This looks like a political statement, not like a serious security measure. "No sane person would say the things this guy is saying, so he must have been hacked." Like the Soviet Union where political opponents would be declared to be insane to silence them.
What damage are they afraid he will do with commit access? Wouldn't it be better to wait for him to commit so they can see what the "hacker" is trying to accomplish?
> What damage are they afraid he will do with commit access?
A lot of people run Bitcoin Core directly from the github repo without checking the git commit signatures; someone who pushed a backdoored commit to that repo could easily steal funds.
> A lot of people run Bitcoin Core directly from the github repo without checking the git commit signatures; someone who pushed a backdoored commit to that repo could easily steal funds.
No one should be running Bitcoin Core from the repo without checking git commit signatures; not everyone whose account gets hacked will post on a blog rather than pushing underhanded but otherwise normal looking commits to the repo - the 'we can prevent damage by revoking access because we saw a weird looking blog post' is just a laughbly bad excuse for a security practice.
Commit signatures do nothing to verify that his device wasn't hacked, it just verifies that someone got access to his key. Geeze this is just stupidity all the way down.
In addition to having the access keys to github, it also requires access to the secret in the pgp key which gives you identity proof. Ideally that's password protected too.
How do you make sure the real Gavin gets the account? Why not just wait for things to clear out and then give him access again. And I guess he can still submit pull requests in case he needs to get a change in.
We aren't putting letters into bottles and throwing them into the ocean, they could video conference with each other easily.
This is all a facade from people who think everyone is dumb enough to believe them. Its like a child being caught with chocolate all over their face saying they didn't steal a candy bar.
Maybe Peter Todd is the one that hacked into Gavin's blog. They've had an ongoing public disagreement for some time and Peter could benefit from making Gavin look bad.
It's too late to edit this comment but new information leads to yet another alternative explanation: Gavin (and others) actually did witness Craig sign a message with one of Satoshi's private keys, and "verify" it on a computer controlled by Craig. Shenanigans were involved that made the phony signature appear to verify. Gavin (and others) were deceived.
What damage are they afraid he will do with commit access? Wouldn't it be better to wait for him to commit so they can see what the "hacker" is trying to accomplish?