11:37 a.m.
There are a few things I think we ought to change in the format of the
card produced by fedora-business-cards. They're presented here:
https://fedoraproject.org/wiki/User:Ianweller/Proposed_business_card_form...
I've set up wikivoting -- please let me know what changes you are for
and against, and why. The votes aren't really binding, they're to give
me a general idea of if we have consensus on it or not.
--
Ian Weller <ian(a)ianweller.org>
GnuPG fingerprint: E51E 0517 7A92 70A2 4226 B050 87ED 7C97 EFA8 4A36
11:54 a.m.
Dear all:
Please mention an official address except saying only the web site. Some
people asking the question and its hard to ans. If possible mention mention
it on the business card.
International phone no is changeable, so use some official phone no with the
extension no. We should think about it for intra connection among the
ambassadors.
Finger print and GPG key is an attractive point for the businesscard.
More than, all the business template should be only bring to one template to
ignore the complexity of choosing. and it should not be set random to use
though there are rules.
Last but least, business card is an inspiration to do our job as smooth as
possible wherever we visit and go. We should concern about it as a marketing
team.
Regards,
Rashadul Islam
-----------------------------------------
Email: irashadul(a)gmail.com
Web: http://fedoraproject.org/wiki/RashadulIslam
On Wed, Jul 1, 2009 at 12:37 PM, Ian Weller <ian(a)ianweller.org> wrote:
There are a few things I think we ought to change in the format of
the
card produced by fedora-business-cards. They're presented here:
https://fedoraproject.org/wiki/User:Ianweller/Proposed_business_card_form...
I've set up wikivoting -- please let me know what changes you are for
and against, and why. The votes aren't really binding, they're to give
me a general idea of if we have consensus on it or not.
--
Ian Weller <ian(a)ianweller.org>
GnuPG fingerprint: E51E 0517 7A92 70A2 4226 B050 87ED 7C97 EFA8 4A36
--
Fedora-marketing-list mailing list
Fedora-marketing-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-marketing-list
12:16 p.m.
On Wed, Jul 1, 2009 at 9:54 AM, Rashadul Islam <irashadul(a)gmail.com> wrote:
Finger print and GPG key is an attractive point for the businesscard.
I'm wondering about this aspect of the business card, as there's a question
about making the full fingerprint an option.
I can understand having the GPG key on a card, but the purpose of having
something the length of a full fingerprint on a business card escapes me.
Would there be a good reason for to have a full fingerprint?
The reason I ask is that we come across this kind of thing in newspaper
work: A reporter would include in his/her article the entire URL of a Web
site, for example (and the following is fake),
http://fedoreproject.org/wiki/wombat/missive/g4itgzb/extreme_lunacy/way_t...,
and the argument made by some editors (i.e., me) is that it's too long to
publish in a newspaper article because no one in their right mind would take
the time to type in that address.
Would the same reasoning apply to having a full fingerprint on a business
card, or is there a reason for doing so that I've never encountered (and
that's entirely possible, I'll be the first to admit, and I'd welcome the
opportunity to be enlightened)?
I'm just making an observation here, and not advocating either way (but my
cards won't have a full fingerprint, to be sure).
Larry Cafiero
12:43 p.m.
On Wed, Jul 1, 2009 at 12:16 PM, Larry Cafiero<larry.cafiero(a)gmail.com> wrote:
On Wed, Jul 1, 2009 at 9:54 AM, Rashadul Islam
<irashadul(a)gmail.com> wrote:
>
> Finger print and GPG key is an attractive point for the businesscard.
I'm wondering about this aspect of the business card, as there's a question
about making the full fingerprint an option.
I can understand having the GPG key on a card, but the purpose of having
something the length of a full fingerprint on a business card escapes me.
Would there be a good reason for to have a full fingerprint?
You cannot validate an imported key without having access to the full
fingerprint. You should always validate the key's fingerprint with the
key's owner before signing it. You can call the person or use some
other means, it is convenient for people if it is just on the card.
John
1:03 p.m.
