SFD09 – The final call for volunteers

[Leslie I'Anson]

Hello,

As you all know Software Freedom Day 2009 is due to take place on
Saturday, 19th September at the University of Manchester
<http://manchester.fsuk.org/blog/2009/09/08/manchester-software-freedom-day-19th-september-2009/>
and many of you have already expressed a keen interest in attending
and participating.

Now that we are less then two weeks away, it is time to finalise these
arrangements and get your name on the SFD team wiki
<http://softwarefreedomday.org/teams/europe/uk/manchester>.

For those of you who are interested in participating but are unsure
how, here are a few suggestions:-

  * Demonstrate your favourite piece of Free Software
      - Firefox, OpenOffice, GIMP, Pidgin, Frozen Bubble...
  * Conduct a beginner-friendly workshop
      - How to install Ubuntu/gNewSense in 7 easy steps.
  * Give a short talk/presentation
      - Introduction to Free Software.
  * Offer technical advice
      - “Do do I?”...
  * [Wo]Man a stall
      - Giveaways, books, merchandise, refreshments.
  * Report on the event
      - Attend, take pictures and write an article/blog post.
  * Be a shepherd.
      - Meet, greet and usher people in.

If you can't attend on the day but would still like to help, then why not:-

  * Burn some Free Software CD-ROMS
      - Ubuntu, Debian, gNewSense, OpenDisc and OpenEducationDisc are
all good examples.
  * Promote the event
      - Among friends and family, put up some posters or do some flyering.
  * Lend us some demonstration equipment
      - Computers and gadgetry running Free Software will always be useful.

All contributions are welcome so please feel free to post them to the
list <fsuk-manchester@...>.

Many thanks and best wishes,
The MFS Team.

--
http://www.fsf.org/ Support Freedom!


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Tue, Sep 8, 2009 at 5:28 PM, Leslie I'Anson <leslie.ianson@...> wrote:

> Hello,
>
> As you all know Software Freedom Day 2009 is due to take place on
> Saturday, 19th September at the University of Manchester
> <http://manchester.fsuk.org/blog/2009/09/08/manchester-software-freedom-day-19th-september-2009/>
> and many of you have already expressed a keen interest in attending
> and participating.
>
> Now that we are less then two weeks away, it is time to finalise these
> arrangements and get your name on the SFD team wiki
> <http://softwarefreedomday.org/teams/europe/uk/manchester>.

i'm definitely going to be around this saturday (moving into halls and
preparing for the induction week)

i'm a coder[1] (over towards the OS end of the FOSS spectrum) and an
Apache Member[1] with an interest (if you can call it that) in legal
(and licensing) issues, community building and FOSS organisational
structures.

looks like the stuff you're planning is all aimed at end user
evangelism. which is cool. outside practical crypto, this isn't my
strength. but if it turns out you find yourselves short of someone to
pick up some of the more esoteric technical stuff (coding, legal,
licensing or organisational), then i'd probably be able to do a lot of
that off the cuff. i'll try to drop in early and leave a mobile phone
number.

given the progress made on breaking SHA-1[3], i'm very keen to swap my
new openpgp code signing key with others in the FOSS web of trust. if
there are people interested, i'd be happy to do key signing party (if
there isn't one already) or talk people through how to set up GnuPG[4]
to generate strong keys and strong links in the WOT[4][5].

good luck and have fun :-)

- robert

[1] http://www.apache.org/foundation/members.html
[2] http://www.ohloh.net/accounts/robertburrelldonkin
[3] http://www.jroller.com/robertburrelldonkin/entry/release_distribution_renewing_the_web
[4] http://www.gnupg.org/
[5] http://www.apache.org/dev/key-transition.html
[6] http://www.apache.org/dev/openpgp.html#sha1


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[sward]

On Thu, Sep 17, 2009 at 12:26:37PM +0100, Robert Burrell Donkin wrote:
> given the progress made on breaking SHA-1[3], i'm very keen to swap my
> new openpgp code signing key with others in the FOSS web of trust. if
> there are people interested, i'd be happy to do key signing party (if
> there isn't one already) or talk people through how to set up GnuPG[4]
> to generate strong keys and strong links in the WOT[4][5].

