Fascism is the concept this guy is lacking in order to describe what’s happening here, and its consequence: imperialism.

Oh wait, wikipedia:

Vardi is open about his Zionism and is listed as a signatory on an anti-academic-boycott letter “United Against the Academic Boycott of Israel,” that denies that genocide has ever occurred in Palestine, despite an inquiry by a United Nations Independent International Commission and International Association of Genocide Scholars stating that the legal definition of genocide has been met according to the Genocide Convention. Vardi supports a two-state solution and served 5 years in the Israel Defense Forces, participating in two wars during his service. Vardi has remarked that boycotts against Israel on university campuses are “deeply distasteful”.

He is fascist after all, Wow.

Yes you are right, damned! Why git isn’t signing the diff (patch)? This is so wrong on so many level, signing already hash the content, we can sign multiple GiB without any issue.

Welcome welcome : https://lemmy.ml/c/antiai

also https://phtn.lemmy.blahaj.zone/c/AntiAI@lemmy.blahaj.zone

Indeed it is still relevant. I am wondering what does it sign for tags.

EDIT: Are you sure about that? signing the hash felt logical but digging about it this seems a false assumption. git is signing the whole commit object.

Security is achieved through other means.

Let’s explicit this: you can, and should, sign your commits if you want security (no commit tampering). You need to:

• generated a gpg key: gpg --full-generate-key
• set git to look for the public key to use: git config --global user.signingkey [public key ID]
• set git to sign your commits: git config --global commit.gpgsign true

Note that I used --global here but you can do without to sign on a per-project basis.

Also gpg UX is terrible, to find the [public key ID] use the command gpg --list-keys, it should looks like:

pub   ed25519 2026-01-01 [SC] <- type algorithm date and capability (this key is only to Sign and Certify)
      662E3CDD6FE329002D0CA5BB40339DD82B12EF16 <- Public key ID
uid           [ultimate] my full name (Master Key) <my_email@domain.com> <- owner information (should be your name and email address)
sub   rsa4096 2026-01-01 [E] <- sub key used to encrypt
sub   ed25519 2026-01-01 [S] [expires: 2027-01-01] <- subkey used to sign

Last, if you want to save/backup you keys the default location of gpg files is ~/gnupg or you can export keys with gpg --export [key ID] > path/to/file.key for the public part and gpg --export-secret-keys [private key ID] for the private part. Both export can have a -a or --armor argument to output as base64 text instead of raw binary. [private key ID] can be found with gpg --list-secret-keys.

EDIT: after writing this I checked https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work and TIL you can sign tags too.

Thanks for sharing.

Why didn’t I know lobsters before? This look 1000 times better than HN… oh you can’t join. Makes sense it isn’t that known.

It’s sad to see this community only listening to people because they’re rich: there are a lot of better engineers who knows more than this guy but they’re not “co-creator of GitHub”. I read this title as boot licking silicon valley.

That being said you don’t hash git commits for security reason : YOU SIGN YOUR COMMITS FOR SECURITY. Sorry for the caps but let’s make this visible.

I salute the initiative but to be honest I’d prefer a lemmy instance by a long mile (actually always looking for lemmy instances deferated from all the noise).

I can’t stand the discourse UX and I am pretty sure that, like slack, this is a black hole where any message in the middle is lost forever (no one will read them).

AI slop, the guys pretends to be software engineer and outputting posts every day. This is extremely low quality, no wonder he advocates not avoiding AI.