At the core of #AndroidDeveloperVerification are a couple potentially useful ideas. #Google has entirely wrapped them in a pile of anti-competitive garbage designed to defend their massive #monopoly profit margins, but nonetheless, those specific technical ideas might still be useful. #iOS's "notarization" is basically the same. That leads me to ask the key question:
What would a #FOSS-respecting system of #verification look like? What #identity info is useful for trusting the #developer?
@eighthave Public key(s) placed in a keys.{app}.{domain} DNS TXT record, private key encrypted app hashes in {version}.{app}.{domain} DNS TXT record, and an OS that knows how to download that hash, decrypt it, and compare it to the app binary it has downloaded.
Maybe @postmarketOS wants to implement this as a trial.
@alsutton @postmarketOS This would specifically link the app and the domain name. That would give the app signer's pseudonym a website/email link, building a more complete pseudonym profile. But I can't see how that would change anything for when the user wants some method of verifying the developer. Linking to someone's government identity does make it easier to track down the actual people who are involved.
@eighthave @postmarketOS The owner of the domainwould be considered the developer, and most (if not all) DNS registrars have an identity verification requirement (even if it is checking a card is on file that, at some point, was used for payment)
@alsutton @postmarketOS sounds like you are proposing some kind of government ID check, then, albeit via the domain name registrar. Also, there is no natural link between a domain name and an app, that has to be invented.