I’m happy to join in and help with this.

Simon
--
A complex system that works is invariably found to have evolved from a
simple system that works.—John Gall


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Leslie I'Anson]

On 17 Sep 2009, at 12:26, Robert Burrell Donkin <robertburrelldonkin@...
 > wrote:

[snip]

>>
>>
>
> i'm definitely going to be around this saturday (moving into halls and
> preparing for the induction week)
>
> i'm a coder[1] (over towards the OS end of the FOSS spectrum) and an
> Apache Member[1] with an interest (if you can call it that) in legal
> (and licensing) issues, community building and FOSS organisational
> structures.
>
> looks like the stuff you're planning is all aimed at end user
> evangelism. which is cool. outside practical crypto, this isn't my
> strength. but if it turns out you find yourselves short of someone to
> pick up some of the more esoteric technical stuff (coding, legal,
> licensing or organisational), then i'd probably be able to do a lot of
> that off the cuff. i'll try to drop in early and leave a mobile phone
> number.
>
> given the progress made on breaking SHA-1[3], i'm very keen to swap my
> new openpgp code signing key with others in the FOSS web of trust. if
> there are people interested, i'd be happy to do key signing party (if
> there isn't one already) or talk people through how to set up GnuPG[4]
> to generate strong keys and strong links in the WOT[4][5].

Excellent, thanks for getting in touch. I know a few people in the  
group with similar interests so you won't feel left out if you do  
decide to attend on Saturday.

Furthermore, we're looking to hold some workshops at the MDDA  
(Portland Street) in coming months, so how would you feel about  
hosting a workshop on GnuPG and key signing?These have been hot topics  
in the group of late.

Best regards,
Leslie


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Thu, Sep 17, 2009 at 2:26 PM, Leslie I'Anson <leslie.ianson@...> wrote:

> On 17 Sep 2009, at 12:26, Robert Burrell Donkin
> <robertburrelldonkin@...> wrote:
>
> [snip]
>
>>>
>>>
>>
>> i'm definitely going to be around this saturday (moving into halls and
>> preparing for the induction week)
>>
>> i'm a coder[1] (over towards the OS end of the FOSS spectrum) and an
>> Apache Member[1] with an interest (if you can call it that) in legal
>> (and licensing) issues, community building and FOSS organisational
>> structures.
>>
>> looks like the stuff you're planning is all aimed at end user
>> evangelism. which is cool. outside practical crypto, this isn't my
>> strength. but if it turns out you find yourselves short of someone to
>> pick up some of the more esoteric technical stuff (coding, legal,
>> licensing or organisational), then i'd probably be able to do a lot of
>> that off the cuff. i'll try to drop in early and leave a mobile phone
>> number.
>>
>> given the progress made on breaking SHA-1[3], i'm very keen to swap my
>> new openpgp code signing key with others in the FOSS web of trust. if
>> there are people interested, i'd be happy to do key signing party (if
>> there isn't one already) or talk people through how to set up GnuPG[4]
>> to generate strong keys and strong links in the WOT[4][5].
>
> Excellent, thanks for getting in touch. I know a few people in the group
> with similar interests so you won't feel left out if you do decide to attend
> on Saturday.

cool

> Furthermore, we're looking to hold some workshops at the MDDA (Portland
> Street) in coming months, so how would you feel about hosting a workshop on
> GnuPG and key signing?These have been hot topics in the group of late.

sounds good

- robert


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Thu, Sep 17, 2009 at 1:52 PM, Simon Ward <simon@...> wrote:
> On Thu, Sep 17, 2009 at 12:26:37PM +0100, Robert Burrell Donkin wrote:
>> given the progress made on breaking SHA-1[3], i'm very keen to swap my
>> new openpgp code signing key with others in the FOSS web of trust. if
>> there are people interested, i'd be happy to do key signing party (if
>> there isn't one already) or talk people through how to set up GnuPG[4]
>> to generate strong keys and strong links in the WOT[4][5].
>
> I’m happy to join in and help with this.

cool :-)

what's be the best way to get organised? are there enough people with
keys to do a formal party? or would something ad hoc be better?

