Tip: use the patch format feature of GitHub to view people's e-mail addresses.

Looking at the commit log, the initial commit caught my attention. The author of the initial commit does not link to any particular account on GitHub. See https://github.com/gliimly/gliimly/commit/23e44479d675d3124e...

From here, we can see some identity.

  From: gliimly <[email protected]>

Pasting the e-mail address into a search engine reveals another work by the same person. In particular, https://vixra.org/pdf/1208.0044v2.pdf . The fact the person publishes under Vixra likely means they are not someone malicious, just what some in the mathematics community call a "crank".

Thanks for the sleuthing work.

And by “crank” do you mean a recluse? Or someone off of the grid?

The first definition in [0], that is:

  a person who has strange or unusual ideas and beliefs

[0] https://dictionary.cambridge.org/dictionary/english/crank

Another term for it would be "fringe science". The paper is an amusing thought experiment based on some baseless assumptions; it would be foolish to assume that it describes any kind of physical reality.

I kinda read this paper, and holy crap, it's what we used to call in college "one of those guys", during the early 2000's.

A computer scientist or engineer who is reasonably competent in his area, but that for some reason decided that he is the one who is going to unify all of physics with his pet theory based on a superficial understanding quantum theory and relativity (always special relativity, never general relativity).

Does personal identification make someone more trustworthy? IMO trust comes from history. I.e. maintaining a project for a long time, working on multiple projects, various contributions, then external factors like community, committers + number of eyes on the code.

This was true for a long time, but now that we have state actors with the capability and willingness to engage in long-term attacks (see: Jia Tan), the way we assess these threats probably have to change.

How does this change with identities? What stops a state actor of investing in a years old persona that builds trust to be used in an attack?

For an entity like North Korea, it's relatively easy to create a bunch of online personas and invest into their long-term online presence by (for example) contributing to multiple different projects. Once a person has to be personally identified, though, the effort and difficulty goes up drastically.

It can be a good first order approximation if you don't wanna take the time to examine the code like by line looking for SQL injection opportunities or whatever