Re: leaking_addresses script..

[Linus Torvalds]

On Wed, Nov 15, 2017 at 1:11 PM, Tobin C. Harding <me@xxxxxxxx> wrote:
>
> Linus I'm not in the web of trust, pulling a tag signed by an _unknown_
> key is not secure is it? Would it not be better to get into the web of
> trust first before requesting you pull any code from me.

Oh, I absolutely take signed pulls from new people who haven't gotten
their keys with a full chain of trust to me..

I do it for a few different reasons:

 - the real trust is *never* in the key. People who trust
technological measures are morons. You trust *people*, not keys. The
technical measures are a shorthand and a help, not the basis.

 - I can just check the code

 - even if you never get your key signed by anybody else, it's still a
sort of "identity" in the sense of me getting the pull requests from
the same person (or key controlling group)

 - you probably *will* get your key signed by somebody else later, and
it's all good, and that will show even in the commits before you got
the signing done.

It's not like we require that people send emailed patches with pgp
signing either.

So I require keys for pull requests even if I can't see the full chain
of trust simply because of those two last issues: it's still an
identity, and one that I expect will eventually be signed.

             Linus