4 ms·
> And then there's https://security.googleblog.com/2021/02/know-prevent-fix-fra https://security.googleblog.com/2021/02/know-prevent-fix-fra... which effectivel
by RcouF1uZ4gsC 6y ago
> And then there's https://security.googleblog.com/2021/02/know-prevent-fix-fra https://security.googleblog.com/2021/02/know-prevent-fix-fra... which effectively calls for the end of open-source contributors staying pseudonymous.
I think that will do more harm than good. First of all a lot of critical software is security related and encryption related and I would guess a higher proportion of contributors in that area are more sensitive to protecting their identity than the general developer population. So you would lose out on some contributions that you would otherwise have gotten.
Second, a major threat in this area arises from nation states. However, due to experience with physical espionage, nation states are already pretty good at establishing fake identities for people (for example it would be no problem for them to supply a fake (or even real) passport/ birth certificate/etc or turning people who are already working in critical areas. Thus getting rid of anonymity would not even be a speed bump for Five Eyes, Russia, China, North Korea, etc.
So I don’t thing there would be much benefit, but there would be a lot of cost.
- jacques_chester 6y agoWhether or not there is an impenetrable fake identity is a different question from "now that identity Foo is untrustworthy, what other things do I need to inspect?"
- RcouF1uZ4gsC 6y agoFor that, you don’t need any type of real world identity. If you require that people sign their commits/reviews with a PGP key and base their reputation on that, that still gives you much the same benefit, while at the same time allowing people to be anonymous.
- jacques_chester 6y agoTo be clear, I agree. The point I was trying to make was that stable identity, whether real or pseudonymous, has value in a security context.
- Avamander 6y agoI think a known pseudonymous identity is better than an unknown fake identity. Real names lower guard but most have no way to actually verify.