On Wed, Jul 1, 2009 at 10:43 AM, inode0 <inode0(a)gmail.com> wrote:
You cannot validate an imported key without having access to the full
fingerprint. You should always validate the key's fingerprint with the
key's owner before signing it. You can call the person or use some
other means, it is convenient for people if it is just on the card.
So let me make sure I'm following this (while exposing what a noob I am in
this regard): I would validate an imported key from you by checking what's
on my screen against the full fingerprint on your business card. Is that the
rationale and benefit of having the full fingerprint on the card?
[I can't imagine calling you up and reading off your full fingerprint to you
and expect you to stay awake until I finish . . . :-) ]
Larry
1:07 p.m.
On 01/07/09 19:03, Larry Cafiero wrote:
On Wed, Jul 1, 2009 at 10:43 AM, inode0 <inode0(a)gmail.com
<mailto:inode0@gmail.com>> wrote:
You cannot validate an imported key without having access to the full
fingerprint. You should always validate the key's fingerprint with the
key's owner before signing it. You can call the person or use some
other means, it is convenient for people if it is just on the card.
So let me make sure I'm following this (while exposing what a noob I am
in this regard): I would validate an imported key from you by checking
what's on my screen against the full fingerprint on your business card.
Is that the rationale and benefit of having the full fingerprint on the
card?
You should only validate, if also you have seen picture ID.
Frank
1:14 p.m.
On Wed, Jul 1, 2009 at 1:07 PM, Frank Murphy<frankly3d(a)gmail.com> wrote:
On 01/07/09 19:03, Larry Cafiero wrote:
>
> On Wed, Jul 1, 2009 at 10:43 AM, inode0 <inode0(a)gmail.com
> <mailto:inode0@gmail.com>> wrote:
>
>
> You cannot validate an imported key without having access to the full
> fingerprint. You should always validate the key's fingerprint with the
> key's owner before signing it. You can call the person or use some
> other means, it is convenient for people if it is just on the card.
>
>
> So let me make sure I'm following this (while exposing what a noob I am
> in this regard): I would validate an imported key from you by checking
> what's on my screen against the full fingerprint on your business card.
> Is that the rationale and benefit of having the full fingerprint on the
> card?
>
You should only validate, if also you have seen picture ID.
Well, if you don't believe in the web of trust. :)
John
1:29 p.m.
On Wed, Jul 1, 2009 at 1:18 PM, Frank Murphy<frankly3d(a)gmail.com> wrote:
On 01/07/09 19:14, inode0 wrote:
>
>
> Well, if you don't believe in the web of trust. :)
>
> John
The web of trust requires picture ID.
Beacause you can prove, you met Mr X,
and seen proof he is who he states
Fingerprint on it's own doesn't do that.
The web of trust is worthless if *I* have to see everyone's picture
ID. The whole point of the web of trust is to extend validation beyond
the people I know.
I think you are thinking about what is needed to conscientiously sign
someone else's key publicly. That act has additional requirements in
order to not break the web of trust too.
John
1:34 p.m.
On 01/07/09 19:29, inode0 wrote:
On Wed, Jul 1, 2009 at 1:18 PM, Frank
Murphy<frankly3d(a)gmail.com> wrote:
> On 01/07/09 19:14, inode0 wrote:
<snip>
The web of trust is worthless if *I* have to see everyone's picture
ID. The whole point of the web of trust is to extend validation beyond
the people I know.
The idae is correct but:
you don't need to meet everyone.
How it works properly is:
Eg. I meet you,
we exchange fingerprints, and see photo id.
We trust trust other.
The someone who you know, has never met me,
I can be vouched for by you.
Because you have matched my id to my key.
That is the trust.
You have to verify the human, and so on to 5 levels.
http://www.gnupg.org/gph/en/manual/x334.html
"
GnuPG overloads the word ``trust'' by using it to mean trust in an owner
and trust in a key. This can be confusing. Sometimes trust in an owner
is referred to as owner-trust to distinguish it from trust in a key.
Throughout this manual, however, ``trust'' is used to mean trust in a
key's owner, and ``validity'' is used to mean trust that a key belongs
to the human associated with the key ID."
1:45 p.m.
