Hacker News Reader

Anybody can push a commit to a git repo with Linus Torvalds name and e-mail on it. With GPG signing, they can verify that the claimed author signed off on the commit.

View on HN

Except that's not how it actually works (you can push fake commits to your repos). If someone can log into your account (to be able to push fake commits to the account's repos) they can also add their GPG key. The point is that no additional security is added by this feature.

Without this feature, I can push commits up to my repo and claim they were written by you; with this feature, people can tell whether you signed off on those commits.

So what? That implies that someone should believe someone when they say "look, the email address on this commit says this person's name -- it must be that person!". This all comes down to repo ownership. In your fork of a repo, you have the ability to fake any history you want. Why should that bother me? GitHub should stop auto-associating emails to usernames -- that's the actual problem here.

> Anybody can push a commit to a git repo

For folks who haven't seen the Torvalds "graffiti" on github, it's critical to distinguish here: "anybody can push a commit to /their/ git repo".

Reply on news.ycombinator.com