Re: kernel.org status: establishing a PGP web of trust

[Valdis . Kletnieks]

On Thu, 06 Oct 2011 09:30:47 +0200, Thomas Gleixner said:

> If Linus signs his key, then all it means is that I can be sure to a
> certain degree that the person who is using the key is Adrian. But
> it's neither a free ticket for a k.org account nor does it have any
> other meaning.

Exactly.  It proves it's Adrian. What you *do* with that information is
an entirely different question.

Many people manage to conflate "authentication" and "authorization",
which are two entirely different things in the security world.  My favorite
example demonstrating the difference:

Authentication: "Yes, your driver's license does say you're Jeffrey Dahmer".
Authorization: "Would you like to borrow a steak knife, Jeffrey?"

(For the non-US people - Dahmer was a notorious serial killer and cannibal:
https://secure.wikimedia.org/wikipedia/en/wiki/Jeffrey_Dahmer

Attachment: pgp00000.pgp
Description: PGP signature