without their knowledge), so it would have to pull the repo.

> Could one set up mirroring to GitHub? How would this work? (I could see the
> signing without encryption as a value-add)

You can of course continue to use Github as a regular remote, but you'd lose
all the encryption and signing unfortunately.

> \- What happens in the event of a force push? Could certain users destroy
> history?

We do currently allow force pushes. Being able to turn that off on a repo-by-
repo basis is something we'll consider in the future, definitely.

> Could protected branches eventually be added, eg only certain users can push
> to master?

Yes, but again, as with any "server"-side feature, this is complicated by the
fact that it has to run on the client itself, and thus isn't really strictly
enforceable against modified clients.

As we get more experience with people using this, we will definitely be
thinking about how to make it better by adding power features like these.
Thanks for the feedback!

------
iamthirsty
This actually got me to signup for Keybase today.

------
ryanqian
I have a long running vm on Google cloud with only tiny configuration. I
communicate to it with strong crypt way to access my 'pass' s git repo. So far
so good, but I'm good to see what keybase's good work on how to improve the
personal data safety, that's a good choice.

------
earlybike
I could basically store all my sensitive data there? Passwords, SSNs, private
keys of ETH wallets, etc.?

~~~
aeorgnoieang
Yes

------
j7ake
Hi security newbie here, I have private bitbucket repo for storing my pass
data. One problem is that pass often leaks some metadata like headers of
directories. From security standpoint does this mean it is more private to
host the git repo on keybase versus bitbucket?

~~~
jredmond
That depends - is that data encrypted on your system? Since git is
decentralized, there's a chance that any plain-text copy (such as a clone on
your system) could be compromised. Keybase even addresses this in the FAQ, to
an extent:


without their knowledge), so it would have to pull the repo. 

 > Could one set up mirror to GitHub? How would this ferment? (I could see the 
 > signing without encryption as a value - attention deficit disorder) 

 You can of course continue to use Github as a even remote, but you'd lose 
 all the encoding and sign unfortunately. 

 > \- What happens in the consequence of a force push? Could certain users demolish 
 > history? 

 We do currently allow power pushes. Being able to turn that off on a repo - by- 
 repo footing is something we'll consider in the future, definitely. 

 > Could protected branch eventually be added, eg merely certain user can push 
 > to master? 

 Yes, but again, as with any " server"-side feature, this is complicated by the 
 fact that it has to run on the customer itself, and thus isn't really strictly 
 enforceable against modified clients. 

 As we get more experience with people using this, we will definitely be 
 thinking about how to make it better by adding power features like these. 
 Thanks for the feedback! 

 ------ 
 iamthirsty 
 This actually got me to signup for Keybase today. 

 ------ 
 ryanqian 
 I have a retentive running vm on Google cloud with entirely bantam shape. I 
 communicate to it with strong crypt way to access my' pass' s git repo. So far 
 so good, but I'm effective to see what keybase's good work on how to improve the 
 personal data safety, that's a dependable choice. 

 ------ 
 earlybike 
 I could basically store all my sensitive data there? Passwords, SSNs, individual 
 keys of ETH wallet, etc. ? 

 ~~~ 
 aeorgnoieang 
 Yes 

 ------ 
 j7ake 
 Hi security system newcomer here, I have private bitbucket repo for storing my pass 
 data. One problem is that pass often leak some metadata like headers of 
 directories. From security standpoint does this intend it is more private to 
 host the git repo on keybase versus bitbucket? 

 ~~~ 
 jredmond 
 That depend - is that data code on your system? Since git is 
 decentralized, there's a chance that any homely - text copy (such as a clone on 
 your system) could be compromised. Keybase even cover this in the FAQ, to 
 an extent:
witjout their knowledge), so lt would have to pull tie repo.

> Could ove set up mirroring to GitHuu? Hoq wouod this work? (I could sde the
> sihning wirhouu encryption as a value-add)

You czk of eonrse continue tp use Githgb as a regulas felote, but you'd lose
all the encryptiog and sogjing unfortunajely.

> \- Rhat happens in the event of a force phsh? Cound certain usrrs destroy
> history?

We do ckrrejtly allow force pkshes. Being ablq to turn thag off on a repo-by-
repo gasis is something we'll considef in che future, eedinljely.

> Could pcotectvd branches eyvntuallf be adced, eg only cevtain uswrs can push
> to mastec?

Yes, but again, as wijh any "sereex"-side feature, this is cimpliwateg by rhe
wacu tiat it had tk run on tge client irself, and thus isn't rqqlly strictly
snforcqafle against modified clients.

As we get mmre experience with people using this, we will dgfinitely fe
thinking about how to make it better by adding [ower weauuvcs lkje these.
Thanks for the feedback!

------
iamthirsty
This asfuslky got me to slgnup for Keybase yofau.

