<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Dec 1, 2013, at 9:23 PM, Diane Trout <<a href="mailto:diane@ghic.org">diane@ghic.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Sunday, December 01, 2013 19:34:40 Henry B Hotz wrote:<br><blockquote type="cite">+1 to Dustin's post of 12:16<br><br>On Nov 30, 2013, at 10:51 AM, Diane Trout <<a href="mailto:diane@ghic.org">diane@ghic.org</a>> wrote:<br><blockquote type="cite">So when one of them signed a some Python software I had reason to believe<br>that it was certified by a person I had met. (You can get to stronger<br>levels of trust in a piece of software using signed commits in git).<br></blockquote><br>Could someone please explain what this means? Git uses stronger crypto than<br>PGP?<br></blockquote><br>No git has the option of using GPG keys for signing tags (git tag -s) and <br>commits (git commit -S).<br></blockquote><div><br></div><div>Ah! The man page is a bit sketchy on detail, but sounds like it's doing a real signed MAC as opposed to a simple hash of the content. Nice. Presumably it's equivalent to GPG-signed email.</div><br><blockquote type="cite">Though for people who dislike the WoT, I don't see whats wrong with using the <br>WoT as long as you think of it as providing supportive evidence and not <br>certainty.<br></blockquote><div><br></div><div>There are two halves to the problem: 1) is the crypto done correctly without gaps in what it covers, and 2) does the key used actually belong to who you think it should. WoT provides a plausible way to solve the second problem, and it attempts to model the real-world uncertainties that may attach to that problem. AFAIK it's unique in *not* trying to provide an absolute solution.</div><br><blockquote type="cite">Diane<br></blockquote></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>Personal email. <a href="mailto:hbhotz@oxy.edu">hbhotz@oxy.edu</a></div><div><br></div></span><br class="Apple-interchange-newline">
</div>
<br></body></html>