<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">"Trust" is tricky. I was trying to list extremes.<div><br></div><div>Thanks for the Debian reference. That makes things concrete.</div><div><br><div><div>On Mar 2, 2014, at 6:40 PM, John Kreznar <<a href="mailto:jek@ininx.com">jek@ininx.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">In a posting lacking a digital signature, it is written:<br><br><blockquote type="cite">On Mar 1, 2014, at 1:35 PM, John Kreznar <<a href="mailto:jek@ininx.com">jek@ininx.com</a>> wrote:<br></blockquote><br><blockquote type="cite"><blockquote type="cite">The physical meeting, their "ID", and their word add nothing to the<br>assurance you get by verifying their signature on something. The key<br>IS the relevant ID.<br></blockquote></blockquote><br><blockquote type="cite">Agreed, in the digital world, the key is the ID.<br></blockquote><br><blockquote type="cite">But there's always the question of what the key is supposed to<br>represent. Does Debian actually want it to represent real people who<br>are legally responsible for claims they make about code, or merely a<br>unique author identity?<br></blockquote><br>Here's a statement of what Debian wants, from debian-keyring README [1]:<br><br> The Debian project wants developers to digitally sign the<br> announcements of their packages, to protect against forgeries.<br><br>And of course, FOSS packages are usually replete with disclaimers of<br>legal warranty.<br><br>Signing a software package with a GPG key works just fine for this<br>purpose, especially if that key has gained positive reputation in prior<br>general correspondence.<br><br><blockquote type="cite">Does a trusting user merely want a unique ID for a pen-pal, or<br>something more?<br></blockquote><br>Not sure how this bears.<br><br>[1] /usr/share/doc/debian-keyring/README.gz on Debian systems<br><br>-- <br>OpenPGP key: <a href="http://ininx.com">http://ininx.com</a><br> John E. Kreznar <a href="mailto:jek@ininx.com">jek@ininx.com</a> 9F1148454619A5F08550 705961A47CC541AFEF13<br><br></blockquote></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>Personal email. <a href="mailto:hbhotz@oxy.edu">hbhotz@oxy.edu</a></div><div><br></div></span><br class="Apple-interchange-newline">
</div>
<br></div></body></html>