TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

I'm not going to cryptographically sign my Git commits, and you shouldn't either

2 点作者 azeemba超过 1 年前

2 条评论

stephenr超过 1 年前
I have to admit I only skimmed a lot of this extremely long winded rant and didn&#x27;t get to the end, but AFAICT they&#x27;re claiming the only &quot;benefit&quot; is a &quot;little verified tick&quot; and that one of the cons is <i>accepting responsibility</i> for previous commits.<p>I don&#x27;t think either of those is a fair or accurate assessment.<p>A signed commit tells you exactly one thing: the person who made the commit is who they say they are, according to the signing key used.<p>That&#x27;s it. It&#x27;s essentially a defence against the nature of git where commits are decoupled from centralised authentication, and thus anyone can make a commit with anyone&#x27;s name on it.<p>Signing doesn&#x27;t prevent you making the commit in the name of someone else (unless you reject unsigned commits) but it stands out as being unsigned.
skull723超过 1 年前
Git is not GitHub. Also, the author should consider going into politics.