Re: [Sks-devel] The pool is shrinking

[Robert J. Hansen]

Mostly this is a response to Arnold, as for some reason his email never
showed up in my inbox:

> I thought SKS and PGP-keys is about one's ability to hide private
> data (by encryption).

Tools do not have intrinsic purposes.  There's the stuff they're
designed for and there's the stuff they actually wind up getting used
for, and very often the two are nothing alike.

The #1 use of OpenPGP today is for Linux distros to verify system
packages.  That accounts for 95% of all OpenPGP usage -- maybe more.

Tools are just tools.  We, we human beings, are the ones who have
purposes and ambitions and goals.

> GDPR is also about one's ability to hide private data

They are different far more than they are similar.

If I use OpenPGP to secure my communications, I'm not imposing anything
on people who acquire my communications.  If they can break the crypto,
go for it.  If they can't, tough luck.  But I'm not telling people who
already have the data, "oh sorry, you can't have it now."

The GDPR is completely different.  You can give me your personal
information.  I can give you complete up-front disclosure about what
you're getting into.  You can review it, you can decide that yes you
want to do this, you can give me your data... and then, ten years later,
you can force me "hey, I changed my mind, you've got to erase data now."

The OpenPGP model *compels absolutely no one*.  GDPR is built around the
idea *the EU has the right to compel people to delete data.*

I'm an American.  If the EU thinks it has the right to compel me to obey
a law I had no say in, well, good luck.

> To me, it is very strange to read one strongly supports one form of
> privacy, while totally ignoring other forms.

Then I think you really need to study ethics.

*How we do something* is just as important as *what it is we do*.  I
think there's a lot to be said about pursuing privacy in a way that
imposes no obligations on any other people.  And I think there's a lot
to be said against pursuing privacy in a way that imposes obligations on
people who don't even live in the EU.

> Remember, people in different parts of the world do have different
> values and different needs.

Yep.  And in America, we value our right to be left alone from the
government telling us that we're required to take certain acts just
because some people in Europe insist we follow their laws.