Favorites

The arguments in defense of JWT are the same as PGP: ‣ it supports good crypto, too; ‣ it just needs an opinionated library; ‣ you can use only the good parts; ‣ it’s battle tested; ‣ it’s flexible; ‣ everything can be misused…

You can imagine how I feel about them.

What to use instead of JWS? Super simple.

1. Take the thing you want to sign.
2. Encode it as a string somehow. (I don’t care how. JSON+base64 works.)
3. Sign it with Ed25519. (No other choices. Ed25519.)
4. Put it and the signature in a JSON blob.

{ “sig”: “🔏”, “data”: “📄” }

Paradox 1: Brevity is higher-bandwidth than verbosity (in aggregate reaches more people; in particular conveys more meaning to a single reader).

Paradox 2: Verbose expression is low-effort.

…esp. for technical comms like commit messages, code comments, PR titles, etc.

Apropos of nothing, with the Go module proxy there is no reason not to name your Go packages like http://filippo.io/age instead of http://github.com/FiloSottile/age. It just takes a couple HTML tags.

This way, you are not tied to a code host and can move without breaking your users.