Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Rich Freeman]

On Wed, Jan 4, 2017 at 4:27 PM, Kristian Fiskerstrand <k_f@g.o> wrote:
> On 01/04/2017 10:17 PM, Michał Górny wrote:
>>>> Isn't barrier of entry to Gentoo high enough already? I know many
>>>> people refusing to join because they consider quizzes
>>>> and the recruitment procedure to be too cumbersome and a waste of time.
>>> No, I don't feel that this is conflicting, on some level it comes down
>>> to a matter of more than technical skills, in this particular context
>>> also establishing trust, both in terms of security and in the long term
>>> responsibilities of both having commit access in general and maintaining
>>> the packages picked up for maintenance.
>> Are you assuming that having a verified proof of identity (well, more
>> of the name since I suppose you won't be recording all his data) of
>> a developer would prevent him from abusing his account?
>
> I would certainly consider it less likely
>

I would tend to agree.  Your real-world identity is tied to your
ability to earn a living, so you have an incentive to protect its
reputation.

And, in the event of abuse having to forge a government ID would be a
considerable barrier to re-applying, and it would likely increase the
stakes if you're caught doing it (since real-world governments tend to
look unkindly on the forgery of such things).

I don't question the usefulness of verifying identity, just the practicality.

-- 
Rich