[gentoo-dev] Keysigning at LWE

[gentoo-dev] Keysigning at LWE

[Corey Shields]

[-- Attachment #1: Type: text/plain, Size: 1227 bytes --]


After talking with klieber a bit, we've decided to organize a little
keysigning for those who will be at next week's LinuxWorld Expo in San
Francisco.  This will be a bit different yet somewhat more convenient
than traditional keysigning "parties".  This is strictly optional and
nobody is forcing anybody to participate.

Here is the process we are going to take

- Send your ascii armored public key to cshields@gentoo.org BEFORE this
coming Saturday (my apologies for the short notice)

- I will compile a list along with fingerprints, make it publicly
available along with the md5sum of the list.

- Stop by the Gentoo booth at LWE (booth 1 in the ".org pavilion") and
bring a government issued photo ID, and your GPG fingerprint. We will
verify your fingerprint with the one on the list, and your key will be
marked as valid.

- The list of valid keys will be made available after LWE and everyone
can sign each valid key from the original list and send it back to the
owner.  

- Those who fail to show up or whose fingerprint does not match will not
be marked valid and should not be signed.

Cheers!

-- 
Corey Shields - Gentoo Linux Infrastructure Team
http://www.gentoo.org/~cshields

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Patrick Kursawe]

[-- Attachment #1: Type: text/plain, Size: 446 bytes --]

On Wed, Jul 30, 2003 at 10:35:05AM -0500, Corey Shields wrote:
> - The list of valid keys will be made available after LWE and everyone
> can sign each valid key from the original list and send it back to the
> owner.  

Perhaps I misunderstand you, but are you actually encouraging people
to sign keys they did not personally verify?

What's the idea behind this, if weakening the web of trust isn't? :-)

Just wondering,

Patrick	

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Corey Shields]

[-- Attachment #1: Type: text/plain, Size: 1112 bytes --]

On Wed, 2003-07-30 at 10:40, Patrick Kursawe wrote:
> Perhaps I misunderstand you, but are you actually encouraging people
> to sign keys they did not personally verify?

Yes.  However, there will be others at the booth that they can
personally verify as well when they come to veryify their own identity,
and if the people at the booth verify everyone else, then it's all the
same, which is why it's called a "web" of trust.  If you come to verify
and trust the people in the booth, who verify everyone else, then it
should be the same.   If you don't trust the people in the booth who are
verifying everone else, then should you be allowing them to sign your
key in the first place?

> What's the idea behind this, if weakening the web of trust isn't? :-)

Not really.

> Just wondering,

That's okay.  I figured some people would have a beef with it, which is
why I stressed that it's a voluntary thing.  If you're not comfortable
with this method, then you don't have to participate. 

Cheers!

-- 
Corey Shields - Gentoo Linux Infrastructure Team
http://www.gentoo.org/~cshields

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Fred Van Andel]

Patrick Kursawe <phosphan@gentoo.org> wrote:
(07/30/2003 08:40)

>On Wed, Jul 30, 2003 at 10:35:05AM -0500, Corey Shields wrote:
>> - The list of valid keys will be made available after LWE and everyone
>> can sign each valid key from the original list and send it back to the
>> owner.  
>
>Perhaps I misunderstand you, but are you actually encouraging people
>to sign keys they did not personally verify?
>
>What's the idea behind this, if weakening the web of trust isn't? :-)
>
>Just wondering,
>
>Patrick	

I think some people are getting too hung up on the identity thing.

Within the context of the gentoo community does it matter what the real name of someone is?  The only identity that ultimately matters is the identity that has cvs access, and to a lesser extent the identity that appears on irc.

If seemants real name were not Seemant Kullen but rather Joe Smith, I wouldn't care because it doesn't matter to me.  Seemants identity is not his name but rather his contribution to gentoo.  And his contribution is independent of his "real" name.

For many things the concept of "real" identity is important. I don't think gentoo has to be one of them. 

To me a signature on a gentoo address means that I am verifying that this identity is a gentoo developer, and I don't need to see government ID for that. In fact official ID gets in the way. I know carpaski is a gentoo developer, but I don't know that this particular individual who is presenting me with ID that says "Nicolas Jones" is in fact carpaski.  He could be a completely different "Nicolas Jones" and I have no way of telling them apart.

I realize this might piss off some and I am sorry, but this has been bothering me for some time and I want to vent.

Fred Van Andel
fava@gentoo.org
GPG KeyID: 76526AD599455482  
GPG fingerprint: 64E4 4BAB 9C99 D565 3E3C F5D0 7652 6AD5 9945 5482


--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Keysigning at LWE

[Corey Shields]

[-- Attachment #1: Type: text/plain, Size: 1807 bytes --]

On Wed, 2003-07-30 at 11:46, Fred Van Andel wrote:
> I think some people are getting too hung up on the identity thing.
> 
> Within the context of the gentoo community does it matter what the real name of someone is?  The only identity that ultimately matters is the identity that has cvs access, and to a lesser extent the identity that appears on irc.

If someone decides to use a different identity online, that's cool.
However, they shouldn't take offense to the rest of us signing each
others keys.