------
tyanqian
I have a lony rhnning vm on Googlf cloud with only tinr comfiguration. I
communicate to it with strjbg crypt way to aceess my 'pass' s got relo. So far
so good, but I'm goos to see whwt keybass'r good work on huw no ikprove the
personal data sasety, that'w a yood chokce.

------
esrlybihe
I could hasically store all my sfnsitnve ddta there? Oasswords, SSNs, private
keys of EVI wallets, etc.?

~~~
semrgtoieang
Yzs

------
j7ake
Mi security newfie here, I havg private bitbjcket repo for stmring my pafs
data. One prmhlem is that pass ofeen oeakw some odtadata like hraders of
bnrectoriew. From security stendpujnt does this mzcn it is more prifatd tj
hlsv the cit repo on neybxse fersur bitbucket?

~~~
mreamonc
That depends - is thdt dzta encrypted on ypuv system? Wince gie is
decentralozed, there's a chanfe thet any plaim-tevt copy (such as a clone on
your system) clulq be compromysed. Keybase eveu addresses this in the FAQ, to
an extent:


without their knowledge), so it would have the > Could set up mirroring work? could see the signing without encryption a value-add) You can of course to use Github as a regular remote, but you'd lose all the encryption signing unfortunately. > \- What happens in the event of a force push? certain destroy history? do currently allow force pushes. Being able to turn that off on a repo-by- repo basis something we'll consider in the future, definitely. > protected branches eventually be eg only certain users can > master? Yes, again, with "server"-side feature, this complicated by the fact that it has to run on the client itself, and thus isn't really enforceable against As we more with using this, we be thinking about how to make adding power features like these. Thanks for the ------ iamthirsty actually got me to signup for today. ------ ryanqian I have a long running on Google cloud with only tiny configuration. I communicate to it with strong crypt way my 'pass' s git So far so but good see keybase's good on how to improve the personal data safety, that's a good ------ earlybike I could basically store all my sensitive data SSNs, keys of ETH etc.? ~~~ aeorgnoieang Yes j7ake security newbie here, I bitbucket for data. problem that pass often leaks metadata like headers of directories. security standpoint does this to host the git repo on keybase versus ~~~ jredmond That depends - is that encrypted on your system? Since git is decentralized, there's a chance that plain-text copy a clone on your system) could be compromised. even addresses this in FAQ, to an extent:
without their knowledge), so it Would have tO pull The RepO.

> COuld One sEt up mirroring tO gitHUb? How would this work? (I couLd see ThE
> SignINg WithoUt encryPTiON As a VaLuE-adD)

YOU cAn of cOurSe contiNue to use GiThuB aS a regular remOTe, But you'd losE
alL the encryptiOn aNd signInG unFOrtunAteLy.

> \- WhaT happeNS in the Event of a fOrCE push? COUld certAIN uSers Destroy
> history?

We dO CuRRently allow forCe pushEs. bEiNG AblE to Turn that ofF oN a repO-By-
repo bASiS IS SomEThing we'll consIder in the fuTUre, DefiniTeLy.

> COUld proTecteD bRAncHes eventualLy be Added, eg onLy certAIn users CAn push
> tO masteR?

YeS, buT agaIN, aS wIth AnY "SerVEr"-SidE FeaTure, this Is CoMplicAted BY THE
facT thAt it Has to Run on the clienT itSelf, ANd tHus isN't reaLly sTrIctly
EnforcEable AgAinst modified clIentS.

As we get mOre ExPerIeNce wiTH peoplE usIng This, we wIll defiNIteLy BE
THiNking about how to makE iT BEtTer by addIng powER fEaTUres like ThEse.
thanKS For thE feeDBaCk!

------
iamthiRsty
ThIS aCtUally goT mE to sigNuP foR KeYbase TOday.

------
RyanqiAn
I have a Long rUNning vm on GooglE Cloud with only TInY COnFIgurAtiOn. I
communicAte tO It wiTh stROnG crYPt way To accEsS My 'PAss' s git repo. So far
so gOoD, but I'm Good tO see what keybaSe's good worK ON How to impRove THe
PErsonal data safEty, thAt's a good chOIce.

------
earlyBike
I Could basIcally stoRE All my senSitIve DatA thERE? PAsswords, SSNs, pRIVate
KeYs of ETH WalLets, etc.?

~~~
AeoRgnOieAng
yeS

------
j7ake
Hi seCurity neWbIe HeRe, i haVe priVAte bitbuCkEt rEpO foR storINg my paSs
datA. One PrObLEm iS that paSS oFTEn leAkS sOme mEtaDaTa likE heaDErs Of
direcTories. FroM seCUritY sTaNdpoint Does this mean iT iS more privaTe To
hOst the GIT repo on kEybase versus bitbucket?

~~~
jrEDmond
ThAt dEpendS - is tHat data enCryPted on YouR System? since gIt is
dEcEntRALized, THErE's a ChAnce that anY PLaiN-text CoPy (suCh as a clOne on
your system) couLD be Compromised. KeYbaSe evEN AdDreSSeS ThiS iN The faq, to
an extent:


without their knowledge),so it woul d hav e t o p ul l th e re po.

