As a visitor here at rgb2r is now moving to another planet a far-away country, the discussion came up again how to do PGP key signing properly. Originally, the requestor asked for passport based signing as done on most of the so-called PGP key signing parties. However, for the following reasons I will not sign passports and don't want passport based signatures.

Party signing

In the normal PGP key signing party based approach, all that is required to obtain a signature is a passport or identity card. The signer verifies that the signee looks like the person on the picture and then signs the key. For this, the signer does not have to know or trust the signee. The signer then submits the key to a key server and the signee can download it from there.

This method allows one to accumulate a lot of signatures over a short time, and to extend the network of signatures very quickly. However, it contains various flaws:

• There is no trust relation between the signer and the signee, so the only thing that is attested by the signature is, that the signee has certain similarities with the documents he/she presented.
• However, especially in multinational keysigning parties, these documents can rather easily be forged so that an untrained eye cannot detect the forgery.
• There may be valid reasons not to want to show one's ID. For example if one's in possession of a diplomatic passport, one might not want to show it to everybody because it might be met with suspicion, or it might compromise the position of the owner of the passport to have everyone be aware of the status.
• In some cases, people may have valid reasons not to disclose their real names, especially if they're working in IT security, if they are political activists or live in a totalitarian regime. But even under normal circumstances, it should be accepted if a person does not want to disclose his/her real name.
  Some people are not even known under their real name at all, and thus a signature on their real name would be rather pointless.
• The associated addresses need not automatically belong to the signee.

There are probably many more problems this model is arising by its lack of trust dependencies or its focus on the passport as the sole base of trust, but these are the most apparent which came to mind.

Trust signatures

The so-called trust signature scheme follows an entirely different dogma. In this scheme, people knowing each other know enough will sign each other's key in order to testify that they are willing to testify that the signee is known as the person he/she claims to be. This of course implies a much greater level of familiarity between the signer and the signee.

Note that in this scheme, it is perfectly valid for the signer to sign a key belonging to a pseudonym — if that's what the signee is known as. That may sound suspicious to a person who's used to attesting passports, but in the end it is much more logical because in the end, the signer attests only what he knows about the other person, without relying on a paper he cannot verify.

Also, some more unrelated improvements come to play. In order to verify UIDs, the signer creates signatures for each individual UID and sends these individually to the mail address in the UID, in an encrypted mail. Then, the signer deletes the signature from the local keychain again. This sounds tedious, but there are good scripts to take care of that, such as, for example, caff from the pgp-tools package.

In this scheme, it is assured that the owner of the UIDs is at least aware of the signature that took place, and can decide whether or not to upload the signatures. On the other hand, a pseudonymous signer can participate without any loss of the trust relationship.

Just for fun, I recently participated in some personality evaluation test. And as expected, the most remarkable thing the tool constanted was pessimism. Since Thomas ”maximus“ Deutsch recently wrote about his opinion on his attitude, which also included pessimism, I got the idea that there is actually a difference between pessimism and pessimism.

Destructive Pessimism

Most people know the destructive pessimism very well. Even the most cheerful people usually had a phase of depression at least during their puberty. In destructive pessimism, people stop believing in the sense of their life, their actions and everything surrounding them. As a consequence, these people find it useless to act at all.

The cognitive aspect is also very discouraging. Destructive pessimists don't perceive positive developments and events at all. Maybe they became too ordinary to be perceived, but in any case these people act like they never happened. Bad events however are perceived as an affirmation and frustration.

Constructive Pessimism

Constructive pessimism however, the type of pessimism I tend to adhere to, does not have the expectation of everything to fail. The pessimistic assumptions in constructive pessimism are way more moderate:

• You cannot expect other people to do work. They most likely won't. They will overestimate their capacity and capability or never get to the job in the first place.
• If something can fail, it will. This is basically a moderate version of murphyism. However, this principle leads to concepts like redundancy, thus it is an important part of the philosophy of engineers.
• Too few people make bad decisions. Individuals tend to oversee aspects, so consulting an adequate number of people is always a nice idea. Too many people however tend to have problems comunicating.

… and many more, but you get the idea. So the general rule is to have low expectations, as opposed to expecting failure.

Other than the destructive pessimist who drowns in lethargy, constructive pessimsts draw their energy from their pessimism. The conclusion from the above assumptions is that it is best to do the job on one's own, and that one should verify every single component for proper operation. This principle is reflected for example in the rules of Extreme Programming.

