LWN: Comments on "Key signing in the pandemic era"

Key signing in the pandemic era

ballombe — Sun, 20 Sep 2020 18:01:00 +0000

This was a convenient way to avoid multiple identities, which would be a problem for Debian, more than for other organizations (for example we hold election with 1 person = 1 vote).
Track record of contribution does not prevent multiple identities, on the contrary, the experience gained
establishing one identity carry to the other.

Key signing in the pandemic era

rra — Sat, 19 Sep 2020 05:47:24 +0000

Agreed. Personally, I can't build trust in someone by only meeting them in person. It's by working with them through some period of time (weeks or months) that I build up trust. The new policy captures that: we're now explicitly recognizing that form of trust via a track record of contributions. In a way it brings Debian more in line with other free software projects where membership was always based on contribution track records.

What we lose is the strength of tie to a legal identity in case something really bad happens and we have to involve legal authorities. (It's dubious how real that tie truly was; paperwork can obviously be forged, although that does raise the bar and risk for an attacker.) In practice I don't think we've ever used that tie.

Key signing in the pandemic era

gerdesj — Thu, 17 Sep 2020 00:42:42 +0000

I'm a relatively benign entity (I think.)

I always use my real name on the internets (gerdesj == Jon Gerdes) apart from /. where I registered as JSG (my initials). I can't remember why but there you go. I was a lurker for several years before I plucked up the courage to register. I think I am quite rare in that I do use my real identity in all my dealings on t' tubes. I may be miss-advised but I'm CREST accredited.

Obviously, I would not recommend my approach for everyone.

The pandemic has absolutely no bearing on trust in my opinion. I can chat with you at five meters and hence keep social distance. I can send you emails or chat on Jitsi. Trust is really a human thing. GPG is a mechanism that can facilitate trust but it can't enforce it, nor provide evidence.