Security
Practical, hands-on guides to handling secrets, keys, and credentials on developer machines – the operational side of security, as distinct from the cryptographic theory covered under Computer Science. The concern here is mundane and constant: private keys, API tokens, and .env files accumulate across a machine, and in a repository full of smart contract deploy scripts, a leaked key is not a recoverable mistake.
The first three pages describe one stack, and read best from the top down.
pass is the interface: a thin shell wrapper over GPG and git that keeps every secret as an individually encrypted file in a versioned store, so you get history and sync without ever committing plaintext.
GPG is the engine underneath it – the OpenPGP implementation doing the actual encryption and signing, and worth understanding directly because pass inherits its key model, its trust model, and its failure modes.
YubiKey is the hardening step. Its OpenPGP smartcard applet holds the GPG private key on the device, so the private material never touches disk and never leaves the hardware – decryption happens on the key, with a physical touch, or it does not happen at all.
Identity separation is the practice of keeping two sets of accounts so that nobody outside can show one person is behind both. It concerns a different property of a key, or of the email address stamped on each commit: not whether it stays secret, but which person it points to. A key can be guarded perfectly and still tie a pseudonym to a legal name by being offered to the wrong server.