- robert


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Leslie I'Anson]

On 17/09/2009, Robert Burrell Donkin <robertburrelldonkin@...> wrote:

> On Thu, Sep 17, 2009 at 1:52 PM, Simon Ward <simon@...> wrote:
>> On Thu, Sep 17, 2009 at 12:26:37PM +0100, Robert Burrell Donkin wrote:
>>> given the progress made on breaking SHA-1[3], i'm very keen to swap my
>>> new openpgp code signing key with others in the FOSS web of trust. if
>>> there are people interested, i'd be happy to do key signing party (if
>>> there isn't one already) or talk people through how to set up GnuPG[4]
>>> to generate strong keys and strong links in the WOT[4][5].
>>
>> I’m happy to join in and help with this.
>
> cool :-)
>
> what's be the best way to get organised? are there enough people with
> keys to do a formal party? or would something ad hoc be better?
>
> - robert

My advice would be to hold a workshop (or two) first. Then numbers
won't be so much of a problem.

On proposal would be:-

Workshop 1 - Introduction to the technology and tools, etc. (ie. theory + demo)
Workshop 2 - Generating keys, etc. (ie.putting theory into practice)
Reward - Key signing "party" (ie. lots of people we new keys to sign)

Just an idea.

Regards,
Leslie

> _______________________________________________
> Fsuk-manchester mailing list
> Fsuk-manchester@...
> http://lists.nongnu.org/mailman/listinfo/fsuk-manchester
>


--
http://www.fsf.org/ Support The Freedom!


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[sward]

On Thu, Sep 17, 2009 at 06:15:54PM +0100, Leslie I'Anson wrote:
> > what's be the best way to get organised? are there enough people with
> > keys to do a formal party? or would something ad hoc be better?

A formal key-signing party would ideally have prepared lists of
fingerprints sent to the coordinator before the event, and I don’t think
there is enough time before SFD to do this.

Because of the nature of the event we don’t have a fixed list of poeple
going (except maybe a core who have said they’ll be there).

For these reasons I’d go for ad-hoc.

> My advice would be to hold a workshop (or two) first. Then numbers
> won't be so much of a problem.

I think workshops would be useful, but I think the idea of people being
shown how, followed by generating their own keys, and then doing the
verification for signing is iffy.

Ideally, people should create their keys in private, on a system they
trust, and not in a public place connected to public wireless.

Maybe we can do the workshops for SFD and follow up with a key-signing
event another time?

Obviously, for those of us who already have keys, we can still exchange
fingerprints at SFD.

Simon
--
A complex system that works is invariably found to have evolved from a
simple system that works.—John Gall


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Leslie I'Anson]

On 17 Sep 2009, at 18:44, Simon Ward <simon@...> wrote:

> On Thu, Sep 17, 2009 at 06:15:54PM +0100, Leslie I'Anson wrote:
>>> what's be the best way to get organised? are there enough people  
>>> with
>>> keys to do a formal party? or would something ad hoc be better?
>
> A formal key-signing party would ideally have prepared lists of
> fingerprints sent to the coordinator before the event, and I don’t t
> hink
> there is enough time before SFD to do this.
>
> Because of the nature of the event we don’t have a fixed list of poe
> ple
> going (except maybe a core who have said they’ll be there).
>
> For these reasons I’d go for ad-hoc.
>
>> My advice would be to hold a workshop (or two) first. Then numbers
>> won't be so much of a problem.
>
> I think workshops would be useful, but I think the idea of people  
> being
> shown how, followed by generating their own keys, and then doing the
> verification for signing is iffy.

