
Timestamping your Github commits - pelle
http://stakeventures.com/articles/2009/08/31/integrating-timecert-with-github
======
kneath
I must be missing something. Isn't that what `git log` is for? Or perhaps
even, the Github interface itself?
[http://share.kyleneath.com/captures/Commit_History_for_kneat...](http://share.kyleneath.com/captures/Commit_History_for_kneath_s_lighthouse_burndown_-
_GitHub-20090831-135056.jpg)

Would really like to hear a real use case for this. As far as I'm concerned,
both Github and TimeCert are unreliable 3rd parties (not like we're talking a
certified notary here), so using TimeCert to "prove" you did something is the
same as using Github to "prove" you did it.

~~~
pelle
I'm the guy behind TimeCert.

The git time stamp is provided by the committer and not a third party. As such
the Git timestamp amounts to a claim by you, that you committed it at that
point. TimeCert simply provides extra backup to that claim.

TimeCert is definitely not a certified notary here (I never paid the $20
application fee nor took a test).

However it is a third party. Whether you choose to trust TimeCert or GitHub is
completely up to you.

However in a dispute the evidence is provided by both TimeCert and Github is
still third party and it isn't possible for you or a disputing party to tamper
with the evidence provided. This evidence could be used in court the same way
ISP logs are used.

TimeCert attempts to be trustworthy. The source is on
<http://github.com/pelle/TimeCert> and the new audit page
<http://timecert.org/audit> shows exactly what code is released.

It would absolutely still be possible for me to modify database records, just
like it would be for your isp to modify mail logs etc. While a very good
question, my reply would be what could I possibly gain from doing that? This
still doesn't remove the question of course and that question is really the
last hurdle.

There are various ways of solving it but it would require some one else
running a similar site. it could be solved by adding a couple of other similar
services in the mix sharing digest feeds that we each time stamp.

In the end it is all about who you decide to trust.

