![](/static/253f0d9/assets/icons/icon-96x96.png)
![](https://lemmy.world/pictrs/image/0943eca5-c4c2-4d65-acc2-7e220598f99e.png)
For the most part, I 90% agree with your stance. However, you can’t take the statement “I have nothing to hide” literally to the extremes. That would be suggesting that the person is okay giving you the passwords for their bank accounts under the guide that they have nothing to hide.
It’s a common colloquial expression which expresses how one accepts the situation as is. I’ve got nothing to hide doesn’t mean that I then consent to a strip search or house search, those are uncomfortable and inconvenient. You can’t always apply the same single justification to support multiple separate events, because you need the full context. Imagine “can I borrow a dollar? sure thing, you’re my friend” Well whoops, you’ve now just given your friend complete reign over all your money for as long as the friend title exists
A more accurate interpretation here is “They’re not collecting any information that I’m embarrassed about”
Sorry, language is messy and oftentimes there are differences between literal and intended meaning. I just wanted to point out why it is indeed, an unfair comparison. You can achieve your point without attacking someone’s (as I argue) correct statement when taken in context, since your underlying point still stands that the majority of people have some limit of sharing information that they would not be comfortable with.
Unless they have access to your private key then there’s no way they can sign code as you.
Alternatively yes, access to your password (and 2fa) would allow them the ability to add an ssh private key for you.
But that’s irrelevant because the issue at hand is that I can make a commit to a repo that I have access to, but using your username, and there’s no way to verify it wasn’t you (actually there is but it requires some assumptions and is also dependent on the git hosting infrastructure)
However when you use signing, key ‘A’ may be able to access a repo but can’t sign commits as key ‘B’, so you can’t have the blame dropped on you for malicious commits (again, unless they also compromised your account/key)