Mike Gerwitz

Those interested in how prototypes and classical inheritance relate (and don't) may be interested in work I did on GNU ease.js, which works with ECMAScript 3+. I have since extended it to support Scala-like traits. https://www.gnu.org/software/easejs/manual/easejs.html#Implementation-… I also wrote a paper on some of the concepts: https://mikegerwitz.com/papers/coope/coope.pdf The `class' keyword in JS still leaves much to be desired; it's just syntatic sugar around the prototype model. There's nothing wrong with that model---it's just important to understand how it differs from what OOP developers traditionally expect.

Great work! I just happened to stumble into Mike Gerwitz's (2012) Horror Story [1] today about trust in git. This is great for safety. [1] https://mikegerwitz.com/papers/git-horror-story

I was amused, after discovering Monotone through the I2P project that you can sign your commits in git too (although in a SCM not written in C++, look around for that famous Linus rant). I was well on board with the idea, like signing my many emails, but even as a rank amateur I have nightmares of waking up like this guy. https://mikegerwitz.com/papers/git-horror-story So I would love tarballs and other things signed, and I do not want to be one of those whiny moochers, but imagine the backlash you get as thankless free software developer when you bork your tag sign or mess up one commit and people through you under the bus, because you cryptographically agreed to it? Haha.

> Before 2007, the way to participate in Open Source was fragmented. Each project had their own workflow, patches circulated in emails, issues were reported in a myriad ways, and if anyone wanted to contribute they had to figure out every project's rules. And it was much better IMO. Now we have a centralized website, in the hands of a single corporation, which requires nonfree JavaScript for much of the basic functionality[1]. Git was designed to work well with email and has commands built-in to format, send and apply patches. I think anyone who used email for patches seriously will agree that they are largely superior to GitHub's pull requests. The free software movement being fragmented is a good thing. GitHub is the land of trends: web developers using Mac OS X who make apps with the latest trendy frameworks like React and Angular (if you think that's a misportrayal, look at the first three pages of the most starred repositories on GitHub[2]). These people don't care about the free software movement, they're just following the current trends, one of which is "Open Source". But if they really cared about free software, they would not be using Mac OS X or GitHub, which requires you to run nonfree JavaScript code in your browser to report issues, open pull requests, etc. The serious projects that do care about free software don't use GitHub. [1]: See Mike Gerwitz's GitHub Does Not Value Software Freedom: https://mikegerwitz.com/about/githubbub [2]:…

To be honest even PGP signing has some issues: it's not clear what does it mean to sign a commit and there is plenty of misuse of that (see [0], `git push --signed` solves some of these issues). Git patch workflow doesn't support signed commits and some kernel devs explore alternative ways of signing [1]. [0]: https://mikegerwitz.com/2012/05/a-git-horror-story-repository-integrit… [1]: https://people.kernel.org/monsieuricon/introducing-b4-and-patch-attest… By "keybase providing alternative" do you mean that they have hosted, encrypted git repos?

Mike Gerwitz on signing commits: https://mikegerwitz.com/papers/git-horror-story.

You are wrong in so many ways. First of all, you are confusing "Microsoft bringing GNU to Windows" with "this is the first time GNU is brought to Windows." Then you go on to make it seem like if the GNU/Linux debate is just the craziness of some guy called RMS: wrong, many people support this distinction. Then you go off-topic talking about why GNU hurd is a mess. None of this contributes to the key topic here: Microsoft only brought GNU, not Linux and not Ubuntu. A topic where you were wrong again. Please read https://mikegerwitz.com/2016/04/GNU-kWindows

git supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though: http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-story-loose-no…

Another good article on git-signing: http://mikegerwitz.com/papers/git-horror-story

1) Repo security is a hard proposition. Using git with an ostensibly(SHA-1) immutable history doesn't imply security. git repo integrity is cool, and I'll just point to interesting discussion of attacks and mitigation in http://mikegerwitz.com/papers/git-horror-story. I'll end my debating with the fact that there is room for improvement. 2) Releasing on time, of high quality, for nearly two decades. Development process.. not that it is some ultimate code or product.

The author's paper on this: http://mikegerwitz.com/papers/coope/coope.pdf

Git's hashes were not always verified all that often in the past (at least, as of 1.7.4.1): http://stackoverflow.com/questions/5585388/which-git-commands-perform-… You'll see plenty of operations do not check the sha1, and will happily hand you bad data, including checkout and clone, depending on circumstances. I haven't checked on the latest version, but at least previously, you'd have to run around using git fsck specifically to get it to notice some sha1 mismatches. So at least trivially, the idea that "it uses sha-1 so it's safe" is silly even without considering the implementation, because it doesn't always check the sha-1 :) (I'm not even going to argue it should, just pointing out it didn't) You can also GPG sign git commits (see http://mikegerwitz.com/papers/git-horror-story.html for a long explanation of what does and does not get checked)

Related: http://mikegerwitz.com/papers/git-horror-story