Agreed but the actual keys don't have to be generated at the workshop.

>
> Ideally, people should create their keys in private, on a system they
> trust, and not in a public place connected to public wireless.

Again, 100% agree.

>
> Maybe we can do the workshops for SFD and follow up with a key-signing
> event another time?

I'm not sure about this. A formal workshop at the MDDA is the best  
place for this in my opinion.

>
> Obviously, for those of us who already have keys, we can still  
> exchange
> fingerprints at SFD.

Of course. The workshops will be happening regardless so it's up to you.

>
>
> Simon
> --
> A complex system that works is invariably found to have evolved from a
> simple system that works.—John Gall
> _______________________________________________
> Fsuk-manchester mailing list
> Fsuk-manchester@...
> http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[sward]

On Thu, Sep 17, 2009 at 07:04:39PM +0100, Leslie I'Anson wrote:
> >I think workshops would be useful, but I think the idea of people
> >being
> >shown how, followed by generating their own keys, and then doing the
> >verification for signing is iffy.
>
> Agreed but the actual keys don't have to be generated at the workshop.

If workshop participants are there because they are new to OpenPGP and
would like to learn about it, how many of them do you expect to already
have keys generated in time for SFD?

> >Maybe we can do the workshops for SFD and follow up with a key-signing
> >event another time?
>
> I'm not sure about this. A formal workshop at the MDDA is the best
> place for this in my opinion.

Let’s forget about the MDDA for a minute, it doesn’t matter too much
where we hold events.

I think I’m getting confused, because I thought you suggested doing
workshops at SFD in this thread, so I’m now wondering why you think they
should be elsewhere.

My suggestion was:

 1. Introductory workshop at SFD
 2. Hands-on workshop at SFD

Then:

 3. Key signing event some other time, _after_ SFD

This could be at a Manchester Free Software event, or organised with
someone else, it doesn’t really matter.

> >Obviously, for those of us who already have keys, we can still
> >exchange fingerprints at SFD.
>
> Of course. The workshops will be happening regardless so it's up to you.

Again, I’m confused.  I wasn’t suggesting a formal SFD event, just that
because people would be meeting it is good for key-signing.

There are, potentially, at least four people I know of who will be at
SFD and already have OpenPGP keys.  We can easily mingle in some sort of
informal and ad-hoc manner and do the necessaries. :)

Simon
--
A complex system that works is invariably found to have evolved from a
simple system that works.—John Gall


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Thu, Sep 17, 2009 at 6:15 PM, Leslie I'Anson <leslie.ianson@...> wrote:

> On 17/09/2009, Robert Burrell Donkin <robertburrelldonkin@...> wrote:
>> On Thu, Sep 17, 2009 at 1:52 PM, Simon Ward <simon@...> wrote:
>>> On Thu, Sep 17, 2009 at 12:26:37PM +0100, Robert Burrell Donkin wrote:
>>>> given the progress made on breaking SHA-1[3], i'm very keen to swap my
>>>> new openpgp code signing key with others in the FOSS web of trust. if
>>>> there are people interested, i'd be happy to do key signing party (if
>>>> there isn't one already) or talk people through how to set up GnuPG[4]
>>>> to generate strong keys and strong links in the WOT[4][5].
>>>
>>> I’m happy to join in and help with this.
>>
>> cool :-)
>>
>> what's be the best way to get organised? are there enough people with
>> keys to do a formal party? or would something ad hoc be better?
>>
>> - robert
>
> My advice would be to hold a workshop (or two) first. Then numbers
> won't be so much of a problem.
>
> On proposal would be:-
>
> Workshop 1 - Introduction to the technology and tools, etc. (ie. theory + demo)
> Workshop 2 - Generating keys, etc. (ie.putting theory into practice)

the theory's a bit dull and requires a lot of technical terms to be done right

i think that a single hands-on workshop would probably work better. if
enough people bring along laptops then we can break into small groups
clustered around those laptops and play around with demo keys based
around some practical problems.

