Coding Freedom: The Ethics and Aesthetics of Hacking

message, text, or piece of software. With an attached signature, it is proof that it originated from the person possessing the key. When key owners meet in person, they establish their identity to each other by exchanging pieces of government-issued picture identification and the key fingerprint, which uniquely identifies the key itself. Having traded and verified this information, developers later place their unique cryptographic signature on each other’s keys to confirm to others that they have connected the key being signed with the individual in possession of those identity documents. This is a process of identity verification that can then be used over the Internet to confirm, with certainty, that an individual is who they say they are.
    By requiring new developers to obtain the signature of an existing Debian developer, the NMP integrates them into what they call a cryptographic “web of trust.” Because nearly every hacker within Debian has a key signed by at least one existing developer, and because many developers have keys signed by numerous others (the stronger the connected set of signatures is, the more trustworthy it is considered), nearly all maintainers are connected. Debian can use cryptographic algorithms to prove that most every developer met at least one other developer, who in turn met at least one other developer, and so forth, until every developer is linked. Debian’s administrative software depends heavily on these keys to identify users for the purposes of integrating software into the distribution, for controlling access to machines, allowing access to a database with sensitive information on developers, and restricting publication to announce-only email lists.
    The importance of meeting in person to sign the keys is illustrated in the following anecdote, which begins with the controversial claim of one Debian developer:
    I have a potentially controversial thesis. My thesis is that the “Raul Miller” who is a Debian Developer and sits on the Technical Committee (and was, for a time, its chairman) doesn’t actually exist.
    You see, Mr. Miller joined the project before we had the current procedures for vetting developers’ identities, and even before we had the semi-informal ones under which I myself was admitted to the project in 1998. Interestingly, there are no signatures on Mr. Miller’s PGP key other than his own. A remarkable accomplishment for someone who’s been with the project this long, but not so surprising for someone whom no other developer has, as far as I can tell, ever claimed to have met in person. 21
    When it became clear that Miller, who occupied a crucial technical position in the project at that time, was outside the web of trust, there was such alarm that within three days, two developers drove to meet the individual in question and succeeded in bringing him into the cryptographic network. The developers’ strong reactions demonstrated the
essential nature
of these infrequent face-to-face interactions and significance of verifying the identity of one of their technical guardians.
    Integration into Debian’s web of trust is thus a vital first step in new maintainers’ integration into the Debian project. This process connects and leads into the second and often most rigorous part of the NMP: philosophy and procedures. The first part of the application requires that new maintainers provide a declaration of intention, a proof of some contribution or skill they could bring to the project, and undergo the philosophy and procedure testing, which includes a biographical narrative of why and how they became involved in free software and Debian.
    During this philosophy step in the NMP, application managers ask prospective developers a series of questions regarding free software and Debian philosophy. While general knowledge of the definition and philosophy related to F/OSS is essential, the questions revolve around Debian’s Social Contract and DFSG. New maintainers are asked a series of questions—some culled from a standard template, and others created anew—to demonstrate their familiarity with these documents, ability to apply and synthesize the concepts encapsulated within them, and capacity to articulate their agreement with as well as commitment to the Debian ideals.
    Although each new maintainer must agree to the Social Contract, the philosophy test does not require developers to hold a homogeneous view on free software. Rather, it seeks to ensure that