TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

I'm not going to cryptographically sign my Git commits, and you shouldn't either

2 pointsby azeembaover 1 year ago

2 comments

stephenrover 1 year ago
I have to admit I only skimmed a lot of this extremely long winded rant and didn&#x27;t get to the end, but AFAICT they&#x27;re claiming the only &quot;benefit&quot; is a &quot;little verified tick&quot; and that one of the cons is <i>accepting responsibility</i> for previous commits.<p>I don&#x27;t think either of those is a fair or accurate assessment.<p>A signed commit tells you exactly one thing: the person who made the commit is who they say they are, according to the signing key used.<p>That&#x27;s it. It&#x27;s essentially a defence against the nature of git where commits are decoupled from centralised authentication, and thus anyone can make a commit with anyone&#x27;s name on it.<p>Signing doesn&#x27;t prevent you making the commit in the name of someone else (unless you reject unsigned commits) but it stands out as being unsigned.
skull723over 1 year ago
Git is not GitHub. Also, the author should consider going into politics.