6 ms·
> National ID How are you going to verify a national ID? By taking a photo of it? What if the photo is edited? By somehow going to the maintainer in person and
by cesarb 3y ago
> National ID
How are you going to verify a national ID? By taking a photo of it? What if the photo is edited? By somehow going to the maintainer in person and looking for anti-counterfeiting features in the paper? What if the ID is old enough that it predates these anti-counterfeiting features? Not all countries are Germany.
> or verification by an employer.
What if the maintainer is unemployed? What if the reason the maintainer has enough free time to maintain the package is because they're already retired, and living off their pension or investment returns?
> Both are ubiquitous
From what I've heard in the Internet, some large countries still don't have a national ID.
- gkbrk 3y agoSome countries have national IDs with public-key encryption. You can use the ID card itself to sign things.
- Barrin92 3y ago>What if the maintainer is unemployed? How many actually existing maintainers in particular of security sensitive parts of open source projects don't have at least some record of employment or education, a modern passport or national ID with eID features, some other comparable form of identification or at least say one reputable person in the community who can verify they are who they say they are? Are we seriously pretending the standards that exist for ordering a beer in a bar can't be met for software security that literally billions of people depend on?