it'd probably be more fun than listening to myself lecture on prime
number theory for a couple of hours ;-)

> Reward - Key signing "party" (ie. lots of people we new keys to sign)

any key signing party needs to be a separate event (for security
reasons). the only demo keys not intended for distribution should be
used at a workshop. but yes, i can organise a formal key signing party
after the workshop.


i would like to try to meetup with anyone who already uses OpenPGP
since the benefits of signing a key depend on how connected that key
is

suppose Alice is well connected to the Apache WOT. then most Apache
release managers will be linked within the three steps that a typical
trust model uses. Suppose Bob is not well connected. if Bob can verify
Alice's identity and key fingerprints in person then Bob can verify
the vast majority of Apache releases.  Alice gains only the ability to
verify signatures from Bob in return. Bob gains a lot from this
exchange and Alice very little.

suppose now that Dawn is a well connected Debian maintainer. when
Alice and Dawn meet personally and verify each other keys the gain is
high. everyone within two hops of Alice is now connected to everyone
within one hops of Dawn and vice versa. this is a big gain for the
FOSS WOT.

my new key is well connected to the Apache WOT through the old key
one. i'll have my passport and cards with my key fingerprint on.
anyone how wants to be able to sign my key so they can verify Apache
releases (and many other FOSS signatures too) is more than welcome to
take a look and a card. they don't even need to have a key now: if
they keep the card safe then they can safely sign at any time in the
future.

if there are going to be people with existing keys there, maybe we can
pick a time to meetup...

- robert


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Dave Page-5]

On Friday 18 September 2009 13:19:42 Robert Burrell Donkin wrote:

> my new key is well connected to the Apache WOT through the old key
> one. i'll have my passport and cards with my key fingerprint on.

See, signing keys using passports is IMHO a bad idea, which is why it's worth
having a discussion about keysigning, what it involves and what you're trying
to achieve with it. I won't (indeed, can't) take part in a keysigning that
requires passports.

Dave
--
Dave Page <grimoire@...>
Jabber: grimoire@...


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Fri, Sep 18, 2009 at 2:44 PM, Dave Page <grimoire@...> wrote:
> On Friday 18 September 2009 13:19:42 Robert Burrell Donkin wrote:
>
>> my new key is well connected to the Apache WOT through the old key
>> one. i'll have my passport and cards with my key fingerprint on.
>
> See, signing keys using passports is IMHO a bad idea, which is why it's worth
> having a discussion about keysigning, what it involves and what you're trying
> to achieve with it.

my primary use case is release security but public key cryptography is
flexible and can be used for lots of different stuff

please feel free to kick off the discussion :-)

> I won't (indeed, can't) take part in a keysigning that
> requires passports.

i will have my passport and my fingerprint. if you don't want to see
my passport, that's cool with me.

the great thing about OpenPGP is that it's design allows hetrogeneous
trust choices and multiple trust model

my policy is that i don't create public signatures with my code
signing key unless i have been able to confidently verify identity.
this is not unusual for keys used to secure release infrastructure.

other people have different policies. some people have different
policies for different keys. that's all cool by me.

the only downside of not bringing photo id to a keysigning is that
some people may elect not to sign your key (or not to publish the
signature)

- robert


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Leslie I'Anson]

Personally, I agree with Robert here, SFD is not the place to hold
workshops but signing keys is up to you. I think where Simon got
confused is with regards to the subject line of these emails, which
came about because Robert initially contacted me by replying to the
call for volunteers.

Anyway, I don't want to forgot about the MDDA because Micheal and I
are planning to hold workshops there in the future, which is why I was
suggesting it to Robert. Btw, I for one am really keen on
understanding some more of the theory behind key generation, signing
and the web of trust and I'm sure others are too.

Thank you both for you input. We'll talk more about this after or at SFD.

