|
|
Log in / Subscribe / Register

Verify the identity of developers

Verify the identity of developers

Posted Mar 30, 2024 7:39 UTC (Sat) by epa (subscriber, #39769)
In reply to: A backdoor in xz by mss
Parent article: A backdoor in xz

It’s probably a dystopian future none of us want. But what if GitHub required all contributors to use their real name and strongly verified their identity? Then for key roles you could require someone with a clear track record and resident in a Western country where they could be prosecuted for maliciously introducing backdoors.

Of course “moles” could still exist, but they would be much more difficult for hostile nations to create than an entirely fake identity like Jia Tan. To add a backdoor the easiest way would then be to compromise some developer’s workstation or steal their private key. Which is by no means impossible, but raises the difficulty somewhat, and is harder to do undetected.

It wouldn’t even need to be GitHub. If Debian started using git sources for releases (no more downloading of random tarballs), a further step would be to require signing of each individual change in the repository (via signed tags or something, I don’t know the details, but it’s possible somehow) and then not trust changes from a new contributor until that person has visited a Debian keysigning party. Again, hardly watertight, but better than no checks at all.

Most of the discussion here has focused on supply chain measures. And I agree with that approach—not trying to “catch the bad guys”. But once the weakest links are tightened, and accepting the fact that we will never have enough reviewers to check every commit, it could make sense to review the people themselves.

to post comments

Verify the identity of developers

Posted Mar 30, 2024 8:08 UTC (Sat) by immibis (subscriber, #105511) [Link] (1 responses)

They sort of are, since GitHub introduced mandatory SMS 2FA for anyone it considers important enough.

Verify the identity of developers

Posted Mar 30, 2024 9:28 UTC (Sat) by pabs (subscriber, #43278) [Link]

There are non-SMS forms of 2FA allowed, TOTP for example, which anyone can do without any identity checks using just software.

Verify the identity of developers

Posted Mar 30, 2024 9:48 UTC (Sat) by kazer (subscriber, #134462) [Link]

> But what if GitHub required all contributors to use their real name and strongly verified their identity?

That is meaningless when GitHub is used just as a mirror and real commits happen elsewhere.
You would need to require that in every repository for everyone contributing.

Something having PGP/X.509 signature for every committer and commit would be part of the solution, but in case someone decides to turn to the dark side you still need to review every change.

And key here is that these changes were not sufficiently reviewed since we don't know if the account was compromised or not.

Verify the identity of developers

Posted Mar 30, 2024 10:51 UTC (Sat) by mss (subscriber, #138799) [Link] (10 responses)

But what if GitHub required all contributors to use their real name and strongly verified their identity? Then for key roles you could require someone with a clear track record and resident in a Western country where they could be prosecuted for maliciously introducing backdoors.

This would be blatant discrimination of most of the world population, which isn't lucky enough to live in a Western country.

And if you drop the "Western country" requirement then a rogue nation-state is in the best position to provide its operatives with as many "genuine" identity verification documents as they might need.

Verify the identity of developers

Posted Mar 30, 2024 12:38 UTC (Sat) by epa (subscriber, #39769) [Link] (9 responses)

Yeah… I didn’t say it would be nice. For security sensitive jobs it’s standard practice to do background checks and to require the person be a US citizen, or whatever. And the check that the person exists (and isn’t a made-up identity or pseudonym) is so basic for any job that it’s not even mentioned.

Anonymous or pseudonymous entities (like “Satoshi”) can make valuable contributions but it may be unwise to put them in a trusted position where code they write is directly executed or installed on millions of systems.

Verify the identity of developers

Posted Mar 30, 2024 17:54 UTC (Sat) by sjj (guest, #2020) [Link] (8 responses)

Believe it or not, but there are legitimate “security sensitive jobs” that are not in the US, or require American citizens.

Would for example Kenyan devs be “Western” enough for you?

Verify the identity of developers

Posted Mar 30, 2024 19:52 UTC (Sat) by epa (subscriber, #39769) [Link] (7 responses)

Indeed, I was using Western as shorthand. And now we get into politics. There is surely a scale with rogue states like North Korea on one side and … some other countries on the other side. LWN isn’t the place for a discussion of whether a developer in Kenya can be considered a real person (not a fake identity made by security services) and whether some country has enough rule of law that someone doing malicious things would be prosecuted (rather than sheltered by the authorities). We are not discussing a technical proposal. It gets messy and of course there are those who don’t trust the USA or allies either. All I can say is that we may be forced, unhappily, to start thinking about this stuff.

Verify the identity of developers

Posted Mar 30, 2024 21:33 UTC (Sat) by MarcB (subscriber, #101804) [Link] (6 responses)

Politics are unavoidable, if you go that route. For example, the US in particular is a proven bad actor here - recall the Snowden revelations about the supply-chain attacks the NSA pulled off. They literally did what nowadays Chinese suppliers are alleged to do - and they used this against supposed allies as well, so there isn't even a "western world against China/Russia" scenario.

This "scale of rogue states" you envision would be one that goes downhill in every direction, no matter from whose perspective you look at it.

Also, if you assume nation-state attackers - which you should - and assume that developers will be working from their home country, then any meaningful verification is simply impossible. It is even unreliable and expensive if you hire employees and have them move to your country. If they stay abroad, it simply can't be done.

Verify the identity of developers

Posted Mar 31, 2024 8:54 UTC (Sun) by epa (subscriber, #39769) [Link] (5 responses)

Indeed the US has a record here and if I were running a nuclear installation in Iran I would require verified Iranian programmers working within the country. But for the rest of us, there is a difference between western countries and others. Many American businesses and even the government rely on the security of Linux and free software. The black-helicopter guys generally have an interest in helping keep free software secure against attacks from ransomware gangs and hostile nation hacking teams. They may do targeted attacks but it doesn’t help them to poison the well as happened here. So I would still prefer to trust a developer with a known legal identity in a US ally over someone who may not be a real person at all. But again, this is politics, and not something where you’ll ever get everyone in agreement.

Verify the identity of developers

Posted Apr 1, 2024 13:28 UTC (Mon) by farnz (subscriber, #17727) [Link] (4 responses)

The USA has a track record of attacking its allies via secret programs (as does every other Western democracy I've looked into - the USA is not unique here). There's thus a constant tug-of-war going on; do I trust the USA because they'd prefer me to do well rather than their enemies, or do I distrust them because they would prefer to attack me in order to benefit the USA and American companies at my expense?

Purely in terms of "can I trust their home nation", the only safe developers are those with the same national affiliation as you, since whatever leverage the nation-state can apply to them can also be applied to you. And that, fundamentally, comes down to a personal trust matter; can you trust the people you depend upon, or not? Can you "trust, but verify"? Or are you stuck with an untrustworthy partner whose behaviour cannot be verified?

Verify the identity of developers

Posted Apr 2, 2024 15:24 UTC (Tue) by MarcB (subscriber, #101804) [Link] (3 responses)

> Purely in terms of "can I trust their home nation", the only safe developers are those with the same national affiliation as you, ...

And even that is a best-case scenario. Many countries do not have strong civil rights and their secret services target their own citizens.

Verify the identity of developers

Posted Apr 2, 2024 16:08 UTC (Tue) by farnz (subscriber, #17727) [Link]

My expectation is that the secret services etc are as much a risk to you as they are to someone you deem "trusted". Basically, by trusting people in the same immigration situation as you and in the same country as you, you're trusting people inside the same "national security" boundary as you; the moment you go outside that, you're at risk of your colleague being targeted by a national security agency that cannot reach you, even if they are an upstanding person themselves.

So, while Canada is basically a safe country, as someone based in England, I'm in a separate "national security" boundary to a Canadian; it is at least theoretically possible that a Canadian agency can't get to me, but can compromise a Canadian contact, and it's also possible for a UK agency to compromise me, while being unable to compromise my Canadian contact.

This analysis still applies even if the two countries are evildoers; my local set of evil government agencies affect me and anyone else in the same country, and your local set affect you and anyone else in the same country. If we're in different countries, and you need only affect one of us, then the set of agencies to care about is the union of the sets we're affected by.

Verify the identity of developers

Posted Apr 3, 2024 17:39 UTC (Wed) by jafd (subscriber, #129642) [Link] (1 responses)

Also, moles exist.

Verify the identity of developers

Posted Apr 4, 2024 19:01 UTC (Thu) by epa (subscriber, #39769) [Link]

Running a mole is about a million times more expensive than creating a GitHub account under a completely made-up identity. That’s the idea.

Verify the identity of developers

Posted Mar 30, 2024 14:40 UTC (Sat) by dvdeug (guest, #10998) [Link] (8 responses)

> resident in a Western country where they could be prosecuted for maliciously introducing backdoors.

Crypto AG was a Swiss encryption company that turned out to be owned by the CIA and West German Federal Intelligence Service (BND) between 1970 and 1993, with the CIA owning it until 2018, that sold backdoored encryption systems to many nations. The NSA produced and promoted the Dual_EC_DRBG CSPRNG that could be used with SSL, with the general consensus being that they had a backdoor, as the possibility of an undetectable backdoor existing was well-known and there was little other reason to use it.

Even if we trust the CIA and NSA (and friends; the Crypto AG story also implicates Germany and Switzerland) blindly, the history of espionage says little for the security of blindly trusting people resident in western nations.

Verify the identity of developers

Posted Mar 30, 2024 16:15 UTC (Sat) by epa (subscriber, #39769) [Link]

Are you saying Crypto AG was publishing all its source code and customers were doing reproducible builds of that?

I certainly do not advocate blindly trusting someone just because they are a known individual from a non-hostile country. We need all the other “many eyeballs”, verified supply chain, and sandboxing too. Once you have all that in place, the next step might be to start strongly identifying developers.

For cryptography the situation is a little different as the cipher is fully described but only experts can analyse it for weaknesses. A backdoor in a library does not require quite the same level of expertise to spot.

Verify the identity of developers

Posted Mar 30, 2024 17:48 UTC (Sat) by marcH (subscriber, #57642) [Link] (6 responses)

> Crypto AG [...] that sold backdoored encryption systems to many nations. The NSA produced and promoted the Dual_EC_DRBG CSPRNG that could be used with SSL, with the general consensus being that they had a backdoor,

These are very real but they were also huge scandals. In dictatorships such stuff is business as usual.

In democracies these questions can be and are debated and there is some oversight on intelligence agencies. A poor level of control but much better than answering to a single person at the top.

Developers do not automatically risk jail or death or worse if they refuse a "proposition" from the intelligence agency of a democracy.

Democracies are fragile and very far from perfect but they're at least trying. So, verifying the identity of developers who live in a democracy would be very far from a silver bullet and I'm not even sure it would be a good idea in the first place but it would be for sure _very_ different from verifying the identify of developers surviving in a dictatorship.

Nothing's black and white here but there can be a huge differences between "light grey" and "dark grey"; let's be careful with "whataboutism".

PS: the main drive (and... sin) of the Western world is unabated greed and the fair dose of corruption that comes with it. Yet Western business is nowadays required to distance itself more and more from powerful dictatorships which is costing a LOT. Guess why.

Verify the identity of developers

Posted Mar 30, 2024 18:15 UTC (Sat) by rra (subscriber, #99804) [Link] (3 responses)

> Developers do not automatically risk jail or death or worse if they refuse a "proposition" from the intelligence agency of a democracy.

I live in a country that is theoretically a democracy but has something called "National Security Letters" that are substantially similar to this description, which makes me dubious the line is quite this clear-cut.

Verify the identity of developers

Posted Mar 30, 2024 19:00 UTC (Sat) by marcH (subscriber, #57642) [Link] (2 responses)

I wrote "not automatically", "shades of grey" and used plenty other adverbs but apparently not enough.

Verify the identity of developers

Posted Mar 30, 2024 19:59 UTC (Sat) by rra (subscriber, #99804) [Link]

> I wrote "not automatically", "shades of grey" and used plenty other adverbs but apparently not enough.

I'm sorry, you're right, you did, and I should have acknowledged that. I still think I disagree with you somewhat about the intensity of the difference, but it's hard to quantify and there's nothing incorrect in what you said.

Verify the identity of developers

Posted Apr 1, 2024 15:31 UTC (Mon) by Lennie (subscriber, #49641) [Link]

For context, I'll post you a link to a talk by a brave man:

https://media.ccc.de/v/27c3-4263-en-resisting_excessive_g...

Resisting the state if they come knocking is euh... hard work to say the least.

Formally good actors can (be made to) turn or get their systems compromised.

Which is why we need to focus on checking code and making code more readable probably less focus less on the actors.

Verify the identity of developers

Posted Mar 30, 2024 19:50 UTC (Sat) by dvdeug (guest, #10998) [Link] (1 responses)

> These are very real but they were also huge scandals.

Huge scandals? Crypto AG, by the time it came out, was a minor historical note. I'd bet most Americans would consider it a good move that let us spy on foreign enemies, and many wouldn't bat an eye at the amount of spying done on allied powers. The NSA stunt annoyed some in the field of computer security, but few outside it.

> In dictatorships such stuff is business as usual.

I'm not sure. China isn't going to play around with Dual_EC_DRBG; you use their keys for SSL or else. They openly put taps in, and wouldn't bother with something nobody is going to trust. This skullduggery is part and parcel of Western intelligence agencies.

> Developers do not automatically risk jail or death or worse if they refuse a "proposition" from the intelligence agency of a democracy.

https://arstechnica.com/tech-policy/2013/04/wikipedia-edi... There's a risk of jail time. Nor do I think US intelligence agencies are above blackmail, though the CIA might reserve that for people outside the US.

> Nothing's black and white here but there can be a huge differences between "light grey" and "dark grey"

Yes, but at the same time, intelligence agencies, democracy or otherwise, are very clandestine and have a history of this type of stuff.

As another note, a new developer from the Western world could be a genuine newbie, but could also be someone who found a job posting on the dark web when looking to buy the "Easy Home Kit for Cooking Meth", and now gets paid for his identity, quite possibly with no idea who is paying him.

> Yet Western business is nowadays required to distance itself more and more from powerful dictatorships which is costing a LOT. Guess why.

More and more? If we're talking about China, it's got Cold War parallels, two large powers fighting over control of the world. Russia has even more Cold War parallels, and while pulling out of Russia is bad for business, so is letting Russia take over Eastern Europe. There's moral elements, and fears that Chinese products have backdoors. I'm really not sure what you're getting at here. I certainly don't see Western business having much trouble dealing with dictatorships that haven't pissed off the West.

Verify the identity of developers

Posted Apr 1, 2024 0:24 UTC (Mon) by marcH (subscriber, #57642) [Link]

> Huge scandals? Crypto AG, by the time it came out, was a minor historical note.

It was probably not mentioned in family dinners but it made the mainstream press which is very rare for topics like this. It also taught many "naive" countries to stop blindly trusting their allies. So yes, it was a pretty big deal.

