> PGP is bad and needs to go away
how should we sign git commits?
how should we sign git commits?
The two things that PGP does are pretty simple/straighforward. What makes PGP bad is that PGP itself it is really complicated, and the way it is integrated into email etc. is also complicated and carries a lot of historical baggage. But if you just want to make a public/private keypair and then use it to sign & encrypt data, that's pretty easy (or as easy as writing any crypto code can get). Signify, Minisign, and Age are clean, simple implementations.
Age does encryption: https://news.ycombinator.com/item?id=21895671
Of course this is sort of a https://xkcd.com/927/ situation. PGP is already used by everyone so why switch?
https://stackoverflow.com/questions/50150318/sign-git-commit...
-- Voltaire
OK, if you're going to downvote this, please tell me how you plan to convince git and Github to replace PGP with signify? Github in particular has invested significant time building up their PGP support.
Personally, I would be fine with signify, I've used it in the past and I like it, and I think people are right when they say we should move toward more focused, Unix-style cryptographic tools - for greenfield projects.
But that doesn't we should abandon all current uses of PGP, particularly when it's working as well as it is with git and Github. There's absolutely nothing wrong with it. It does what it's supposed to.
It took a long time to get PGP supported by Github, and now you're going to want them to change it?
Edit: If people want to add support to Git for signify, and lobby Github to support it, I'd be in favor. But strongly, strongly opposed to removing PGP support.
https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
And don't complain about downvoting.
But don't order me around. I'm not your employee, kid, or whoever it is you feel you have a right to speak to like that.