• 0 Posts
  • 10 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2024

help-circle




  • In my work organization, we don’t allow pushes from users that have not signed their commits. We also frequently make use of git blame along with git verify-commit. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We’re a medium-sized FinTech organization though, so it’s very important we keep track of who is touching what.

    That said, I can’t see it being all that important to an individual unless they’re very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and home-manager, I use the programs.git module to setup automatic signing and key selection. I really haven’t touched it at all in years now. It was very “set it and forget it” for me.





  • Why, is it impossible or difficult to enforce?

    Not sure, that’s why I asked out of curiosity. But I would assume so; it’s very easy to get WireGuard setup on a Raspberry PI or just about any SBC. For example, you could setup a SBC with a usb WiFi adapter, travel to a state where VPNs aren’t banned, connect to public WiFi and with a little additional config (changing ports), you’re good to go.