Bye for now,
Leslie

On 18/09/2009, Robert Burrell Donkin <robertburrelldonkin@...> wrote:

> On Thu, Sep 17, 2009 at 6:15 PM, Leslie I'Anson <leslie.ianson@...>
> wrote:
>> On 17/09/2009, Robert Burrell Donkin <robertburrelldonkin@...>
>> wrote:
>>> On Thu, Sep 17, 2009 at 1:52 PM, Simon Ward <simon@...> wrote:
>>>> On Thu, Sep 17, 2009 at 12:26:37PM +0100, Robert Burrell Donkin wrote:
>>>>> given the progress made on breaking SHA-1[3], i'm very keen to swap my
>>>>> new openpgp code signing key with others in the FOSS web of trust. if
>>>>> there are people interested, i'd be happy to do key signing party (if
>>>>> there isn't one already) or talk people through how to set up GnuPG[4]
>>>>> to generate strong keys and strong links in the WOT[4][5].
>>>>
>>>> I’m happy to join in and help with this.
>>>
>>> cool :-)
>>>
>>> what's be the best way to get organised? are there enough people with
>>> keys to do a formal party? or would something ad hoc be better?
>>>
>>> - robert
>>
>> My advice would be to hold a workshop (or two) first. Then numbers
>> won't be so much of a problem.
>>
>> On proposal would be:-
>>
>> Workshop 1 - Introduction to the technology and tools, etc. (ie. theory +
>> demo)
>> Workshop 2 - Generating keys, etc. (ie.putting theory into practice)
>
> the theory's a bit dull and requires a lot of technical terms to be done
> right
>
> i think that a single hands-on workshop would probably work better. if
> enough people bring along laptops then we can break into small groups
> clustered around those laptops and play around with demo keys based
> around some practical problems.
>
> it'd probably be more fun than listening to myself lecture on prime
> number theory for a couple of hours ;-)
>
>> Reward - Key signing "party" (ie. lots of people we new keys to sign)
>
> any key signing party needs to be a separate event (for security
> reasons). the only demo keys not intended for distribution should be
> used at a workshop. but yes, i can organise a formal key signing party
> after the workshop.
>
>
> i would like to try to meetup with anyone who already uses OpenPGP
> since the benefits of signing a key depend on how connected that key
> is
>
> suppose Alice is well connected to the Apache WOT. then most Apache
> release managers will be linked within the three steps that a typical
> trust model uses. Suppose Bob is not well connected. if Bob can verify
> Alice's identity and key fingerprints in person then Bob can verify
> the vast majority of Apache releases.  Alice gains only the ability to
> verify signatures from Bob in return. Bob gains a lot from this
> exchange and Alice very little.
>
> suppose now that Dawn is a well connected Debian maintainer. when
> Alice and Dawn meet personally and verify each other keys the gain is
> high. everyone within two hops of Alice is now connected to everyone
> within one hops of Dawn and vice versa. this is a big gain for the
> FOSS WOT.
>
> my new key is well connected to the Apache WOT through the old key
> one. i'll have my passport and cards with my key fingerprint on.
> anyone how wants to be able to sign my key so they can verify Apache
> releases (and many other FOSS signatures too) is more than welcome to
> take a look and a card. they don't even need to have a key now: if
> they keep the card safe then they can safely sign at any time in the
> future.
>
> if there are going to be people with existing keys there, maybe we can
> pick a time to meetup...
>
> - robert
>

--
http://www.fsf.org/ Support The Freedom!


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[Leslie I'Anson]

Despite the risk of some people finding this topic a little dry, I
strongly believe that a well organised workshop, or series of
workshops, where discussions like this can take place and people can
learn from those more experienced is a good idea.

I hope you all agree and will support such an event.

