From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 58163138334 for ; Sat, 2 Feb 2019 13:47:50 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0194FE09A5; Sat, 2 Feb 2019 13:47:48 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B37CEE0984 for ; Sat, 2 Feb 2019 13:47:47 +0000 (UTC) Received: by mail-pg1-f170.google.com with SMTP id v28so4299312pgk.10 for ; Sat, 02 Feb 2019 05:47:47 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=PluwTxquNJsyOR0JJOoyKG9O/mt/7snE6pFi8sBAqaM=; b=pOAjQcFxbEotXwtp8CQ6hdpwtCmZFjhE6jEUEQYANdSfYNcsArTew58zr6InKva2XF b7X0oyYuK7DSEqkC23OlxtCVTc0Xtnd05q3muywer1oxIZ83SvP7ZE2r3DNnUdTwpzZN SnpOuft9VGEr4WxKJTxWgoPF6hEHKadD8Jw9uVxnASGmzn+3o7VGLQEykGgqM8ZT3MIQ KlX2y+xe7cfpmGSjam+T6NHsOYjcn2ibRqJFBlAAaVqBjL46f92IVMF5oNu6XgyMUmij y8iZIlrJ0c0ie41jKBzzBQy7tFTgF85ybjb+kRz90004hyMjzeeKAQUD7Tfhv864fBYy 2cEg== X-Gm-Message-State: AHQUAub12p7PtECN0+p6akGzUFi2evNw7ULNaDxDtjtJyArJo6lxOGxq mUBmOGI/vOFfxqIas597wamkIKBBYMWHGGF0Jw6ufg== X-Google-Smtp-Source: AHgI3IZ9hoyRRxwCSHZ4O6KNqo7TAi3oSVsBQ5/aHxlrq1uqKqE27F+oRBcayD9dVnhaB0yL0XtlVbzSIiUUR5UxDD8= X-Received: by 2002:a63:4b60:: with SMTP id k32mr6135854pgl.186.1549115266038; Sat, 02 Feb 2019 05:47:46 -0800 (PST) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 References: <1548943008.796.1.camel@gentoo.org> <1549027511.722.0.camel@gentoo.org> In-Reply-To: From: Rich Freeman Date: Sat, 2 Feb 2019 08:47:34 -0500 Message-ID: Subject: Re: [gentoo-project] pre-GLEP: Gentoo OpenPGP web of trust To: gentoo-project Cc: =?UTF-8?B?TWljaGHFgiBHw7Nybnk=?= Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 0a052080-e333-4d8a-ad9e-d0cf28e97f8c X-Archives-Hash: 5fb2543d036e7180a01c0b0d7f6366c9 On Sat, Feb 2, 2019 at 12:55 AM desultory wrote: > > On 02/01/19 08:25, Micha=C5=82 G=C3=B3rny wrote: > > On Thu, 2019-01-31 at 12:33 -0500, Rich Freeman wrote: > >> On Thu, Jan 31, 2019 at 8:56 AM Micha=C5=82 G=C3=B3rny wrote: > >> > >>> Verify the person's real name (at least for the user identifier > >>> used for copyright purposes). This is usually done through > >>> verifying an identification document with photograph. It is > >>> a good idea to ask for the document type earlier, and read on > >>> forgery protections used. > >> > >> "usually"? "identification document"? Does this mean that an > >> appropriate method of verification is entirely up to individual > >> discretion? If so that makes the process of getting every key signed > >> fairly trivial as long as two people have (in?)appropriately-rigorous > >> standards... > > > > I'm sorry, I keep forgetting that you can't rely on people in Gentoo > > being mature and you need to specify everything as 'MUST' and 'MUST > > NOT', or otherwise they are going to ignore the spirit of the policy > > and violate in the worst way permitted by bending the wording. > > > You started this thread with what distinctly appeared to be a plea to > avoid ad hominem attacks, just to turn around make make them yourself. > Do, kindly, stop it. Neither of our comments were helpful here. I made a passive-aggressive post out of emotion and mgorny made a provoked passive-aggressive reply (which is why we shouldn't be communicating this way in the first place). In both cases the tone distracted from the gist of the points: 1. The standards for identification are somewhat subjective and will necessarily vary from individual to individual. You actually phrased this concern better in your reply, and perhaps I might have done the same if I had taken more time to compose myself better. 2. Mgorny's point is that in practice well-intending identity verifiers are probably going to be good enough at getting the job done. I agree, though mainly because I don't think it is important that the job be done at all. --=20 Rich