On Wed, Jul 1, 2009 at 1:34 PM, Frank Murphy<frankly3d(a)gmail.com> wrote:
On 01/07/09 19:29, inode0 wrote:
>
> On Wed, Jul 1, 2009 at 1:18 PM, Frank Murphy<frankly3d(a)gmail.com> wrote:
>>
>> On 01/07/09 19:14, inode0 wrote:
<snip>
>
> The web of trust is worthless if *I* have to see everyone's picture
> ID. The whole point of the web of trust is to extend validation beyond
> the people I know.
>
The idae is correct but:
you don't need to meet everyone.
How it works properly is:
Eg. I meet you,
we exchange fingerprints, and see photo id.
Returning to Larry's question this is the point where I want my
fingerprint on my Fedora business card ... to make this exchange not
require me writing it down or printing it out or anything else. We
meet, we confirm identities using birth certificates and 15 forms of
other identification including 6 with pictures (or whatever *you* feel
is necessary beyond the stated expectation as described here and
elsewhere), and you take my business card. It makes my life at a
keysigning party that much easier and it makes the signer's life
easier later when signing the keys too.
John
1:48 p.m.
On 01/07/09 19:45, inode0 wrote:
Returning to Larry's question this is the point where I want my
fingerprint on my Fedora business card ... to make this exchange not
require me writing it down or printing it out or anything else. We
meet, we confirm identities using birth certificates and 15 forms of
other identification including 6 with pictures (or whatever *you* feel
is necessary
#1 Not what *I Feel* it's just the way it's done.
beyond the stated expectation as described here and
elsewhere), and you take my business card. It makes my life at a
keysigning party that much easier and it makes the signer's life
easier later when signing the keys too.
Once verified and validated yes.
and so on out as ripples.
Frank
1:57 p.m.
On Wed, Jul 1, 2009 at 1:48 PM, Frank Murphy<frankly3d(a)gmail.com> wrote:
On 01/07/09 19:45, inode0 wrote:
> Returning to Larry's question this is the point where I want my
> fingerprint on my Fedora business card ... to make this exchange not
> require me writing it down or printing it out or anything else. We
> meet, we confirm identities using birth certificates and 15 forms of
> other identification including 6 with pictures (or whatever *you* feel
> is necessary
#1 Not what *I Feel* it's just the way it's done.
Sorry Frank, I did not mean Frank when I said *you* there. I meant
whoever is confirming the identity of the unknown party. Some people
might require more than a picture ID. They might ask for 2 forms of
government issued ID with one including a picture or something else.
John
2 p.m.
On 01/07/09 19:57, inode0 wrote:
Sorry Frank, I did not mean Frank when I said *you* there. I meant
whoever is confirming the identity of the unknown party. Some people
might require more than a picture ID. They might ask for 2 forms of
government issued ID with one including a picture or something else.
John
My bad.
It's getting late here and I'm grumpy.
I need some TV, to calm me down.
Frank
1:10 p.m.
On Wed, Jul 1, 2009 at 1:03 PM, Larry Cafiero<larry.cafiero(a)gmail.com> wrote:
On Wed, Jul 1, 2009 at 10:43 AM, inode0 <inode0(a)gmail.com>
wrote:
>
> You cannot validate an imported key without having access to the full
> fingerprint. You should always validate the key's fingerprint with the
> key's owner before signing it. You can call the person or use some
> other means, it is convenient for people if it is just on the card.
So let me make sure I'm following this (while exposing what a noob I am in
this regard): I would validate an imported key from you by checking what's
on my screen against the full fingerprint on your business card. Is that the
rationale and benefit of having the full fingerprint on the card?
The key you are importing is likely not from me but from some key
server on the internet. You might have received it directly from the
key's owner, but I think that is unusual.
yes, after confirming matching fingerprints you know it is my key. It
is just easier to do that if I give you my fingerprint.
John
5406
days inactive
5406
days old
marketing@lists.fedoraproject.org
15 comments
5 participants
participants (5)
-
Frank Murphy -
Ian Weller -
inode0 -
Larry Cafiero -
Rashadul Islam