Comment Comment by rsc Open source fundamentally does not work that way. There are many important open source contributors who work pseudonymously.Google's Know, Prevent, Fix blog post floated the idea of stronger identity for open source in https://security.googleblog.com/2021/02/know-prevent-fix-fra... and there was very significant pushback. We learned a lot from that.The fundamental problem with stronger identity is that spy agencies can create very convincing ones. How are distros going to detect those? parent rsc 2 years ago
Google's Know, Prevent, Fix blog post floated the idea of stronger identity for open source in https://security.googleblog.com/2021/02/know-prevent-fix-fra... and there was very significant pushback. We learned a lot from that.
The fundamental problem with stronger identity is that spy agencies can create very convincing ones. How are distros going to detect those?