> https://arstechnica.com/tech-policy/2013/04/wikipedia-edi... There's a risk of jail time.

Whether this particular case has merit or not, publishing classified information is of course pretty stupid and totally unrelated to inserting backdoors in open source projects.

> but could also be someone who found a job posting on the dark web

Yes verifying identities will never be a silver bullet. But it would be for sure more useful in a place with a functional legal system where such a person runs the risk of being caught and prosecuted (as opposed to getting a medal from their dictator).

> I'm really not sure what you're getting at here. I certainly don't see Western business having much trouble dealing with dictatorships that haven't pissed off the West.

My (admittedly confusing) tangent/PS was: businesses and monopolies tend to buy congressmen and run the show in democracies, especially in the US since "Citizens United vs FEC". As you noted, businesses generally don't care about dictatorships, only about money. That's why they are called "businesses". But even in these short-sighted, market-based countries, authorities are starting to realize the magnitude of the risks and problems and are (slowly) taking precautions affecting the bottom line of their uber rich and all powerful businesses. The IT naivety is (slowly) regressing and that's a good thing.

Verify the identity of developers

Posted Mar 30, 2024 15:39 UTC (Sat) by marcH (subscriber, #57642) [Link] (5 responses)

> ... and accepting the fact that we will never have enough reviewers to check every commit, ...

This is the main problem right here and the "solution" is to just SLOW DOWN. No xz maintainer? Fine, no xz software at all. The world will keep spinning.

This site is never short of very valid criticism of greedy corporations exploiting exhausted maintainers. But sometimes it would also be good to look in the mirror and at the attitude of some maintainers. Scratching your own itch and sharing your random and insecure musings on the Internet is great. But when that pet project becomes popular hubris kicks in. Then comes the desire to become popular and successful too and to avoid a fork at all costs: someone else more "active" and more lax could fork and reap all the fame! Quick, quick, let's merge all these great new features that I have barely the time to look at. Who knows: someone somewhere could be interested in them?

The number 1 job of a good maintainer is to say "no" or even (the horror!) completely ignore some ideas and submissions. The Linux kernel is not perfect but actually decent at this. The rest of what runs on a Linux desktop... not so much.

It's not just corporations: many consumers, developers and generally _people_ generally don't want to pay for quality. We just want more and more for less and less money. With just one exception: security. Because a device that grants criminals access to your data and passwords is much scarier than a device that stops working. So security has been saving quality and it will keep slowing things down. That's a good thing.

Verify the identity of developers

Posted Mar 30, 2024 15:43 UTC (Sat) by marcH (subscriber, #57642) [Link]

> don't want to pay for quality. [...] With just one exception: security.

Sorry I forgot the other, obvious exception: dying. For instance: in a Boeing plane.

Verify the identity of developers

Posted Mar 30, 2024 15:53 UTC (Sat) by pizza (subscriber, #46) [Link] (3 responses)

> This is the main problem right here and the "solution" is to just SLOW DOWN. No xz maintainer? Fine, no xz software at all. The world will keep spinning.

Ok, so widely-user xz stops being maintained. The amount of collective effort to remove xz from production dwarfs the effort of maintaining xz. By multiple orders of magnitude.

Meanwhile, as this mess demonstrates, "maintained" doesn't mean it can be trusted.

Verify the identity of developers

Posted Mar 30, 2024 17:04 UTC (Sat) by marcH (subscriber, #57642) [Link] (2 responses)

> Ok, so widely-user xz stops being maintained.

This already happened a while ago but that wasn't my main point. My main point is: how was 20% better compression enough to "lure" projects into adding some bad dependency? _This_ is when projects should "slow down" and take the time to weight all the pros and cons, including future maintenance headaches
https://cacm.acm.org/practice/surviving-software-dependen...

> The amount of collective effort to remove xz from production dwarfs the effort of maintaining xz. By multiple orders of magnitude.

This is comparing apples and oranges because it's not the same people. There's no "collective" either: each project should manage its dependencies independently.

I'm surprised that switching to a different compression is so expensive because many projects offer such a choice at configuration time which hints at comparable APIs.

> "maintained" doesn't mean it can be trusted.

Indeed but "unmaintained" cannot be trusted _for sure_. Same as testing: it can only "prove the existence of bugs, not their absence". Quality is not black or white.

> Meanwhile, as this mess demonstrates,

If anything, this mess demonstrated a lack of maintenance.

Verify the identity of developers

Posted Mar 31, 2024 21:19 UTC (Sun) by calumapplepie (guest, #143655) [Link] (1 responses)

> My main point is: how was 20% better compression enough to "lure" projects into adding some bad dependency?

Because it wasn't a bad dependency, and 20% is a big improvement. xz has (had?) a website, multiple contributors, maintainers, and more. There were heated debates over the advantages of it compared to other tools. Eventually, it gained wide use, because 20% faster downloads, 20% less storage, 20% lower bandwidth fees, and a 20% better algorithm was an upgrade.

> This is comparing apples and oranges because it's not the same people. There's no "collective" either: each project should manage its dependencies independently.

Then we will have 60% of projects continue using XZ for years after it is abandoned. Besides, the idea of projects as a bunch of little silos that all know each other and work together isn't realistic; lots of contributions are drive-by, and lots of contributors are involved in many projects.

> If anything, this mess demonstrated a lack of maintenance.

XZ was and is maintained. It was subjected to continuous fuzzing as a part of Googles OSS-fuzz. It was vendored into the Linux kernel, an "essential" part of Debian, and more. There isn't a maintainer on the planet who would have rejected its inclusion because of reputational fears.

Do we need more auditing? Yes. Maybe some clever person can think of linker patches that will catch this particular exploit technique, or maybe we need to have more people running with the options that exist to catch it, or maybe even someone should write some automated tests. But rogue maintainers was and will remain a problem.

Verify the identity of developers

Posted Apr 1, 2024 0:04 UTC (Mon) by marcH (subscriber, #57642) [Link]

> xz has (had?) a website, multiple contributors, maintainers, and more. [...] XZ was and is maintained.

Did you read the news?

> Then we will have 60% of projects continue using XZ for years after it is abandoned. Besides, the idea of projects as a bunch of little silos that all know each other and work together isn't realistic; lots of contributions are drive-by, and lots of contributors are involved in many projects.

I don't get the point you're trying to make here.

In any case adding and managing dependencies is a benefit-risk assessment and it's up to each project to make its own decisions in a decentralized manner; there is simply no alternative besides not making this assessment.

"Decentralized" does not mean "in a vacuum": more popular dependencies are of course more likely to be picked up or forked by someone who really needs them if the current maintainer(s) fail.

Verify the identity of developers

Posted Mar 30, 2024 20:29 UTC (Sat) by pawel44 (guest, #162008) [Link]

> Then for key roles you could require someone with a clear track record and resident in a Western country where they could > be prosecuted for maliciously introducing backdoors.

Was NSA prosecuted?

Verify the identity of developers

Posted Mar 31, 2024 11:05 UTC (Sun) by dkzm (guest, #55549) [Link] (53 responses)

Let's suppose somebody add drivers for yet another Chinese SBC or making QEMU's COLO feature (VMware FT equivalent, at least partially developed by Huawei as far as I understood) really working or just new and improved quantization format for LLMs to textgenweb ui. Or just some new improvments to Linux network stack (Huawei did this as far as I remember)

They are not from Western country (they are likely from China). Shouldn't github just refuse their access? They just use their own services, blame it on github being unwelcoming to them. West will not be able to use and learn their could and they would still be able to do so. This likely mean that all major opensources projects will be forked and it it's possible that github 'original' will not be most maintained branch anymore.

