Show HN: Git-remote-s3 – push and pull Git repos to/from s3, encrypted using GPG | Hacker News Reader

Show HN: Git-remote-s3 – push and pull Git repos to/from s3, encrypted using GPG

github.com

79 pointsbgahagan16 comments

i have been using keybase's encrypted git repos and it has been great. highly recommended as a possible alternative to this.

https://keybase.io/blog/encrypted-git-for-everyone

If I may plug my own app, EasyGit is a third alternative for macOS users. It pushes git repos to iCloud.

https://easygit.app

I think the key context here is "encryption" which your app doesn't have.

EasyGit data are encrypted by Apple. So it is on par with using KeyBase or GitHub. I give you that it is not the same as rolling your own crypto, but I was replying to a comment about KeyBase.

Don't know anything about keybase, can keybase see the data in your encrypted git repos?

No, they are end to end encrypted.

https://keybase.io/blog/encrypted-git-for-everyone

Wow, sir, you are presenting yourself as a little bit clueless. Keybase's whole shtick is thorough end-to-end encryption on all of their products. They're not "rolling their own crypto". They use established, proven cryptography to share keys between your devices without ever having access to your private keys themselves.

Apple, on the other hand, can see everything you upload to iCloud Drive, iCloud Photos etc. Don't believe their marketing, they only do e2e on the Keychain and Messages - and even then the clients have no way of making sure the recipient's key they received from Apple actually matches their private key. So Apple could fool both sides, give them keys generated by Apple and decrypt everything on their servers when requested by authorities like fucking China (a.k.a. MITM).

Sorry, I was referring to the S3+GPG solution. However as far as I know the Keybase client is closed source, so everything you say also applies to them.

The keybase client is open source: https://github.com/keybase/client

GPG is designed to be used by end users. It's a bit cumbersome, but you don't have to implement any algorithms, which is what I assume is meant by 'rolling your own crypto'.

That E2E encryption sure must be easy when you just handwave away key distribution. At least that's still not as bad as when FileVault discarded the user's password hint and instead used the plaintext password itself as the hint.

I have failed at understanding how to set this up. How do I use it while installing the bare minimum amount of keybase? Why is it necessary to use their website with keybase git? Can't I use the cryptography without their key exchange?

I got a bad feeling trying to use the app last time.

All you have to do is install Keybase, then when you load the app you click "git" in the menunav and create a repository for yourself or a team. It's easy. :)

The trick is, apparently, doing it without sending anything to Keybase

I guess it’s somewhat possible if someone did the effort to Port their server code?

Very cool project! But be wary using something like this on large repos with lots of objects, S3 PUT pricing is obscene and you may end up with a surprising bill...

Reply on news.ycombinator.com