Re: [gentoo-project] pre-GLEP: Gentoo OpenPGP web of trust

[desultory <desultory@gentoo.org>]

On 02/01/19 08:25, Michał Górny wrote:
> On Thu, 2019-01-31 at 12:33 -0500, Rich Freeman wrote:
>> On Thu, Jan 31, 2019 at 8:56 AM Michał Górny <mgorny@gentoo.org> wrote:
>>>
>>> 1. It is entirely customary and therefore requires customized software
>>>    to use.  In other words, it's of limited usefulness to people outside
>>>    Gentoo or does not work out of the box there.
>>
>> This part could be addressed easily by having Gentoo create a signing
>> key, and automatically signing all dev keys based on LDAP using it.
>> Then users can trust that one key and inherit trust for the rest.
>>
>> Users have to opt into the trust model by trusting somebody's key no
>> matter what.  No reason that couldn't be a centrally-managed one.
>>
>> I'll also agree with the comment that physically interacting with
>> people is not all that easy.  There are many areas of the world where
>> FOSS developers are relatively uncommon, let alone Gentoo ones.
>> Unless those alternate organizations have VERY broad coverage (such as
>> an alternative of a notary recognized by any country or something like
>> that) you're still going to have issues.
>>
>>> Verify the person's real name (at least for the user identifier
>>>      used for copyright purposes).  This is usually done through
>>>      verifying an identification document with photograph.  It is
>>>      a good idea to ask for the document type earlier, and read on
>>>      forgery protections used.
>>
>> "usually"?  "identification document"?  Does this mean that an
>> appropriate method of verification is entirely up to individual
>> discretion?  If so that makes the process of getting every key signed
>> fairly trivial as long as two people have (in?)appropriately-rigorous
>> standards...
>>
> 
> I'm sorry, I keep forgetting that you can't rely on people in Gentoo
> being mature and you need to specify everything as 'MUST' and 'MUST
> NOT', or otherwise they are going to ignore the spirit of the policy
> and violate in the worst way permitted by bending the wording.
> 
You started this thread with what distinctly appeared to be a plea to
avoid ad hominem attacks, just to turn around make make them yourself.
Do, kindly, stop it.