Verify the identity of developers

Posted Mar 31, 2024 17:53 UTC (Sun) by epa (subscriber, #39769) [Link] (52 responses)

I didn't mean blocking anyone from gitlab or even blocking them from committing. I meant given a particular git repository being able to see the people who have committed to it, and whether their identity has been verified as a real person. Whether to then "trust" that repository is a policy decision and would be made by distributors or perhaps your company's IT department. People are already making these decisions; given that we face attempts to introduce backdoors under fake identities like "Jia Tan", having some extra information about whose identity has been verified might help make better decisions.

Verify the identity of developers

Posted Mar 31, 2024 18:12 UTC (Sun) by pizza (subscriber, #46) [Link] (51 responses)

> given that we face attempts to introduce backdoors under fake identities like "Jia Tan", having some extra information about whose identity has been verified might help make better decisions.

What does "verified" mean in this context?

Verify the identity of developers

Posted Apr 1, 2024 6:31 UTC (Mon) by epa (subscriber, #39769) [Link] (50 responses)

I was imagining a future where GitLab verifies the identity of people using an identity document such as a passport. Of course, that’s currently not practical. It would require governments to issue electronic identities by signing someone’s private key or the like. Which could happen in Estonia but for various reasons seems out of reach in the USA. Actually, GitLab need not be involved, if you can tie back a private key to a named individual and commits are signed.

And I did say it would be somewhat dystopian and not desired by free software developers.

It would not be watertight but would make things a bit more difficult for an organization that wants to get maintainer permissions in a project and add malicious code. Currently, creating a fake identity is trivially easy.

Verify the identity of developers

Posted Apr 1, 2024 6:45 UTC (Mon) by mjg59 (subscriber, #23239) [Link] (49 responses)

If we're in a world where we're dealing with state level attackers we should assume that they're going to be able to produce ID that's good enough to pass any viable non-government checks, and so you end up with something that deters legitimate contributors without preventing the worst case failures.

Verify the identity of developers

Posted Apr 1, 2024 7:08 UTC (Mon) by himi (subscriber, #340) [Link] (48 responses)

Yes and no.

Yes, nation state attackers have the capacity to forge ID that will pass any viable checks (non-government or government) - history has given us many examples. But, when those nation states have been caught out doing so it has the potential to result in the kind of negative impacts that nation states actually take seriously - diplomatic incidents, visa refusals or revocations, even changes to policies on visa applications. Sure, true rogue states probably don't care that much about that kind of thing, but anyone that doesn't want to be /considered/ a rogue state by most of the world will care.

Not that I think this is a good argument for requiring real-world ID to be able to make legitimate contributions to free software projects, but it's definitely worth remembering that when real-world ID gets involved the consequences for a lot of things, both good /and/ bad, escalate rather quickly.

Verify the identity of developers

Posted Apr 1, 2024 7:22 UTC (Mon) by mjg59 (subscriber, #23239) [Link] (47 responses)

Mossad agents used fake Canadian passports in an assassination, and the meaningful impact on their international reputation was approximately zero. And it was only possible to determine that because there were alternative pathways to identify who the agents were, what their legitimate nationality was, and how they had entered the country anyway. Without building an incredible amount of infrastructure there's no real way to flag an identity as false until they've already done something illegitimate, and even then if you can't identify the underlying identity you're probably not going to be able to figure out who issued the false identity. Unless you want every contribution to be subject to the same criteria as entering a foreign country, I just don't think this is a meaningful speedbump.

Verify the identity of developers

Posted Apr 3, 2024 8:04 UTC (Wed) by epa (subscriber, #39769) [Link] (46 responses)

The fake Canadian passports must have worked because immigration officers just looked at them. They didn’t check them against a database maintained by the Canadian government. I am not completely certain, but I know that in Europe a passport is not just eyeballed but *scanned* using its RFID chip, or at least the computer-readable text printed on it. And within the European Union at least, it gets checked against a database. So you can’t just print one that looks convincing.

(Unless of course the Mossad operatives took on the identity of real Canadians and looked like them too, so they could in principle have stolen those people’s real passports and used them to travel. I am have been assuming they created entirely fake identities.)

How does this relate to checking the identity of programmers? Well, a requirement of “please take a photo of your passport” wouldn’t cut it. But if governments provide a way to validate the passport data (or for an individual to generate a code which can be checked on a govt website, as already happens in some countries) then we do make it harder to create fake identities. A step further would be for an individual to have their public key signed by a government agency. You could at least check the person’s real name and nationality. That’s a lot better than “Jia Tan”.

Verify the identity of developers

Posted Apr 3, 2024 12:53 UTC (Wed) by smurf (subscriber, #17840) [Link]

> if governments provide a way to validate the passport data

Not that difficult to do given reasonably useable infrastructure. In Germany you don't even need direct support from the government to do it (other than having a RFID chip in your document in the first place of course): there's an online service from Governikus that transmogrifies the electronic data in your ID card to a GPG signature. See e.g. mine at 72CF8E5E25B4C293, signed by 5E5CCCB4A4BF43D7.

Verify the identity of developers

Posted Apr 4, 2024 14:17 UTC (Thu) by kleptog (subscriber, #1183) [Link] (44 responses)

Apps that can validate your passport via the NFC chip are fairly common these days. You can open a bank account online by holding your phone to your passport, and then letting it take a picture of your face. It's all held together with public key cryptography. I'm not sure if the CRL for passports is publically available, but it does exist.

Maybe not in the US though?

But that doesn't really help though, because all it proves is that someone has access to a passport. That doesn't tell you if they're trustworthy or not. And since you're not going to be scanning someone elses passport in the end you're going to be trusting who ever did that the person was actually there, so you've just moved the problem around.

In the end you can never be 100% sure someone is trustworthy. No technical solution can do that. But perhaps we can make a machine learning system that can monitor commits for dodgy stuff to make it feasible for humans to focus on the risky patches.

Verify the identity of developers

Posted Apr 4, 2024 18:59 UTC (Thu) by epa (subscriber, #39769) [Link]

If the developer’s public key is signed by a government agency and linked to their identity document (as apparently can be done in Germany) that is a stronger check than just checking a passport and associating it with a public key uploaded separately.

None of this is completely watertight. But right now it’s kind of embarrassing how easy it is to create a fake identity and use it to contribute or even become maintainer of a project.

Verify the identity of developers

Posted Apr 4, 2024 19:33 UTC (Thu) by draco (subscriber, #1792) [Link] (42 responses)

Passports establish identity and jurisdiction (for extradition if necessary) for claims of torts and charges of crimes.

It's not about whether they can be trusted, but about whether they can be held accountable if they do something bad.

By comparison, as we've seen, an email, public key, and purported name are nearly useless for these purposes.

(It hopefully goes without saying that these all need to be tied together to one person to be useful, but it was apparently not obvious why a passport helps, so I figured I'd be upfront with that detail.)

Verify the identity of developers

Posted Apr 4, 2024 19:37 UTC (Thu) by mss (subscriber, #138799) [Link]

Passports establish identity and jurisdiction (for extradition if necessary) for claims of torts and charges of crimes.

It's not about whether they can be trusted, but about whether they can be held accountable if they do something bad.

That's not very useful for a nation-state-sponsored attack like (most likely) this one.

Verify the identity of developers

Posted Apr 4, 2024 19:43 UTC (Thu) by pizza (subscriber, #46) [Link] (39 responses)

> Passports establish identity and jurisdiction (for extradition if necessary) for claims of torts and charges of crimes.

