[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [nm-admin] Identification step in the current scheme (Re: Fear the new maintainer process)



Dale wrote: 
 > Matthew Vernon wrote:
 > > Therefore, what does it matter that I can't remember the face of the
 > > person whose key I signed six months ago? I am still happy that I saw
 > > good ID, and that if I get mail signed/encrypted with that key that it
 > > comes from that person.
 > > 
 > While your happiness _is_ important, just how does it help the
 > administrators of Debian? I haven't seen his face, nor has the DAM. You

Because you trust me (possibly by many steps removed) to have checked
his identity correctly.

 > are the lucky one who _has_ seen his face, but we know we can not ask you
 > at this point if the face matches the name. We agree that the activity

Why does this matter? We know the face<->name mapping to be correct
now (since it was then, and face-change surgery isn't all that common).

 > actually happened at the same time we agree that we can't re-create the
 > event accurately in memory.

Why does this matter?
 
 > Why? You don't reject the requirement for showing your ID when another
 > individual asks to sign your key. How is showing your picture to the
 > administrative members of Debian any different?

Because it's unnecessary, and because I don't like other people
keeping copies of photos of me lying aroudn (so I accept other people
may not want this to happen to them either).
 
 > What threat do you experience from having an image of your face on record
 > with this group to which you belong? Will you only come to a conference in
 > disquise? Why is one acceptable and the other anathema?

I'm not saying it's anathema. I'm saying that it's unnecessary and
people may object to it - therefore it should not be a requiement to
join Debian.
 
 > This photo isn't about a "web of trust". That requirement is satisfied by
 > the key. The photo is about being able to identify our membership. As your
 > key fingerprint is not required to be barcoded onto your hand, the image
 > of your face is a good alternative.

Why do we need to identify our members' faces? It's not like Debian
know what I look like, or many other developers.

Matthew

-- 
Rapun.sel - outermost outpost of the Pick Empire
http://www.pick.ucam.org



Reply to: