Messages in this thread | | | Date | Wed, 5 Oct 2011 16:00:39 -0400 | Subject | Re: kernel.org status: establishing a PGP web of trust | From | Arnaud Lacombe <> |
| |
Hi,
On Tue, Oct 4, 2011 at 6:39 PM, Adrian Bunk <bunk@stusta.de> wrote: > On Tue, Oct 04, 2011 at 04:29:48PM -0400, Valdis.Kletnieks@vt.edu wrote: >> On Mon, 03 Oct 2011 21:04:41 +0300, Adrian Bunk said: >> > On Mon, Oct 03, 2011 at 12:28:17PM -0400, Frank Ch. Eigler wrote: >> >> > > What is the threat that this passport checking is intended to cure? >> > > That someone else might have been impersonating Rafael for years, >> > > sending patches, chatting in email and over the phone, and attending >> > > conferences? >> > >> > Key signing is an identity check. >> >> That's dodging the issue. Somehow, I don't see Andrew Morton asking Linus to >> sign his key, and Linus saying "How do I know you're the *real* Andrew Morton?" >> And Andrew is a clever guy, if he was a fake Andrew, I'm sure he'd have gotten >> a fake ID that would be good enough to fool Linus, who is also a clever guy but >> I'm not aware of any special background he has in forgery detection. ;) >> >> The more important point is that as far as the linux-kernel community is >> concerned, the guy we've all seen show up at conferences and present stuff all >> these times *is* Andrew Morton, even if his real name is George Q. Smith and >> he's been on the run for the last 27 years for an embarassing incident >> involving an ostrich, the mayor's daughter, and 17 gallons of mineral oil in >> the atrium of the museum. ;) >> >> The ID check is to connect an actual person to the claimed key, and primarily >> intended for key signing parties and the like, where people *don't* know each >> other very well. I think there's something like 5 people on the linux-kernel >> list who actually know me in real life, because I don't travel much and I'm >> rather in the boonies. If I asked anybody *else* who I'd not met before to >> sign my key, yes, I'd expect them to check my ID, to ensure I wasn't somebody >> trying to pull a fast one at the keysigning party. > > If you just want to be sure that patch number 100 comes from the same > person as the 99 patches before you could do that without key signing > (require signed patches and check that all 100 patches were signed by > the same key). > > But the semantics of PGP key signing is that you certify that you > verified that a photo ID of that person matches the name on the key. > > No matter if that's needed for kernel purposes. > And no matter if it's possible to present you a fake ID. > > One might discuss what requirements for access to kernel.org machines make > sense or not, but when you sign a key you have to check a photo ID first. > >> > > If so, perhaps the impostor is of more value to the >> > > project than the Real Rafael. >> > >> > Pseudonymous contributions to the kernel are not allowed. >> >> See above - whoever Andrew Morton *really* is, his contributions are hardly >> pseudonymous. > > Each time a patch goes through him into the kernel, he certifies that > his real name is Andrew Morton. > > If that would not be his real name, it would make him somewhere between > completely untrustable and punishable at court. > Under which jurisdiction ? Under which law ?
IANAL, but US copyright law does recognize the use of pseudonym for copyrighted work[0], without requirements to disclose one's legal name.
- Arnaud
[0]: http://www.copyright.gov/fls/fl101.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |