Can I just use NIP-39 to verify my identity instead?
Good Afternoon folks: Well, on Nostr, this might be a slightly redundant message (events are signed and there are plenty of web of trust relays around) but please don’t let others impersonate you as easily as "Linus Torvalds" over here: https://github.com/jayphelps/git-blame-someone-else/commit/e5cfe4bb2190a2ae406d5f0b8f49c32ac0f01cd7. Especially in situations where this is entirely preventable.
Just… sign your stuff! Don’t put your users at risk. Don’t let laziness, advocacy for other tools or conspiracy theories dissuade you from doing it.
Yes, Nostr has its own emerging alternatives. Also, software like AGE (for encrypting files) and Sigstore (for software supply chain security) are also shaping up nicely. But in many contexts, not only is PGP not dead, it’s still the most widely available and arguably the best option around.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Good afternoon, folks! Just a quick reminder: PGP isn't dead. Sign with pride!
Signed with my GPG key: 1BBD C23D 1853 255D 6415 D2EC 814E DF85 1AAB 370E
#OpenPGP #GPG #Cybersecurity #Tech #DigitalIdentity #SignYourCode
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQTHaQ+iFRwfaXx+TxhjUbpCCVDiNAUCZ7cd5gAKCRBjUbpCCVDi
NOZSAPoDPFoZXKuxya98iY6nAV6hzgOghpqF/OtOVSW4qtEdMQEA3x/jqaD4R9vo
qi89wA4Hsd4KeqwTSQxKDECesI+W8QU=
=3gty
-----END PGP SIGNATURE-----
-
@anthony@accioly.social 🔗 https://accioly.social/users/anthony/statuses/114036190256089233
Discussion
You can, for instance, use NIP-39 to verify that you have control of a certain GitHub account. This can be useful for other Nostriches.
Regardless of NIP-39 though, unless you are signing your commits, it's pretty easy for other people to create a commit linked to your real GitHub account. All that they have to do is have a look at some of your commits, figure out what e-mail address you are using and push any commit with this email address. See "Linus Torvalds" example above. Unless you are signing your commits and have vigilant mode enabled, there will be no visual indication that this commit didn't come from you. And this is only step 1 out of 100 that can be exploited if artifacts aren't being signed throughout the software supply chain.