I think a known pseudonymous identity is better than an unknown fake identity. Real names lower guard but most have no way to actually verify.
Re:Open Source Security Foundation
by jacques_chester on Saturday March 27, 2021 @10:47PM
(#26607513)
Whether or not there is an impenetrable fake identity is a different question from "now that identity Foo is untrustworthy, what other things do I need to inspect?"
Re:Open Source Security Foundation
by RcouF1uZ4gsC on Sunday March 28, 2021 @01:20AM
(#26608182)
For that, you don’t need any type of real world identity. If you require that people sign their commits/reviews with a PGP key and base their reputation on that, that still gives you much the same benefit, while at the same time allowing people to be anonymous.
Re:Open Source Security Foundation
by jacques_chester on Sunday March 28, 2021 @01:15PM
(#26612114)
To be clear, I agree.
The point I was trying to make was that stable identity, whether real or pseudonymous, has value in a security context.
I think that will do more harm than good. First of all a lot of critical software is security related and encryption related and I would guess a higher proportion of contributors in that area are more sensitive to protecting their identity than the general developer population. So you would lose out on some contributions that you would otherwise have gotten.
Second, a major threat in this area arises from nation states. However, due to experience with physical espionage, nation states are already pretty good at establishing fake identities for people (for example it would be no problem for them to supply a fake (or even real) passport/ birth certificate/etc or turning people who are already working in critical areas. Thus getting rid of anonymity would not even be a speed bump for Five Eyes, Russia, China, North Korea, etc.
So I don’t thing there would be much benefit, but there would be a lot of cost.