Re: [gentoo-project] [RFC] OpenPGP Authority Keys to provide validity of developer/service keys

[Rich Freeman]

On Sat, Feb 23, 2019 at 11:30 AM Alec Warner <antarus@g.o> wrote:
>
> - As rich noted, most people have no idea how GPG works and they
> just do whatever they are instructed to do. I don't think a lack of
> knowledge of GPG indicates "being a troll" nor "lack of technical
> competence."

I wasn't even arguing ignorance.  I've been using PGP since the days
when I had to jump through hoops to get around the ITAR restrictions.

I don't follow the Gentoo instructions because I don't know how to use
gpg.  I follow them because the GLEP has a stack of requirements for
how a Gentoo gpg key ought to be set up, and since I have no intention
of ever using the key for anything else, there is no reason to waste
time tailoring it to my own needs.  It is no different from my company
laptop - I configure it however they want me to and don't use it for
anything personal.  That isn't because I don't know how to use gmail
or Facebook or whatever on it, but simply because it makes no sense
for me to get frustrated with whatever the IT policy is of the day
when a laptop starts at $120 these days and I can just use my own, and
I have independent internet anywhere I go.

Likewise the reason I don't sign my email isn't because I don't know
how thunderbird/kmail/whatever works.  It is because there isn't much
intersection between MUAs that fit how I actually access email these
days and MUAs that can securely access my key.  If my Gentoo email
workflow required a more gpg-centric workflow then I'd set up a
separate email account just for Gentoo, use Thunderbird or whatever
with it on a single desktop, and not look at it much except when I had
to.  Or maybe if it were supported I'd use a different key for email
so that I wouldn't need to go sticking my commit-signing key on every
phone/laptop/whatever I use where it could get compromised and end up
with some poor soul getting rooted, and I could be more liberal with
the email key.  Really though I suspect that some of the newer
x509-based protocols are better-supported by email clients.

I've been involved with Gentoo in one way or another for approaching
15 years and in all that time I think I've had to use gpg for
something other than commit-signing maybe once or twice.  Nothing
wrong with using it, and I accept that some roles might require it
more often, but it seems a bit overkill to invest a ton of time in
secure email for an organization that almost never needs secure email.

No trolling intended.  I just don't see the point.  If it were
required then I would comply.  I completely get the spirit vs the
letter of the rules, but IMO this doesn't fall under either.  As far
as I can tell there was never any intent to require an email signing
subkey, and this was not a mere accidental omission, at least not on
the part of the majority of council members who voted for the policy.

-- 
Rich