I assume Linus would be slightly suspicious getting a pull request from himself. :)
But in cases where there's no obvious hierarchy for new users to enter the network, oversights like these are surely dangerous. Unfortunately the free software community infrastructure has the same issues--
1) download all the public GPG keystores
2) count the total number of keys
3) generate that same number of keys, copying the name/email info you got from the keys in the keystore
4) graft the social graph (i.e., which keys signed which other keys) from the keystores onto the keys you generated, creating a kind of "shadow" keychain
5) slowly upload your "shadow" keychain back up to the public GPG keystores.
Voila! Now you have two Richard Stallmans, two IOhanneses, two everything. Big deal. But you also have the _exact_ same number of signatures on each key as the real keychain. To the newcomer its impossible to tell which is real and which is fake by counting the signatures.
I mentioned this to some GPG gurus, and they brushed it off because-- after all-- the "shadow" keychain just sits there on its own little island. And that's true, until somebody accidentally signs something in the "shadow" keychain from the real one.
(I also watched a video of a security expert mentioning this same issue, which was alarming because I had always assumed I didn't understand well enough how the web of trust works...)
-Jonathan
On Tuesday, August 4, 2015 8:59 PM, Chris McCormick <chris@mccormick.cx> wrote: