On: Gavin Andresen's commit access to Bitcoin revoked, hacking suspected

[tacos]

Commit signatures do nothing to verify that his device wasn't hacked, it just verifies that someone got access to his key. Geeze this is just stupidity all the way down.

[bluejekyll → tacos]

In addition to having the access keys to github, it also requires access to the secret in the pgp key which gives you identity proof. Ideally that's password protected too.

It's defense in depth.

[tacos → bluejekyll]

That password is potentially ten lines down in the keylogger report. Depth isn't as deep as you think.