<snip>

> To me a signature on a gentoo address means that I am verifying that this identity is a gentoo developer, and I don't need to see government ID for that. In fact official ID gets in the way. I know carpaski is a gentoo developer, but I don't know that this particular individual who is presenting me with ID that says "Nicolas Jones" is in fact carpaski.  He could be a completely different "Nicolas Jones" and I have no way of telling them apart.

Some of us use the gentoo.org address as a secondary UID on our primary
gpg key.  Therefore, I would rather know that who I am signing (and visa
versa) is the identity of that person.  Best way to do that is with a
photo ID.

If you have a solution for signing keys of people with identities that
are not their own, maybe that should be used for those people.  

> I realize this might piss off some and I am sorry, but this has been bothering me for some time and I want to vent.

No, not at all..   kind of expected some fallout when I posted the
idea.  There are a few of us who will be signing our keys when we meet
at LWE, and so we just wanted to extend the invitation to anyone else in
the gentoo community.

Cheers!

-- 
Corey Shields - Gentoo Linux Infrastructure Team
http://www.gentoo.org/~cshields

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Sven Vermeulen]

[-- Attachment #1: Type: text/plain, Size: 617 bytes --]

On Wed, Jul 30, 2003 at 12:24:38PM -0500, Corey Shields wrote:
[...]

Another way of keysigning is to have a dedicated time to do so. 

First, all ppl mail their pubkey and fingerprint to a general person who puts
them online before the meeting.

On the meeting (at the dedicated time) all ppl are named and show their
fingerprint to the rest of the room (through a whiteboard or a projection).

This way you can personally verify the fingerprint _and_ see the person in
live action (even take a picture of your favorite dev :)

Wkr,
	Sven Vermeulen


-- 
    Save some animals, eat a vegetarian.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Patrick Kursawe]

[-- Attachment #1: Type: text/plain, Size: 1008 bytes --]

On Wed, Jul 30, 2003 at 08:59:12PM +0200, Sven Vermeulen wrote:

> Another way of keysigning is to have a dedicated time to do so. 
> 
> First, all ppl mail their pubkey and fingerprint to a general person who puts
> them online before the meeting.
> 
> On the meeting (at the dedicated time) all ppl are named and show their
> fingerprint to the rest of the room (through a whiteboard or a projection).

Yes. That's the way keysigning is usually organized, and it makes sense.
I think "trust the guys at the booth and sign what they told you to sign"
is just quite exactly _not_ what the web of trust is meant to be.
Signing should allow you to see, not just to guess who actually verified
which ID.

Signing a key means verifying identity. Who trusts who is a different
kind of matter, and it's not just for fun GPG provides trust values
for keys. So I would recommend doing it the way Sven proposed - 
or let the guys at the booth sign keys of visitors and vice versa.

Bye, Patrick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Keysigning at LWE

[Fred Van Andel]

Corey Shields <cshields@gentoo.org> wrote:
(07/30/2003 10:24)

Sorry about the delay in responding. My firewall/mailserver was down with hardware issues.

>On Wed, 2003-07-30 at 11:46, Fred Van Andel wrote:
>> I think some people are getting too hung up on the identity thing.
>> 
>> Within the context of the gentoo community does it matter what the real name of someone is?  The only identity that ultimately matters is the identity that has cvs access, and to a lesser extent the identity that appears on irc.
>
>If someone decides to use a different identity online, that's cool.
>However, they shouldn't take offense to the rest of us signing each
>others keys.
>
><snip>
>
>> To me a signature on a gentoo address means that I am verifying that this identity is a gentoo developer, and I don't need to see government ID for that. In fact official ID gets in the way. I know carpaski is a gentoo developer, but I don't know that this particular individual who is presenting me with ID that says "Nicolas Jones" is in fact carpaski.  He could be a completely different "Nicolas Jones" and I have no way of telling them apart.
>
>Some of us use the gentoo.org address as a secondary UID on our primary
>gpg key.  Therefore, I would rather know that who I am signing (and visa
>versa) is the identity of that person.  Best way to do that is with a
>photo ID.

In my case I have created a seperate key for my gentoo email address so that the key can be signed/revoked without affecting my main email address.

>If you have a solution for signing keys of people with identities that
>are not their own, maybe that should be used for those people.  

My point is that there gentoo identity is the one that matters, their real identity is irrelevant to gentoo. As far as gentoo is concerned there is only one identity.

If carpaski were to place his key in his protected directory on dev.g.o I would be confindant that it is his key (root manipulations aside). The presenance of carpaski's key however tells me nothing about Nicolas Jones, that would require more conventional proof.

>> I realize this might piss off some and I am sorry, but this has been bothering me for some time and I want to vent.
>
>No, not at all..   kind of expected some fallout when I posted the
>idea.  There are a few of us who will be signing our keys when we meet
>at LWE, and so we just wanted to extend the invitation to anyone else in
>the gentoo community.

I have absolutely no objection to key signings, my objection is within gentoo they are not strictly necessary.  The requirement for confirming physical ID's will not be easy since we are a global orginization.  The infrastructure changes that are coming regarding signing and verifying ebuilds and such will be hard to set in place unless everyones signes and is signed.

Fred Van Andel
fava@gentoo.org
GPG KeyID: 76526AD599455482  
GPG fingerprint: 64E4 4BAB 9C99 D565 3E3C F5D0 7652 6AD5 9945 5482


--
gentoo-dev@gentoo.org mailing list