From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194] helo=mx.sourceforge.net) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1Wnt4r-0007Ta-SV for bitcoin-development@lists.sourceforge.net; Fri, 23 May 2014 17:16:17 +0000 X-ACL-Warn: Received: from serv.jerviss.org ([12.47.47.47] helo=inana.jerviss.org) by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1Wnt4q-0005ZX-EH for bitcoin-development@lists.sourceforge.net; Fri, 23 May 2014 17:16:17 +0000 Received: from [156.99.25.142] ([156.99.25.142]) (username: kjj authenticated by PLAIN symmetric_key_bits=0) by inana.jerviss.org (8.13.6/8.12.11) with ESMTP id s4NGmYgm026797 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 23 May 2014 11:48:38 -0500 Message-ID: <537F7BE2.6010006@jerviss.org> Date: Fri, 23 May 2014 11:48:34 -0500 From: Kyle Jerviss User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 SeaMonkey/2.26 MIME-Version: 1.0 To: Wladimir , Jeff Garzik References: <7B48B9D4-5FB0-42CA-A462-C20D3F345A9A@beams.io> <537D0CE1.3000608@monetize.io> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Received-SPF: pass (inana.jerviss.org: 156.99.25.142 is authenticated by a trusted mechanism) X-Spam-Score: -2.2 (--) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain -0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-Headers-End: 1Wnt4q-0005ZX-EH Cc: Bitcoin Development Subject: Re: [Bitcoin-development] PSA: Please sign your git commits X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 May 2014 17:16:18 -0000 Multisig is great for irreversible actions, but pointless most of the time, which is why no PGP developer or user ever thought to implement it. If you lose a key and an attacker signs a bogus email or commit with it, we all roll back with no lasting harm done. Wladimir wrote: > On Thu, May 22, 2014 at 8:06 PM, Jeff Garzik wrote: >> Related: Current multi-sig wallet technology being rolled out now, >> with 2FA and other fancy doodads, is now arguably more secure than my >> PGP keyring. My PGP keyring is, to draw an analogy, a non-multisig >> wallet (set of keys), with all the associated theft/data >> destruction/backup risks. >> >> The more improvements I see in bitcoin wallets, the more antiquated my >> PGP keyring appears. Zero concept of multisig. The PGP keyring >> compromise process is rarely exercised. 2FA is lacking. At least >> offline signing works well. Mostly. > Would be incredible to have multisig for git commits as well. I don't > think git supports multiple signers for one commit at this point - > amending the signature replaces the last one - but it would allow for > some interesting multi-factor designs in which the damage when a dev's > computer is compromised would be reduced. > > Sounds like a lot of work to get a good workflow there, though. > > My mail about single-signing commits was already longer than I > expected when I started writing there. Even though the process is > really simple. > > Though if anyone's interest is piqued by this, please pick it up. > > Wladimir > > ------------------------------------------------------------------------------ > "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE > Instantly run your Selenium tests across 300+ browser/OS combos. > Get unparalleled scalability from the best Selenium testing platform available > Simple to use. Nothing to install. Get started now for free." > http://p.sf.net/sfu/SauceLabs > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development