The differences are also very serious in the cognitive dimension. If a constructive pessimist perceives failure, it was what he expected, so it does not come as a deception. He prepared for the failure, in fact. If, however, he succeeds, then he is very positively surprised and perceives the success as such. Thus, disappointing a constructive pessimist is close to impossible, while the world is indeed full of positive surprises for them.

As a conclusion it may be repeated that there are indeed different types of pessimism, and that not all of them necessarily lead to apathy. Indeed, pessimism can be quite inspiring.

I would like to invite all people who have an interest in political activism for the benefits of Open Source and Free Software as well as aiming at a free and open information infrastructure (open standards, etc.) to the second Swiss FOSS compatible lobbyist meeting in Berne, in the conference room in the railway station. The meeting will take place on

Monday, November 5th, 2007 18:00 (that is 6pm)

in the conference rooms inside the railway station of Bern, Switzerland.

The place is easily reached by taking the train to Berne and leaving at the central station. If you are planning to go there by car, there is a parking lot (surveilled) right above the railway station (Universität Langgasse).

If you have comments or don't know how to find this place, call me under TL1733-RIPE or +41.793790549.

Agenda

1. Salutation
2. Review of the situation since the first meeting
3. Analysis of failed projects
4. Introduction of working groups and creating member lists (see next headline)
5. Working group agenda discussion
6. Outlook on likely items for the year 2008
7. Maybe drop by at the Altes Tramdepot or something similar to have a drink

Proposed woking groups

The following is a list of working groups which are deemed helpful for the organization of the upcoming campaigns:

Currently debated items

• Office OpenXML standardization
• Copyright Revision (cleanup work)
• Federal Surveillance (trojan etc.)

Generic Working Groups

• Open Standards
• Amendments
• Lobbying
• Intelligence
• Press
• IT (Yes, there are lots of things to do in this area too)

This is an interesting collection of documents from the Antitrust case against Microsoft:

• Bill Gates stating how MS Office should depend on proprietary Internet Explorer features
• Bill Gates: «Why would the Office group be giving out the Office 2000 formats to competitors? To me this seems crazy.»
• Office 97 includes an unique user identifier, patch provided for customers asking for it explicitly
• Evangelism as a war plan
• Apple took the WinFS promises and made them real before we did
• Outlook for 2005
• Allchin: I would buy a Mac today
• Linux 2003 Heat Map
• Linux OEM Threat Sensor 2002, also assessing StarOffice
• Attempt to unite with Intel against IBM + Linux
• Getting cheap Microsoft products out to Malaysia in order to prevent them from switching to Linux
• Why Microsoft Apples are better than Linux Oranges
• WalMart Lindows eradication taskforce
• IDC white paper sponsored by Microsoft: Windows 2000 vs. Linux
• Strategy presentation for 2001
• Internal Office rant following RedHerring article: Is Microsoft losing its grip?
• Comparison between Office XP and StarOffice 5.2
• Comparison between Office 2000 and StarOffice 5.2 – StarOffice as OEM product must be prevented
• New policy regarding Office 2000 file formats forbids to build converters, develop competitive products, etc.
• Prediction of StarOffice 5.2 spread
• Not building Word 11: the feature war is over
• Bill Gates: ACPI should be a Windows specific standard
• Making fun of German customers: Corel sells as much as home productivity
• Anti-Java strategy 1995
• Stevenson: Why we must not support Java
• Office 95 channel push called «Operation Napalm»
• Plamodon: ISVs are pawns in the struggle between platform vendors
• Making Windows 3.x incompatible with DR-DOS
• Source code to the «Alien DOS warning message»
• Spreading FUD about DR-DOS incompatibilities

Please note that all of these are Microsoft internal documents and not an invention of some conspiracy theorist.

As their latest change in policy, the music industry now only offers low quality audio streams instead of music CDs to critics of the print and movie media corporations.

For quite a while now, the music industry has been accusing the critics of passing on the CDs they have been given. Up to this point, they have not been able to substantiate this claim. Just like with all the other accusations made so far, however, the music industry jumped to conclusions and decided to only pass low quality (32 kbps) audio streams to the media in the future.

However, as the swiss german news paper Der Bund complains, 32kbps are such a horribly bad quality that it doesn't allow the critic to decide if the music is worth listening or not. Thus, Der Bund sees this as another step of the music industry on the road to insignificance.

Dell, who recently decided to offer laptops with Linux preinstalled as well, decided now to join the Microsoft agreement, just like Novell et cetera did before.

The named main goal of the agreement is to promote interoperability between the different Linux flavors and Windows. Critics say however that the agreement might be a lawsuit protection against Microsoft in their coming IP violation campaign against the Open Source movement.