4 ms·

Bootstrapping trust is hard. Debian is a good example here. A requirement of being a Debian Maintainer or Developer is that you must have met real existing Deb

by rlpb 13y ago

Bootstrapping trust is hard. Debian is a good example here. A requirement of being a Debian Maintainer or Developer is that you must have met real existing Debian Developers in person and they must have signed your key (after checking your identity)[1]. This certainly does make it harder to become a DM or DD. But it gives us the Debian keyring, which is the distro trust implementation for Debian as explained in the article. However, despite the difficulty in bootstrapping developers, Debian have achieved it. Thanks to them, there are many more people in the strong set[2], and you can probably find one near you[3]. Can we use this to bootstrap other communities, and end up in a situation where it's normal to already have been "introduced" into the strong set if you're a software author in any project? [1]: http://www.debian.org/devel/join/nm-step2 http://www.debian.org/devel/join/nm-step2 [2]: http://pgp.cs.uu.nl/plot/ http://pgp.cs.uu.nl/plot/ [3]: http://wiki.debian.org/Keysigning/Offers http://wiki.debian.org/Keysigning/Offers

lifeisstillgood 13y ago
That's an interesting idea - there could be easily be a Python core key ring and each library / package could connect off that trust circle. Interesting -
- rlpb 13y ago
  The catch is that signing a key does not usually convey "trust", just "identity". In Debian, trust is assigned at the end of a successful application process to becoming a Debian Maintainer or Developer, and this trust is conveyed for a particular identity with presence in the official Debian keyring. So in Debian, trust is centralized. However, it doesn't have to be exactly like this. I can imagine a decentralized system built on the same tooling. For example: you could require three certifications from existing members in the set, bootstrapped from Guido, for inclusion in the trusted keychain. (You might additionally limit the maximum degrees of separation from Guido to assist with auditability).

by rlpb 13y ago

lifeisstillgood 13y ago

That's an interesting idea - there could be easily be a Python core key ring and each library / package could connect off that trust circle. Interesting -

rlpb 13y ago
The catch is that signing a key does not usually convey "trust", just "identity". In Debian, trust is assigned at the end of a successful application process to becoming a Debian Maintainer or Developer, and this trust is conveyed for a particular identity with presence in the official Debian keyring. So in Debian, trust is centralized. However, it doesn't have to be exactly like this. I can imagine a decentralized system built on the same tooling. For example: you could require three certifications from existing members in the set, bootstrapped from Guido, for inclusion in the trusted keychain. (You might additionally limit the maximum degrees of separation from Guido to assist with auditability).