Thanks again,
Leslie

On 18/09/2009, Robert Burrell Donkin <robertburrelldonkin@...> wrote:

> On Fri, Sep 18, 2009 at 2:44 PM, Dave Page <grimoire@...>
> wrote:
>> On Friday 18 September 2009 13:19:42 Robert Burrell Donkin wrote:
>>
>>> my new key is well connected to the Apache WOT through the old key
>>> one. i'll have my passport and cards with my key fingerprint on.
>>
>> See, signing keys using passports is IMHO a bad idea, which is why it's
>> worth
>> having a discussion about keysigning, what it involves and what you're
>> trying
>> to achieve with it.
>
> my primary use case is release security but public key cryptography is
> flexible and can be used for lots of different stuff
>
> please feel free to kick off the discussion :-)
>
>> I won't (indeed, can't) take part in a keysigning that
>> requires passports.
>
> i will have my passport and my fingerprint. if you don't want to see
> my passport, that's cool with me.
>
> the great thing about OpenPGP is that it's design allows hetrogeneous
> trust choices and multiple trust model
>
> my policy is that i don't create public signatures with my code
> signing key unless i have been able to confidently verify identity.
> this is not unusual for keys used to secure release infrastructure.
>
> other people have different policies. some people have different
> policies for different keys. that's all cool by me.
>
> the only downside of not bringing photo id to a keysigning is that
> some people may elect not to sign your key (or not to publish the
> signature)
>
> - robert
>
>
> _______________________________________________
> Fsuk-manchester mailing list
> Fsuk-manchester@...
> http://lists.nongnu.org/mailman/listinfo/fsuk-manchester
>

--
http://www.fsf.org/ Support The Freedom!


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[sward]

On Fri, Sep 18, 2009 at 02:44:02PM +0100, Dave Page wrote:
> See, signing keys using passports is IMHO a bad idea, which is why it's worth
> having a discussion about keysigning, what it involves and what you're trying
> to achieve with it. I won't (indeed, can't) take part in a keysigning that
> requires passports.

Verifying identity using *only* passports is probably a bad idea, but
it’s not black and white.  With the passport, you essentially have a
third party that you presume (or not) has done some verification that
you may or may not trust to some extent.  It’s up to you to make that
decision.

It would be convenient if everybody had the same standards as you for
verifying identity, but they don’t, and that’s part of the beauty of
the OpenPGP web of trust.  You can decide how much you trust someone
to correctly verify identity and sign keys.  Again, it’s up to you to
make that decision.

Simon
--
A complex system that works is invariably found to have evolved from a
simple system that works.—John Gall


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester

[robert burrell donkin-2]

On Sun, Sep 20, 2009 at 1:26 PM, Simon Ward <simon@...> wrote:

> On Fri, Sep 18, 2009 at 02:44:02PM +0100, Dave Page wrote:
>> See, signing keys using passports is IMHO a bad idea, which is why it's worth
>> having a discussion about keysigning, what it involves and what you're trying
>> to achieve with it. I won't (indeed, can't) take part in a keysigning that
>> requires passports.
>
> Verifying identity using *only* passports is probably a bad idea, but
> it’s not black and white.  With the passport, you essentially have a
> third party that you presume (or not) has done some verification that
> you may or may not trust to some extent.  It’s up o you to make that
> decision.

identity is a deep problem

possession of state issued photo ID is at least a clear test. yes,
passports can be forged or issued in error but it's relatively hard
(at least in the UK these days) to find independent channels. british
photo ID opens up employment, bank accounts, the NHS and so on. it is
now a single point of failure.

a passport is relatively hard to forge but once it has been, it is
hard to think of independent channels that cannot be easily forged
once in possession of that document.

> It would be convenient if everybody had the same standards as you for
> verifying identity, but they don’t, and that’s part of the beauty of
> the OpenPGP web of trust.  You can decide how much you trust someone
> to correctly verify identity and sign keys.  Again, it’s up to you to
> make that decision.

one of the problems with modelling trust is that meta-judgements are
just too hard to make so this only really works for one hop

- robert


_______________________________________________
Fsuk-manchester mailing list
Fsuk-manchester@...
http://lists.nongnu.org/mailman/listinfo/fsuk-manchester