Then there's the little problem that most people don't have passports.

So you'd need to handle (and have a way of validating) nearly 200 (non-standarized) national identity documents. Then there are countries like the US that don't have a single (domestic-focused) nation-wide ID [1].

[1] eg the USA, with 50 states, plenty of non-state territories (eg DC and Puerto Rico) and various native tribal IDs, plus military and other federally-issued IDs, and so forth...)

Verify the identity of developers

Posted Apr 5, 2024 9:46 UTC (Fri) by smurf (subscriber, #17840) [Link] (38 responses)

> Then there's the little problem that most people don't have passports.

That's likely true if you talk about the world's population as an aggregate.

The actual rate varies rather wildly between countries, and their subpopulation (I'd assume that IT affine people are somewhat more likely to have one than not, for instance).

Verify the identity of developers

Posted Apr 5, 2024 12:20 UTC (Fri) by pizza (subscriber, #46) [Link] (37 responses)

> The actual rate varies rather wildly between countries, and their subpopulation (I'd assume that IT affine people are somewhat more likely to have one than not, for instance).

You're probably right, but I'd still be surprised if a majority "IT people" in the US have a passport.

(And EU citizens don't need a passport to travel within the EU either)

Verify the identity of developers

Posted Apr 5, 2024 12:55 UTC (Fri) by atnot (guest, #124910) [Link] (9 responses)

This entire discussion is just moot in the first place, because if some project requires me to scan my passport to contribute, I will simply not contribute to that project. And experience show few people will. *Especially* if that means you take on some sort of legal liability for your contributions, which just, hell no.

Look at CLAs, most people already can't be bothered to e-sign some document in docusign or whatever.

And it's the wrong direction to discuss this anyway. Sure, verifying passports would be a way to verify that people contributing to *your* project are people recognized by some sort of UN government (lots of people aren't, but let's put that aside). But if, say, sqlite, gcc, freebsd, linux or whatever organizations your systems depend on isn't going to enforce your draconian policy, what are you going to do? Or if they do, and a fork develops that just lets people contribute without any riffraff? Are you going to not package their software and everything that depends on it? Rewrite the whole thing from scratch? You can't trust any of their commits after all. Put the stuff without passport checks in a seperate repository, which everyone just enables blindly because that's what you actually need to do to get real work done, just like people already do with rpmfusion and universe and flatpak and pypi and everything else?

It's just a completely unrealistic model of free software development that assumes a "supply chain" and an avenue for contractual obligations that just does not exist, cannot exist and is deeply undesired by all of the people this industry runs on, those who publish their code online because it brings them joy.

Verify the identity of developers

Posted Apr 5, 2024 13:43 UTC (Fri) by farnz (subscriber, #17727) [Link]

… assumes a "supply chain" and an avenue for contractual obligations that just does not exist, cannot exist and is deeply undesired by all of the people this industry runs on, those who publish their code online because it brings them joy.

This is the key point; if you're going to "solve" this problem, you need to start at the producer end, since the consumers of Free Software have no leverage over the producers in general (you may have leverage in specific cases - say if you employ a producer of Free Software and can threaten their livelihood - but not over the full sum of Free Software).

If you can't come up with a good reason why you'd jump through the hoops you're putting in place to fix a typo in a message the program displays (say changing "the" to "The" because of context), then your hoops are not going to work in general, since there will be plenty of producers of best-in-class Free Software who refuse to jump through your hoops.

Verify the identity of developers

Posted Apr 6, 2024 13:14 UTC (Sat) by smurf (subscriber, #17840) [Link] (7 responses)

> Look at CLAs, most people already can't be bothered to e-sign some document in docusign or whatever.

The problem with CLAs isn't that I can't be bothered.

The problem is that assigning my copyright, or the rights thereof (you can't "assign copyright" in some jurisdictions; you created it, you have the copyright, period end of discussion, presuming you didn't do it for an employer) is a very bad idea because it allows the transferee to re-license the work under any proprietary legalese they damn well please. Numerous examples can readily be found in the archives, of LWN and elsewhere.

Showing my passport / ID document to somebody doesn't take away any of my rights.

XZ and of course a whole freakin' lot of other software is the equivalent of critical infrastructure. In most countries, if I want to hire you to work on anything critical, you showing me some official ID document is just the first step in a rather long list of intrusive government snoopage, depending on quite how critical the piece you'd then be able to subvert is; including but *way* not limited to checking that you don't have relatives in $BAD_COUNTRY whose health would be a convenient handle their government might blackmail you with.

You don't want that? fine, go work somewhere else.

Verify the identity of developers

Posted Apr 6, 2024 16:42 UTC (Sat) by atnot (guest, #124910) [Link] (3 responses)

Okay, I'll work on something else. And then it will become useful, and lots of people will want to
install it on your distro. And then it ends up becoming critical. What are you gonna do then?

You can say how it would work if this was a company again and again. But this isn't a company. It very explicity and deliberately does not work like a company.
You can't just handwave some sort of contractual customer relationship between someone uploading code on the internet and other people chosing to use it in critical ways of their own accord, that's just not how things work.

Verify the identity of developers

Posted Apr 6, 2024 18:14 UTC (Sat) by smurf (subscriber, #17840) [Link] (2 responses)

Surprise: I know that.

> You can say how it would work if this was a company again and again.

I don't recall saying anything more than once.

Also I didn't say that "this", whatever it is, should work like a company. Or that I'm advocating for doing things that way.

All I'm saying is that compared to the security (both real and theater) you're subjected to when working on "this" in a corporate context, requesting something that links your online identity with what most people consider to be the Real World isn't *that* much of a burden.

Given this attack, the idea of finding some middle ground between "you're a $NATION black hat? sure, no prob, here are the keys" and the (IMHO somewhat excessive) hoops the corporate world requires you to jump through when you want to do the exact same thing for $$$ isn't *that* far out.

So we get to talk about it.

There's a material difference between discussing ways to ID people working on critical code and concluding that it's not practical and finding some other way to reach the same goal (clean up our tooling, pay somebody to do code reviews, whatever) and declaring a priori that the topic is not up for discussion because "that's just not how things work".

Verify the identity of developers

Posted Apr 6, 2024 18:26 UTC (Sat) by mjg59 (subscriber, #23239) [Link] (1 responses)

Linking "online identity" to "real world identity" is a great way to dissuade a significant number of people from participating in free software, and at this point we have no evidence whatsoever it would have done anything to help in the case in question.

Verify the identity of developers

Posted Apr 6, 2024 19:06 UTC (Sat) by Wol (subscriber, #4433) [Link]

And what smurf is conveniently forgetting is that my pet project may or may not be critical to me. If it's critical to someone else - NOT MY PROBLEM!

"We get to talk about it". And the FIRST thing I'm going to talk about is £££. At which point if you don't want to pay - or I don't want the money! - we're at an impasse.

At the end of the day, there has to be a MUTUAL EXCHANGE OF VALUE. And smurf is assuming he has something of value to offer - BAD ASSUMPTION! I don't know about other people, but as far as I'm concerned, if it involves dealing with the US Authorities, my price is likely to be "Up Yours!!!"

"So we get to talk about it." "Feel free to fork it. I don't care".

Cheers,
Wol

Verify the identity of developers

Posted Apr 6, 2024 16:53 UTC (Sat) by farnz (subscriber, #17727) [Link] (2 responses)

When xz started, and indeed when most of the open source that's now "critical infrastructure" started, it was just a hobby project, and not critical. It became critical because it was useful and became used; but that's on the users, not the developers.

