Re: [nm-admin] Identification step in the current scheme (Re: Fear the new maintainer process)
On Mon, Jul 31, 2000 at 03:06:36PM +0000, Dale Scheetz wrote:
> I strongly disagree with the interpretation being made here.
think you missing, or overlooking three very important things.
> Every applicant must provide an image file of a photograph of themselves,
> most desired is a passport or a photo ID, signed with their GPG key, in
> order to identify themselves to the group. This image is archived by the
> DAM as the record of the "eyeball" portion of the identification.
First off, though, I dispute your entire entire eyeball/handshake notion.
I've haven't seen anything in real life approaching it. Is this a formal
social model or a colloquial one?
> If the key is already signed by a current Debian member, no further
> identification is necessary. Otherwise the more complex "handshake" clause
> is executed.
>
> Having a key that is signed by a Debian member, doesnot constitute
> "eyeball" contact, as many members have admitted that, although they
> certainly looked at ID during the keysigning, they are not certain that
> they can still identify the person by face.
>
> Having the assurance that the keyholder is the applicant (this comes from
> the signature on their key) coupled with the signed image provided by the
> applicant closes the eye/hand loop. Neither is sufficient without the
> other.
No it does not. It allows a false image to be let in (if anything).
Essentialy what it boils down to is this.
Say there is an applicant, for example, Robert van der Meulen. This
applicant has a public key signed by Wichert, Ray Dassen and Michel
Onstein.
The new maintainer process says that these three people aren't competnant
enough, aren't trustworthy enough to be able to fully identify a
potential applicant.
Instead we insist that Robert supply us with a photo, signed by his key
(in turn signed by the `evil' 3 developers above). For what gain? We can
get assurances that the applicant knows the private key to the public key
jyst be insisting he sign the fortune file (or something else easily
verifible).
I think we should trust existing developers to be compentent key signers.
The current procedure buys us nothing but more processing time per applicant
(whose key is already signed).
> I would also ask: Do we want to accept people as members who are unwilling
> to show us their face?
>
> Obvoiusly I don't think so ;-)
It isn't obvious at all. I would also ask: Do we want to accpet people as
members who are unwilling to disclose their telephone number?
I would also ask: Do we want to accept epeople as members who are unwilling
to disclose their home addresses?
You are probably wondering why I am being some pedantinc about this point
the reason is this. At the current rate of processing we should have
gone through about 300 (or so) applicans and accepted (at least) half of
them.
It'll mean that, eventually, all maintainers will have their photo ID on
file which the DAM. To put it bluntly, if you don't believe you can
trust the DPL - why should I, or any other, developer trust the DAM?
If people choose to make pictures of themselves availale lets keep it
that -- their choice.
Anand
Reply to: