Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Michał Górny]

On Wed, 4 Jan 2017 21:47:34 +0100
Kristian Fiskerstrand <k_f@g.o> wrote:

> On 01/04/2017 08:12 PM, Michał Górny wrote:
> > On Wed, 4 Jan 2017 18:58:26 +0100
> > Kristian Fiskerstrand <k_f@g.o> wrote:
> >
> >> With increasing focus on security in various contexts I'd like to
> >> propose that we start discussing catching up with other distributions
> >> and start requiring new developers' OpenPGP keyblocks to have at least
> >> two signatures from existing developers before applications can be
> >> made[A]. Amongst other things This helps building the Gentoo Web of Trust.
> >>
> >>
> >> E.g [Debian] has the following requirement: "To maintain the strong Web
> >> of Trust that connects all Debian Developers, Applicants need to
> >> identify themselves by providing an OpenPGP key that is signed by at
> >> least two official Developers. To further ensure their identity,
> >> signatures by other people (who do not need to be DDs, but should be
> >> well connected in the overall Web of Trust) are strongly recommended."
> >
> > Isn't barrier of entry to Gentoo high enough already? I know many
> > people refusing to join because they consider quizzes
> > and the recruitment procedure to be too cumbersome and a waste of time.
>
> No, I don't feel that this is conflicting, on some level it comes down
> to a matter of more than technical skills, in this particular context
> also establishing trust, both in terms of security and in the long term
> responsibilities of both having commit access in general and maintaining
> the packages picked up for maintenance.

Are you assuming that having a verified proof of identity (well, more
of the name since I suppose you won't be recording all his data) of
a developer would prevent him from abusing his account?

-- 
Best regards,
Michał Górny
<http://dev.gentoo.org/~mgorny/>