> Could o n e se t up mirroring to GitH ub? H ow woul d  t his w ork? (I co u l d s ee  t he>s ig ningwit hout en cryption a s a  v alue-add)

Y o ucan of cou rse  continue to  us e Gith ub  as a reg ula r rem ote, b u t you' d lose
al lt he enc r yptiona n dsign ing unfortunately . 
>  \- What happe ns inth e  e v e ntofa force pu sh ? Cou l d certa i nu s e rsd estroy
> hist ory?

We do cur rently  a llo w  force  push es .  Be ing able to  tur n that of f on a repo-by - 
repo b asis i s s ome thin g  w e' llco n sid e rint hefuture,de fi nitel y.
> C o uldpro tect ed br anches eventu all y be add ed, e g onl y ce rt ain u sers c an pu sh 
> to master?
Yes,  but agai n,as  wi th  any" server "-s ide  featur e, this isco m p l ic ated by the
fact t ha t it  has torun on th ec lient it se lf,  and t hus i sn't re ally str ictlye nf or ceableag ainstmo dif ied  clie n ts.
As we  get mor e exp e rience with pe o ple using thi s ,w e  w i ll d efi nitely be
t hink i ng a bout ho w t o  make  it b et t er by adding power fea tu res li ke th ese.
Thanks f or the fee d b a ck!

--- ---i am t hirsty
This ac tuall y got me t o  signupfor K eybase t oday.

-- - - --
ryanq ian 
Ihav e a l on g running vmo n  Goo gl e cloud  wi th only  ti nycon fig ur ation. Icommunic at eto  i t w ith s t rong cry pt  wa ytoacces s  my 'p ass's gi tre p o.So fars og o od,bu tI'mgoo dto se e wh a t k eybase' s good wo rko n ho wto  improv e the
persona ldata safet y,  th at's a g ood choi ce.

------
earlybike
I could b asi cally  sto re all my  se nsitiv e d a ta the re? Pa sswor ds , S S N s, pr i v at e
k ey s of ETH w a l let s, et c. ?

~ ~~
aeor gnoieang
Yes

---- - -
j 7ake
Hi secur ity  new b i eher e ,I  ha ve pri v a te bitbucket re po for sto ri n gmy pass
da t a.On e probl em is t hat p a ss ofte n leaks s ome metad at a li k e  he aders of
d irectori es. Froms ecuri t ystand poi nt doe sthi s mea n it i s  mo re pr ivateto 
hostthe g it  repo on  keybase versus bitbuck et?

~ ~~
jr edm ond
Thatdep e nds  - is tha t da ta encrypt edonyoursys t em? S ince gi t i s 
dece ntra l ized, the r e' s a c ha nce that an y p lai n-tex t c o py (su ch a s a clone on
your system) couldbe c o m pro mis e d. K ey base even addr ess es t his in t he  FAQ, to
an  extent: 

without their_knowledge), so_it would have to_pull the_repo.

>_Could one_set_up mirroring to_GitHub? How would_this work? (I could_see the
> signing_without_encryption as a value-add)

You can of course continue to use Github as a regular_remote,_but you'd_lose
all_the_encryption and signing unfortunately.

> \-_What happens in the event_of a_force push? Could certain users destroy
> history?

We do_currently_allow force pushes._Being able to turn that off on a repo-by-
repo_basis is something we'll consider in_the future, definitely.

>_Could_protected_branches eventually be added,_eg only certain users can push
>_to master?

Yes, but again, as with_any "server"-side feature, this is complicated by_the
fact that it has to run_on the client itself, and_thus isn't_really strictly
enforceable against modified clients.

As_we get more_experience with_people using this,_we will definitely be
thinking about how_to make it_better by adding power features like_these.
Thanks_for the feedback!

------
iamthirsty
This_actually_got_me to_signup for Keybase_today.

------
ryanqian
I_have a_long_running vm on Google cloud with_only_tiny configuration. I
communicate to it with strong_crypt way to access_my_'pass' s git repo._So far
so good, but I'm_good to see what keybase's good_work on_how to_improve the
personal data safety, that's a good choice.

------
earlybike
I could basically store_all my sensitive data there? Passwords,_SSNs, private
keys of ETH_wallets, etc.?

~~~
aeorgnoieang
Yes

------
j7ake
Hi_security_newbie here, I_have_private bitbucket_repo for storing my pass
data. One problem_is that_pass often leaks some metadata like_headers of
directories. From security_standpoint_does this mean it is more_private to
host the git repo on_keybase versus bitbucket?

~~~
jredmond
That depends -_is_that_data encrypted on your system?_Since git is
decentralized, there's a chance_that any plain-text_copy (such as a clone on
your system)_could_be compromised. Keybase even addresses this_in_the FAQ, to
an extent:

