Top all-time · #2960
Mike Gerwitz
Personal blog · mikegerwitz.com · on HN as mikegerwitzsecurityprogramming
Mike Gerwitz's personal blog at mikegerwitz.com covers security and programming. Since 2012, 26 different Hacker News readers have linked it 49 times, most often “A Git Horror Story: Repository Integrity With Signed Commits”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN readers mostly link Mike Gerwitz's 2012 'git horror story' paper on trusting git history and commit signing. His GNU ease.js paper and a few other posts are cited less often.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- A Git Horror Story: Repository Integrity With Signed Commits9 people · 9 mentions · first linked 2014-01-18
- A Git Horror Story: Repository Integrity with Signed Commits (2012)5 people · 5 mentions · first linked 2016-04-05
- GNU/kWindows3 people · 5 mentions · first linked 2016-04-07
- A Git Horror Story: Repository Integrity With Signed Commits2 people · 2 mentions · first linked 2012-05-22
- A Git horror story – repository integrity with signed commits2 people · 2 mentions · first linked 2014-01-03
- A Git Horror Story: Repository Integrity with Signed Commits (2012)2 people · 2 mentions · first linked 2019-11-01
- /about/githubbub2 people · 2 mentions · first linked 2016-01-15
What Hacker News says?
Great work! I just happened to stumble into Mike Gerwitz's (2012) Horror Story [1] today about trust in git. This is great for safety. [1] https://mikegerwitz.com/papers/git-horror-story
Comment linking /papers/git-horror-story
on “Keybase launches encrypted Git”Submitted A Git Horror Story: Repository Integrity With Signed Commits as a story · 163 points
HN discussionYou might be interested in this: https://mikegerwitz.com/projects/git-shortmaps/about/ It creates the aliases as you do, but also includes tab completion, and only takes effect when you're in a repository path.
Comment linking /projects/git-shortmaps/about/
on “Little Things I Like to Do with Git”Submitted A Git Horror Story: Repository Integrity with Signed Commits (2012) as a story · 89 points
HN discussionI ended up writing a full compiler stack in XSLT for declarative, XML-based DSLs[0][1] and a few targets (mainly JavaScript and HTML). It didn't start out as that, but having already written basic HTML/JS generation from a simple DSL, it evolved from there. It was originally written in XSLT 1.0 so that it could generate in the web browser, which had some serious limitations and was incredibly verbose. XSLT 2 is much…
Comment linking /hoxsl/manual/
on “SVG can do that?”Submitted A Git Horror Story: Repository Integrity With Signed Commits as a story · 89 points
HN discussionTalk to others. More importantly, learn _how_ to talk to others. Know your audience. Learn what examples turn people on and off---what gets their attention vs. what sounds like a parent lecturing to their child. You don't want to put people on the defensive. Learn how to relate it to them. Learn how to make them _understand_ the problem and why it's important---otherwise they won't care, or if they do, it'll be shor…
Comment linking /talks/sapsf.pdf
on “Ask HN: What are we doing about Facebook, Google, and the closed internet?”Submitted GNU/kWindows as a story · 57 points
HN discussionIn addition to account compromise, there's also the risk of bugs/compromise of GitHub itself: https://github.com/blog/1068-public-key-security-vulnerabili... Commit signing can help to mitigate that.[0] Note that GitHub now offers the ability to add your GPG public key to your profile and show whether a commit is signed with that key or not. I find this more dangerous than useful: if an attacker compromises the acco…
Comment linking /papers/git-horror-story
on “Curl’s backdoor threat”Submitted A Git Horror Story: Repository Integrity with Signed Commits as a story · 18 points
HN discussionThird-party scripts aren't just a performance problem---consider privacy/trackers as well. I gave a talk at LibrePlanet 2017, where one of the things I showed is the drastic effect disabling JavaScript has on third-party scripts, graphed by Lightbeam: https://mikegerwitz.com/talks/sapsf.pdf (slide 60 / pg 115, "The Web---Mitigations & Anonymity"). There's a bunch of stuff before that slide that's mitigated by JS, in…
Comment linking /talks/sapsf.pdf
on “A day without JavaScript”Submitted Open Source Security with git as a story · 3 points
HN discussionI was amused, after discovering Monotone through the I2P project that you can sign your commits in git too (although in a SCM not written in C++, look around for that famous Linus rant). I was well on board with the idea, like signing my many emails, but even as a rank amateur I have nightmares of waking up like this guy. https://mikegerwitz.com/papers/git-horror-story So I would love tarballs and other things signe…
Comment linking /papers/git-horror-story
on “GPG signature verification”Submitted Signing git commits with gpg - problems and thoughts as a story · 3 points
HN discussionRelated: http://mikegerwitz.com/papers/git-horror-story
Comment linking /papers/git-horror-story
on “Linus Torvalds did not commit this”Submitted On Recent Events in the Free Software Community as a story · 2 points
HN discussionAnother good article on git-signing: http://mikegerwitz.com/papers/git-horror-story
Comment linking /papers/git-horror-story
on “Linus Torvalds did not commit this”Submitted A Git Horror Story: Repository Integrity with Signed Commits (2012) as a story · 2 points
HN discussionhttps://mikegerwitz.com/2016/04/GNU-kWindows
Comment linking /2016/04/GNU-kWindows
on “Show HN: Boot Windows 10 Directly into Linux Desktop of Choice”Submitted A Git Horror Story: Repository Integrity with Signed Commits as a story · 2 points
HN discussion> Before 2007, the way to participate in Open Source was fragmented. Each project had their own workflow, patches circulated in emails, issues were reported in a myriad ways, and if anyone wanted to contribute they had to figure out every project's rules. And it was much better IMO. Now we have a centralized website, in the hands of a single corporation, which requires nonfree JavaScript for much of the basic functi…
Comment linking /about/githubbub
on “An open letter of gratitude to GitHub”Submitted A Git horror story – repository integrity with signed commits as a story · 2 points
HN discussionRichard calls it "GNU/kWindows" (like GNU/kFreeBSD); I wrote an article with his input a while back: https://mikegerwitz.com/2016/04/GNU-kWindows
Comment linking /2016/04/GNU-kWindows
on “Running I3 Window Manager on Ubuntu for Windows”Submitted National Uproar: A Comprehensive Overview of the NSA Leaks and Revelations as a story · 2 points
HN discussiongit supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though: http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-stor...
Comment linking /papers/git-horror-story
on “Juniper hack has U.S. fearing foreign infiltration”Submitted Secure Git Commits as a story · 2 points
HN discussionMy learning falls into a couple main categories: formal study for the sciences (be it math, programming, crypto, etc); and broad research for advocacy and activism. Both of these involve keeping up with current events, the latter moreso than the former; the former can be especially time-sensitive. I don't have the time to put these in any coherent order, so I'll just list some: - Bookmarks. I find much of my informa…
Comment linking /projects/sapsf/tree/slides.org
on “Ask HN: What's your process for learning?”Submitted Classical OOP with Ecmascript as a story · 2 points
HN discussionMike Gerwitz on signing commits: https://mikegerwitz.com/papers/git-horror-story .
Comment linking /papers/git-horror-story
on “Git hash function transition plan”Submitted GHCQ’s “Exceptional Access”, E2EE, Decentralization, and Reproducible Builds as a story · 1 points
HN discussion
