3 ms·
In my experience Debian has always had it's share of community drama and static. Around 2002 I used to publish a couple of RPMs and since I used to use Debian m
by seanhunter 5y ago
In my experience Debian has always had it's share of community drama and static. Around 2002 I used to publish a couple of RPMs and since I used to use Debian myself for some of my own servers I decided to publish .debs as well. So some debian folks asked me to "make them official". I found becoming a Debian dev such a pita I just abandoned the attempt. Literally at one point one Debian dev who was a co-worker of mine in real life refused to sign my key because he said "how could he really sure of my identity". Dude, we work together, for a regulated financial institution that does background checks. How could I get away with having some kind of secret identity?
I just decided to avoid the friction and not bother publishing my .debs.
- drsnow 5y agoWhy didn't you just verify when co-working that yes, you are the one who is asking to have your key signed? Wouldn't that have solved it all in one go?
- seanhunter 5y agoI'm not sure what you mean. He literally said that to me in a face to face conversation.
- andyonthewings 5y agoUsually the verification is as simple as taking a look at the key owner's ID card (Social Security card) or driver license, or any similar legal doc, just to make sure the key owner name matches the real person. I got my key signed with the same simple procedure. The only troublesome part was to find Debian devs to meet physically, because there were only 3 in where I live (Hong Kong), and only one of them had a valid key (others have expired or just lost keys). Two signatures are needed, so I needed one more. Luckily, I happened had to travel to the US for work, so I solved my problem.