The Linux Kernel's PGP Web of Trust

https://blog.kleine-koenig.org/ukl/the-linux-kernels-pgp-web-of-trust.html

74•JNRowe•9h ago

Comments

jmclnx•7h ago

Seems this is related to SHA1 being used on gnupg. Will be interesting on how this plays out when SHA1 in gpg is obsoleted. I am not looking forward to that.

Then there is the added complexity of git using SHA1, I do not know if that has been changed yet.

Fun times ahead.

FWIW, I changed my git commit signing to ssh-ed25519 from gnupg about a month ago.

freeopinion•6h ago

Didn't GPG change its default to ed25519 four years ago?

https://lists.gnupg.org/pipermail/gnupg-announce/2021q2/0004...

kpcyrd•4h ago

ssh-ed25519 is different from a gnupg ed25519 key, since it doesn't have any of the technical baggage that gnupg has. Even with ed25519, sha1 is still hardcoded into RFC4880, the standard that gnupg implements. Fingerprints are typically 40 characters long since they are hex sha1 hashes. There's RFC9580 that changes this to sha256, but it's still very new and currently being finalized.

But even then, when using ed25519+sha256 to generate a signature, you're still going to do this over a sha1 hash because of the way git works.

arccy•3h ago

or... gpg gets obsoleted along with sha1

NooneAtAll3•5h ago

> since more than 20 years.

a bit sad that "since for time_points, for for time_duration" grammar rule isn't as well known as it should

Tomte•5h ago

German. "seit" for both.

owl_vision•1h ago

since we are at time constructs, german also uses "wenn" when english uses "if" or "when".

crote•4h ago

It's his second language. I think we can cut him some slack.

NoahKAndrews•3h ago

It's not like that's even a common mistake, in my experience

immibis•2m ago

"since <duration>" is the normal grammar in German and has the semantics of "since subtract(now, <duration>)" as you would expect

owl_vision•1h ago

from constructive corrections, we learn our grammatical, semantical mistakes, hence we move forward to better understand each other.

seethishat•3h ago

Nice write-up. Thanks for sharing.

Some may not remember BitKeeper being used to maintain the Linux kernel source code and how a discrepancy was found (22 years ago) between that repo and the CVS repo. This kind of led to git and signed commits that we have today, etc.

Here's a short write up: https://blog.citp.princeton.edu/2013/10/09/the-linux-backdoo...

ALICE detects the conversion of lead into gold at the LHC

Launch HN: Nao Labs (YC X25) – Cursor for Data

Sofie: open-source web based system for automating live TV news production

Inventing the Adventure Game (1984)

Past, present, and future of Sorbet type syntax

21 GB/s CSV Parsing Using SIMD on AMD 9950X

New Tool: lsds – List All Linux Block Devices and Settings in One Place

Show HN: Oliphaunt – A native Mastodon client for macOS

Itter.sh – Micro-Blogging via Terminal

Show HN: Aberdeen – An elegant approach to reactive UIs

Show HN: A backend agnostic Ruby framework for building reactive desktop apps

In the Network of the Conclav: How we "guessed" the Pope using network science

Rollstack (YC W23) Is Hiring TypeScript Engineers (Remote US/CA)

LegoGPT: Generating Physically Stable and Buildable Lego

Why 536 was 'the worst year to be alive' (2018)

All BART trains were stopped due to ‘computer networking problem’

Reverse Engineering "DNA Sequences" in the Lost World: Jurassic Park Video Game

Show HN: Hyvector – A fast and modern SVG editor

Show HN: BlenderQ – A TUI for managing multiple Blender renders

Rust’s dependencies are starting to worry me

NSF faces shake-up as officials abolish its 37 divisions

CryptPad: An Alternative to the Google Suite

The birth of AI poker? Letters from the 1984 WSOP

Cell Mates: Extracting Useful Information from Tables for LLMs

Math Machine – A notebook will show your kid how far they have travelled

Data manipulations alleged in study that paved way for Microsoft's quantum chip

"Night of the Living Dead" accidentally became public domain (2019)

The Anarchitecture Group

Odin, a Pragmatic C Alternative with a Go Flavour

Implementing a Struct of Arrays