<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Mar 1, 2014, at 1:35 PM, John Kreznar <<a href="mailto:jek@ininx.com">jek@ininx.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">In a posting lacking a digital signature, it is written:<br><br><blockquote type="cite">On Sat, Mar 1, 2014 at 12:09 PM, John Kreznar <<a href="mailto:jek@ininx.com">jek@ininx.com</a>> wrote:<br></blockquote><br><blockquote type="cite"><blockquote type="cite">What matters is that the mind that wrote the software and the mind that<br>knows the passphrase to the GPG key are one and the same. Physical<br>appearance is irrelevant.<br></blockquote></blockquote><br><blockquote type="cite">For signing packages, yea. But for proving that you are this person<br>with a certain key, yes, it is relevant.<br></blockquote><br>Ask this person to sign something, and then verify the signature.<br><br><blockquote type="cite">Which brings me back to your point, what would your solution to this?<br>(you meet someone, checked their ID, exchanged keys, and then took<br>them on their word that they are the true authors of the package)<br></blockquote><br>The physical meeting, their "ID", and their word add nothing to the<br>assurance you get by verifying their signature on something. The key IS<br>the relevant ID.<br></blockquote><div><br></div><div>Agreed, in the digital world, the key is the ID.</div><div><br></div><div>But there's always the question of what the key is supposed to represent. Does Debian actually want it to represent real people who are legally responsible for claims they make about code, or merely a unique author identity? Does a trusting user merely want a unique ID for a pen-pal, or something more?</div><br><blockquote type="cite">-- <br>OpenPGP key: <a href="http://ininx.com">http://ininx.com</a><br> John E. Kreznar <a href="mailto:jek@ininx.com">jek@ininx.com</a> 9F1148454619A5F08550 705961A47CC541AFEF13<br></blockquote></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>Personal email. <a href="mailto:hbhotz@oxy.edu">hbhotz@oxy.edu</a></div><div><br></div></span><br class="Apple-interchange-newline">
</div>
<br></body></html>