Or are you saying that I'm allowed to demand that you go through a very long list of government snoopage because I've used your comment in something critical, and you now owe me big time for my decision to make use of your work?

Verify the identity of developers

Posted Apr 7, 2024 2:35 UTC (Sun) by draco (subscriber, #1792) [Link] (1 responses)

No, I think it's the other way around

Perhaps I don't want the reputational damage of having nation state attacks on my project, so I insist on knowing that the patches I accept are from real, identifiable people from countries I trust

Maybe nobody contributes to my project, maybe I'm ok with that, maybe some people feel better about my project because of that policy

Maybe people who don't like that choose to fork it, that's their right, but then they accept the consequences

Or maybe they do the same thing, but with different trust decisions about who's ok 😂🤷

A variant of this has happened before: DJB is very opinionated about what goes into his software

Is this a good approach? The proof won't be in any arguments about it, but in what actually happens

Verify the identity of developers

Posted Apr 7, 2024 11:17 UTC (Sun) by farnz (subscriber, #17727) [Link]

But what if you yourself are a nation state attacker? How do I know when I look at something and consider using it that you're trustworthy? How do I as a potential user get you to jump through my hoops that confirm that you are a real, identifiable person from a country I trust?

And remember that for a lot of contributions, I can see that they're safe by review; why would I demand anything from a contributor when it's obvious to me that the change is good as-is? For code where I can't completely review it, I need some degree of trust, but where I can review in full, why would I put you through a barrage of trust checks just to go 'yep, I can see that changing "correct. the system" to "correct. The system" is a good change to make'?

Verify the identity of developers

Posted Apr 5, 2024 12:55 UTC (Fri) by paulj (subscriber, #341) [Link] (26 responses)

EU citizens *do* need some form of official ID (e.g. passport, driving licence, national ID card) to travel between at least some of the EU.

Citizens (and possibly also residents) do not need ID to travel within the Schengen Area. Now, the Schengen Area includes nearly all EU members, but not all. Notably, the 2 island member states are not in Schengen, Ireland and Malta - Ireland can not join Schengen because the UK has never wanted to join, and Ireland has always had an open border with the UK, and will have for the foreseeable future. Malta, not sure why, but perhaps that's also to do with UK relations - however it will be joining at some point soon. Additionally, the EFTA states, and a couple of others, are also in Schengen - but not in EU.

Verify the identity of developers

Posted Apr 5, 2024 12:59 UTC (Fri) by paulj (subscriber, #341) [Link]

tl;dr: You need an ID to travel to/from Ireland ;)

Cause of the Brits.

Verify the identity of developers

Posted Apr 5, 2024 14:36 UTC (Fri) by jem (subscriber, #24231) [Link] (24 responses)

>Citizens (and possibly also residents) do not need ID to travel within the Schengen Area.

This is a common misconception. EU citizens are required to carry a government issued ID card or passport if they are traveling abroad, even if the travel is limited within the Schengen area. However, the ID is normally not checked at the border between two Schengen countries, but checks can be reinstated if circumstances require it.

In some countries within the Schengen area (*cough* Germany) citizens are required to be in possession of an ID card (or passport) even within their own country.

Verify the identity of developers

Posted Apr 5, 2024 14:56 UTC (Fri) by rschroev (subscriber, #4164) [Link]

> In some countries within the Schengen area (*cough* Germany) citizens are required to be in possession of an ID card (or passport) even within their own country.

Same in Belgium. In practice in everyday life in most situations this is not enforced, but police enforcement can ask for your ID (I think they have to state why they do) when they feel you're causing trouble.

Verify the identity of developers

Posted Apr 5, 2024 18:36 UTC (Fri) by pizza (subscriber, #46) [Link] (21 responses)

My point was that as a EU citizen you don't need a *passport* to travel around the EU; your national ID card is sufficient. Only when traveling outside the EU would a passport come into play.

What makes passports semi-feasible for "identity verification" is that there is a true international standard for machine readability (and decoding) of their information. But passports are not a given, meaning you'd realistically need to accept various [sub-]national ID cards in all their infinite diversity, with potentially a separate reading/decoding/verification mechanism required for each issuing agency.

Verify the identity of developers

Posted Apr 6, 2024 21:31 UTC (Sat) by kleptog (subscriber, #1183) [Link] (20 responses)

It worth noting that from a technical aspect there's less difference between passports and ID cards than you might think. National ID cards in europe often have the same NFC chip as the passports and they work the same way. The only real reason you need a passport outside the EU is because many countries want to (a) put stamps in your passport, (b) add physical visas to them and (c) be able to look at your passport to see if you've visited any countries they don't like. That's why countries near the EU where there are no visa requirements will accept national ID cards at immigration. (The Dutch ID card is acceptable for travel to 42 countries.)

As digital visas become more common there will be more countries that will accept ID cards in lieu of passports.

It's possible to use all this infrastructure in positive ways. For example, it would allow Github to have proof you are over 18 and a resident of country X, without revealing any other information about you (zero-knowledge proofs). We're not there yet.

Of course the next step is to ditch the physical card altogether and have it all in your phone instead. Of course that gets trickier, because a passport/ID card provides offline unrecorded proof of validity, but it's not clear if a pure digital app based identity can work offline.

Verify the identity of developers

Posted Apr 6, 2024 22:05 UTC (Sat) by pizza (subscriber, #46) [Link] (19 responses)

>It's worth noting that from a technical aspect there's less difference between passports and ID cards than you might think. National ID cards in europe often have the same NFC chip as the passports and they work the same way.

...Well, that's great for Europeans, but what about the rest of the world?

(again, that's my point -- Passports have an international standard for machine readability and interoperability, but there are more standards for domestic identification than there are countries! I have a US passport, a second Federal-issued ID, and a state-issued ID. They are all machine-readable, but via different mechanisms, and the encoded information also differs. The passport establishes citizenship. The state ID establishes residency and permission to operate a motor vehicle on public roads)

Verify the identity of developers

Posted Apr 7, 2024 15:53 UTC (Sun) by kleptog (subscriber, #1183) [Link] (18 responses)

> They are all machine-readable, but via different mechanisms, and the encoded information also differs.

Ok, but this is a fabricated problem. The states of the US could surely get together and adopt a single standard to cover everything. Clearly it's not a big enough problem.

If your point is that requiring digital identification online for open-source projects would unfairly exclude much of the world, I agree with you. That's not something we can reasonably require at this point (perhaps ever).

Verify the identity of developers

Posted Apr 7, 2024 17:00 UTC (Sun) by pizza (subscriber, #46) [Link] (17 responses)

> Ok, but this is a fabricated problem. The states of the US could surely get together and adopt a single standard to cover everything. Clearly it's not a big enough problem.

There is a federal standard for state ID cards now (imposed by the "REAL ID Act" but twenty years later it's still not fully deployed, and IIRC that _still_ doesn't provide a standard mechanism for machine readability or verification.

It's "not a big enough problem" because these ID cards are only used physically, in person, using the mk-I eyeball to make sure the photo vaguely looks like the person holding it.

> If your point is that requiring digital identification online for open-source projects would unfairly exclude much of the world, I agree with you. That's not something we can reasonably require at this point (perhaps ever).

Yes, except it's not "much of the world" so much as "everyone that doesn't live in a jurisdiction that provides state-issued digital identification along with a low/zero-cost mechanism for arbitrary third parties (including those outside your jurisdiction) to validate said credentials." IIUC hardly anywhere qualifies in that respect.

Verify the identity of developers

Posted Apr 7, 2024 17:46 UTC (Sun) by pizza (subscriber, #46) [Link]

> and IIRC that _still_ doesn't provide a standard mechanism for machine readability or verification.

Whoops, I stand corrected. It wasn't part of the original law, but instead as regulations issued by the DHS after the fact. So, currently REAL-ID compliant cards must have a PDF417 2D bar code containing a minimum of 10 data elements [1]. Notably missing is a digital signature that one can use to _validate_ the data without some sort of query to the issuing authority, so absent that query, these ID cards are only useful for in-person stuff since you can photoshop anything you want onto the front (photo, text) and back (barcode) and nobody would be any the wiser.

(Nearly all of the REAL-ID provisions have to do with physical/anti-tamper security (eg watermarks, holograms) and a consistent minimum standard for documentation needed to issue said ID, and the information that needs to be shown..)

(Meanwhile, various federal agencies (including the military) have their own ID standards that use different machine readable mechanisms and encoded data..)

[1] legal name, gender, DOB, address of residence, etc. See https://www.law.cornell.edu/cfr/text/6/37.19

Verify the identity of developers

Posted Apr 7, 2024 20:51 UTC (Sun) by Wol (subscriber, #4433) [Link] (15 responses)

> Yes, except it's not "much of the world" so much as "everyone that doesn't live in a jurisdiction that provides state-issued digital identification along with a low/zero-cost mechanism for arbitrary third parties (including those outside your jurisdiction) to validate said credentials." IIUC hardly anywhere qualifies in that respect.

In the UK, it certainly isn't mandatory. The ONLY piece of ID that all British Nationals can be reasonably assumed to possess is a birth certificate. That's assuming their parents registered the birth. Anything beyond that is OPTIONAL, although living without it can be hard. If you haven't had to renew your driving licence for one reason or another, the old green paper version is still valid. There probably aren't that many left, though. My passport is not a proper biometric one (it's also no longer valid), but if anybody wants a passport for ID I would quite happily present it and say "if that's not good enough, it's the best I've got".

More and more, if people demand things off of me (mobile phone number especially), I just walk away ...

Cheers,
Wol

Verify the identity of developers

Posted Apr 8, 2024 21:31 UTC (Mon) by kleptog (subscriber, #1183) [Link] (14 responses)

> if anybody wants a passport for ID I would quite happily present it and say "if that's not good enough, it's the best I've got".

I hope it is for you too. The UK has a weird view on IDs. On the one hand they recognise the benefits, on the other hand whenever it's proposed they always talk about being required to carry them at all times. Which is basically insane and a way to sink the topic before it gets anywhere.

A national ID is physical proof you are allowed to be there and have certain rights. So if some government database has a glitch and suddenly decides you're an illegal immigrant (e.g. Windrush, EUSS, the current PCDP scandal at the Home Office) you have physical proof that the database is *wrong*. Good for preventing you getting deported. That such a card is useful in other contexts is bonus.

From a pure practical point, my bank can assert my nationality just as well as the government can. You don't necessarily need passports/ID cards for that.

Verify the identity of developers

Posted Apr 9, 2024 9:02 UTC (Tue) by farnz (subscriber, #17727) [Link] (13 responses)

One of the issues in the UK with national ID cards is that whenever the idea comes up, the intent is to fund the cards via other uses of the data contained therein. Being required to carry them at all times is just a consequence of the idea that national ID cards need to turn a profit for the government.

Verify the identity of developers

Posted Apr 9, 2024 9:53 UTC (Tue) by Wol (subscriber, #4433) [Link] (12 responses)

One of the other issues we have is that the UK is not a single nation - and it's dominated by the "little englanders".

Has anybody else noticed that - of the four nations - England is the only one without its own National Anthem?

Driven home when watching the Calcutta Cup - the Scots sing "Flower of Scotland", but the English sing "God Save the (Scottish) King" !!!

It's the same problem the Canadians and Mexicans have with North America / USA, and the English seem completely oblivious to it ...

Cheers,
Wol

Verify the identity of developers

Posted Apr 9, 2024 15:06 UTC (Tue) by rschroev (subscriber, #4164) [Link] (6 responses)

England is also the only one without its own parliament. It's almost as if England still feels the whole UK is theirs, with the other members subordinate instead of them all being on the same level.

Verify the identity of developers

Posted Apr 10, 2024 10:01 UTC (Wed) by paulj (subscriber, #341) [Link] (5 responses)

An artifact of how the UK avoids properly addressing its constitutional issues, instead sating discontent in the non-English parts by a series of more ad-hoc "devolution" of powers from Westminster to other parliaments, seeking to react to events with the minimum of change.

It started with Ireland, which got a devolved government and dominion status within the UK in 1922 with some powers reserved for Westminster and an "Executive Council" (similarish to the privy council), until 1931 when Ireland became a wholly autonomous dominion, and then to 1937 as "Eire" a self-declared independent state (dominion status ambiguous), and formally as the Republic of Ireland from 1948.

Scotland and Wales got their own devolution in 1999, both more proscribed than the original Irish Free State (which had taken armed insurrection), but each with continued representation via MPs in Westminster. I'm not sure about the differences in power between them. The Scottish parliament seems to me to have more "status" and power than the Welsh one, but that might just be my bias, having lived in Scotland - I don't know much about Welsh devolution and how it compares.

It seems to me Ireland has the healthier status of the 4 "home nations", as they were (ignoring the Troubles, arising from Elizabethan and Jacobean era United Kingdom politics, which due to historical quirks left a longer, stronger imprint in the north of Ireland than the rest of the UK). Ireland continues to have very strong bilateral links to the rest of the Celtic Isles - Irish and British citizens travel and settle freely between them, trade a little less so now thanks to BrExit though, there are bilateral institutions, etc. - while Ireland is ultimately able to decide its own fate.

I don't understand why Scotland, if not Wales, doesn't also seek a similar situation. Would be better for all in the end I think. (I did vote "Yes" in the IndyRef in Scotland. ;) ).

Verify the identity of developers

Posted Apr 10, 2024 11:23 UTC (Wed) by Wol (subscriber, #4433) [Link] (4 responses)

> Scotland and Wales got their own devolution in 1999, both more proscribed than the original Irish Free State (which had taken armed insurrection), but each with continued representation via MPs in Westminster. I'm not sure about the differences in power between them. The Scottish parliament seems to me to have more "status" and power than the Welsh one, but that might just be my bias, having lived in Scotland - I don't know much about Welsh devolution and how it compares.

Being interested in history, I think this goes back to the fact that England and Scotland were two separate nations (let's forget the Flower of Scotland Proud Edward's Army bit) until very recently. Until William's intervention in 1066, the assorted British nations were steadily coalescing of their own accord, take for example the agreement round about 900AD between - iirc - Mercia, Northumbria and Wessex that all three crowns would pass to whichever King survived longest.

Then William arrived and upset the applecart, setting out to unite the British Isles by force. Out of proto-England, Wales held out the longest which forged a separate nationality (quite possibly helped by the fact that the Anglo-Saxon nations fell rather more easily, the Welsh being Celtic so already feeling different). But Wales has always been part of "England" since the mid 1100s (and sort-of took over the English crown with Owain Tudor about 1500).

Scotland has always had a separate identity - again being Gaelic rather than Anglo-Saxon (although the Sassenachs are "Lowland Scots" aka Angles"). Again fuelled by constant conflict with the Normans to the south. And with their own monarchy (which Wales never had?) since pre-William - again going back to 900s and earlier - which left alone would probably have merged with England using a similar mechanism. But it wasn't to be.

So Scotland was either occupied, or completely independent, until the "Union of the Crowns" in 1603. It remained an independent (theoretically) country until about 1750 and the "Act of Union".

So basically, Scotland has more power and independence because Scotland is considered a nation/country. Wales is just a subordinate principality.

(And personally, I think Westminster has far too much power. A lot of it should be devolved to local government. But it's the standard ebb and flow of politics unfortunately - the centre grabs power, messes it up, and the regions grab it back. Rinse and repeat :-(

Cheers,
Wol

Verify the identity of developers

Posted Apr 10, 2024 12:59 UTC (Wed) by paulj (subscriber, #341) [Link] (3 responses)

Interesting... ;)

As an aside, I note your view of the history seems skewed towards the countries /currently/ part of the UK. You can't understand the history of these Celtic Isles without understanding the history of one of the larger chunks of it, and a kingdom of the king of England for longer than Scotland - Ireland. Some of the biggest battles relevant to the history of the kingdom of England (and to the history of Europe, to a certain extent) were fought in... Ireland (by soldiers from many nations).

Just saying, cause a lot of modern British seem to overlook it - just cause Ireland is no longer part of the UK.

Verify the identity of developers

Posted Apr 10, 2024 15:04 UTC (Wed) by Wol (subscriber, #4433) [Link] (1 responses)

Agreed I don't know an awful lot about Ireland. Bear in mind I consider myself European/Scottish although my wife insists I'm English, so that accounts for at least some of the bias.

I also know there's an awful lot of history roundabout the time of Cromwell and Cromwell :- ) that's Thomas Cromwell of Henry VIII fame for the first one :-) but I know very little about it, other than it was the age-old Catholic/Protestant mess. (And quite likely earlier, too.)

The other thing that often gets forgotten about medieval history is the "Joan of Arc vs the English" lie. Okay, Joan is a bit later than this, but King John (of Magna Carta fame, 1215) is probably the first true "King of England". Before that, and including his elder brother Richard, the title of Duke of Normandy actually ranked ABOVE the King of England. Richard's troubles in the Crusades basically brought about the downfall of the Norman Empire, and Joan drove the Normans out of Normandy (probably a gross mis-representation of what actually happened, but rather more accurate than folk history!)

Cheers,
Wol

Verify the identity of developers

Posted Apr 11, 2024 9:12 UTC (Thu) by paulj (subscriber, #341) [Link]

King John possibly succeeded - despite himself - in part thanks to having Ireland to draw wealth from. Without Ireland, he'd have had nothing early on ("John Lackland" - John no-land), and would have been less wealthy later. He might have struggled to hold the English crown against his nephew Arthur and Philip II of France.

Verify the identity of developers

Posted Apr 10, 2024 15:19 UTC (Wed) by Wol (subscriber, #4433) [Link]

Just to throw in another snippet, to help explain the Saxon / William thing - Saxon kings were elected. William's pretence for invasion was that he had been promised the crown, which was half true, but it was never in the gift of the promissors.

And that's how the treaty between the three kings worked - the ruling councils basically signed up that the only eligible candidates for any vacant monarchy would be the other monarchs. All helped by the fact that the crowns did NOT pass father to son, although the only real candidates were all close relatives of the late King.

Indeed, George II may have been the first King to inherit as of legal right, given the shenanigans in the aftermath of Henry VIII and Edward VI, and the similar shenanigans over James II, William and Mary, and Anne. Indeed, after the death of his wife, William III ruled alone despite not being of (British) Royal Blood at all! Using him as precedent, we should have had King Albert, and King Philip! (Although of course, Philip was of British Royal Blood, as also reputedly is Camilla.)

Cheers,
Wol

Verify the identity of developers

Posted Apr 9, 2024 15:39 UTC (Tue) by anselm (subscriber, #2796) [Link]

the Scots sing "Flower of Scotland"

So far that's just a patriotic song popular with Scottish sports fans which various Scottish sports bodies have provisionally adopted in the absence of an actual national anthem (which Scotland doesn't have, either).

Having said that, in spite of its obvious problems Flower of Scotland is apparently a strong contender to become the official national anthem once the Scottish parliament gets its act together. As far as the English are concerned, they should be bothered by the fact that they have no national parliament (or for that matter government) much more than by the formal absence of a national anthem.

Verify the identity of developers

Posted Apr 10, 2024 9:27 UTC (Wed) by paulj (subscriber, #341) [Link] (3 responses)

King Big Ears is German, not Scottish. ;)

Verify the identity of developers

Posted Apr 11, 2024 9:42 UTC (Thu) by Wol (subscriber, #4433) [Link] (2 responses)

Well, he is directly descended from the Scottish King James VI/I ...

(So he's as Scottish as most other people in Scotland :-) which is to say not really at all. Most residents of modern Scotland (a) do not live in the Land of the Scots, and (b) trace their ancestry to either the Picts or the Angles.

(Inasmuch as most people in the British Isles trace their ancestry back to the Anglo-Saxons - genetically we're nearly all Britons, but culturally we're Anglo-Saxon because we adopted the ruling class's language and culture. That's where the word "Welsh" came from - aka "not Anglo Saxon".)

Cheers,
Wol

Verify the identity of developers

Posted Apr 11, 2024 10:17 UTC (Thu) by paulj (subscriber, #341) [Link] (1 responses)

He's descended from the *German* George I and II from /both/ his mother and father :). George I's is also german on /both/ sides, even if his mother was a Stuart - "Sophia of Hanover". Her mother, Elizabeth Stuart was born in Scotland to James VI / I, but her mother was Danish.

It's a bit of a stretch to call Big Ears "Scottish" because, in between the plethora of German ancestors, you can find one couple who were Scottish and Danish a few hundred years ago. ;)

Verify the identity of developers

Posted Apr 11, 2024 11:12 UTC (Thu) by Wol (subscriber, #4433) [Link]

What about Lady Elizabeth Bowes-Lyon?

Cheers,
Wol

Verify the identity of developers

Posted Apr 5, 2024 19:38 UTC (Fri) by gioele (subscriber, #61675) [Link]

> In some countries within the Schengen area (*cough* Germany) citizens are required to be in possession of an ID card (or passport) even within their own country.

Formally, Germany requires you to "possess" an identity document ("verpflichtet, einen gültigen Ausweis zu besitzen" = to have applied for it and to have it somewhere, for example at home) once you are 16. It is not required that you "are in possession" of an identity document (~= to carry with you).

https://www.gesetze-im-internet.de/pauswg/BJNR134610009.h...
https://www.gesetze-im-internet.de/englisch_pauswg/englis...

Verify the identity of developers

Posted Apr 4, 2024 22:47 UTC (Thu) by farnz (subscriber, #17727) [Link]

They don't even do that - all my passport actually does is establish that if someone presents it to you as "their" passport, and you don't believe them, you can hand them over to my country of origin, and my country of origin will arrange my return home (if it's me presenting the passport) and bill me for it later, or will arrest the person, bring them to my country of origin, and then prosecute them for using my passport while not being me, with potential for significant jail time over here.

In particular, for the purposes of holding me accountable for actions, my passport is less valuable than my purported name and e-mail address. If those aren't enough, my passport details are not; my country does not issue ID cards as a matter of course, and I therefore have no documentation that establishes my identity for the purposes of accountability.

Better yet, I'm allowed multiple passports as long as I am not using them to defraud the government. The details on my passport don't have to be my "legal" name, since there is no such thing - they just have to be a name that I use in the course of business. I could get a passport in the name "Linus Benedict Torvalds" quite legitimately, as long as I can show the government that I use that name regularly.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds