Jonathan McDowell: Meta: Rant about rants about PGP keysigning problems
(This has ended up longer than I intended, largely because I felt I should then get into why. I'm aware I haven't got into all the nuances, so I hope readers familiar with the area will appreciate this is the compact version.)Thorsten had a rant last week about PGP keysigning problems. He apologises for his tone, but that's not the issue I take with his rant.
It starts "Keysigning is useless". And yet his complaints seem to be:
- Dealing with the private half of your GPG key securely involves some faff (in this case booting with a live CD and having to set things up ready to keysign).
- He doesn't get on with caff.
- People reject email from machines with invalid HELOs and perform other anti spam measures on ISP access ranges (I'm not clear if it's just greylisting or outright rejects as that's not made clear).
- PGP/MIME is a protocol violation (yes, but it's much better than inline OpenPGP. Unless you have to deal with RT, which mangles it. *sigh*)
Torsten does say that he'll continue to do keysigning on a per-person basis, so it doesn't sound like he's completely given up. I'm posting this largely so other Debian related people don't get the idea that it's not important to think about keysigning.
Why should we care?
Firstly, let's clarify what I mean when I sign someone else's key. If I sign your key then I think that I believe you hold the private part of a key that has your name and an email address I believe I can use to contact you on it. It means I have seen government issued ID that matches that name. It also means that I have interacted with you (and watched others interact with you) under that persona. In short I am happy that the key is a reasonable digital representation of your identity - something signed by it either comes from you or has involved the key being compromised or you coerced into using it against your will.
Why is this useful?
It gets useful thanks to the web of trust; ie the idea that there are a bunch of people I trust partially to sign other keys, and if enough of them have signed a key then I can have a reasonable expectation that the key belongs to the person I want to talk to. Which means I might be prepared to send private data to them. Or Debian might be prepared to accept an upload from them. Which, when you're dealing with a community that spans the planet and where most of the contributors haven't met each other, is pretty freakin' useful - I, as part of Debian's keyring team, don't need to personally be able to identify every Debian developer. All I need to do is be able to trust other DDs to be able to do so. (Though maybe I'm missing out on something here - perhaps Debian should be paying for Gunnar and me to travel the world verifying fingerprints. \o/)
(I still do mass keysignings btw. I'm picky about which keys I actually sign - this is in no way intended as a slight against those I don't, but a mass keysigning at least lets me know that the people involved are happy to exchange fingerprints. Though, FWIW, I normally have ID on me and frequently have fingerprint slips, so if you know me and want me to sign your key/want to sign mine then by all means ask me when you see me!)
Nathanael Boehm wrote a nice essay last month called
The
This moment has finally arrived! Last Saturday (27-th) on #debconf-team decision was made, DebConf11 is coming to Bosnia and Herzegovina!
Our team and myself were working on this whole candidature for last ~9 months, and even though we put incredibly amounts on energy, hard work, enthusiasm and everything else that goes along with it, suspense and uncertainty were there until the very last minute! One of our local team members (trip0d s) wife almost gave a birth to their child during the decision process that lasted full 4 hours
As a remainder we were competing with Ecuador and Germany to win this bid, whole process was excruciating and very emotionally distressful in every possible aspect for every team member; at one point Germany took a slight lead ahead of Bosnian team, while in the end by points Bosnia was in slight lead by 0.25 points, and this is exactly what touched me the most about this whole bid/decision/process.
This is not a great advantage or anything for that matter, but what happened is that in decision process Debian debconf team and its developers picked Bosnia and Herzegovina as a place where they want to have DebConf11! Our main competitors from M nchen, Germany showed a real fair play and at the end even yielded to our side; really to both of you, Michael Banck (azeem) and Andreas Barth (aba) it was a pleasure and honor to compete with you guys!
See you in NYC for proper handshake and possibly a hug?
Also I d like to thank Jimmy Kaplowitz (Hydroxide), Moray Allan (moray) who had chairs and who did absolutely incredible job I guess I ll just have to thank the whole debconf orga team for all their amazing work ( can t name names individually because I ll definitely forget someone!)
This bid really reunited whole Bosnia and Herzegovina, this whole process also united all of Balkans and whole of Ex Yugoslavia, which makes me especially happy since today (March 1st) we are celebrating the day we officially separated from Yugoslavia. Now this just one small step forward, since the real work is ahead of us and we re starting it all as soon as tomorrow since there s really a lot that needs to be done.
Again thank you all, we ll give our best for this to be a DebConf you ll remember (as a great one of course!), in the meantime see you in New York City!
Adnan Hodzic aka AbsintheSyringe team leader on behalf of whole debconf11-team.
For my research at the university, I've become a lead developer for

DebConf 11 will be held in Banja Luka, Bosnia and Herzegovina. Munich, Germany arrived on a close second and our bid, Quito, Ecuador, arrived last, allegedly because some points flipped over since DC 11 was meant to happen in Europe. So, after having three DebConfs hosted in America in the last four years, DebConf 11 will travel to Europe in 2011! Good news for all our fellow DDs and contributors over there.
The Banja Luka team managed to get an important support from their Government. They even met with the Prime Minister and got him to sign an offer of full support. I think this becomes dangerous for a DebConf, given that I ve worked and have had mishaps while funding conferences with at least three governments (Ecuador, Venezuela and Brazil) with stronger levels of support (Law-like level) for free software and I know that at least other two governments in the World have unfortunately done this in the past. So we need backup plans and lots of follow-up activities with the stakeholders.
However, this agreement sets an important milestone in government support for free and open source software as well as Debian. I ll use it in my Debian slides, and congratulations!
IMO, Munich would have made a great host for DC11 in terms of air travel connectivity, at a bigger hit on local costs, but nothing that would differ that much from DC7, though! I don t think I ll be able to make it at this moment to Bosnia (struggling for NYC) and at this point it s premature to think on supporting Quito s again for DC12. People and sponsors get gradually tired, even with spiritual commitment.
The DC10 decision meeting was long and lots of things needed to be improved. At that moment I thought the Project learnt useful lessons for future meetings, but we re repeating ourselves now on the DC11 decision meeting. And now, I m just hoping for the best, for the sake of the time and sanity of all us here. Ditch the priority list altogether, increase the stakeholders on the global team, filter bids early in the process and use more technology to improve the information flow before the decision!
If you want to help the
Christian Robert
n was more of a symbolic meaning, since in meantime we solved our bids weakest links and pretty much got it mature and at the stage we were aiming it to be. We ll still make some minor changes to it until the final decision date (in 47 hours) but this is it really
So without further ado, let me introduce you to our n wiki
Since besides changing pretty much the whole wiki we have also added (important) new pages for:
Banja Luka and Republika Srpska
We have added a new pages to bring
To remind you, we will get free venue building wheter it s Government Building or Banski Dvori , besides that we re getting them to cover basically all of the costs needed for the conference, and besides that we re getting 5 additional members to our local team (highly capable and educated govt. officials) which even includes city Mayor. Early tomorrow we ll get scan/fax of this memorandum from Chief of Cabinet along with the local team names which will all together be added to this very wiki page.
Local Team
We have almost
Bosnia and Herzegovina FTW!
A good friend of mine convinced me to give "The Wire" a try. I've just
finished season four of five. This is the best TV programme I have ever seen.
I'd have a renewed faith in the TV industry's quality standards
were it not for the fact it stands alone, quality-wise.