My name is Daniel Con Gilmore and I'm a Debbie developer. So Debbie is an operating system. We call it the universal operating system. It's been around for 20 years. We have tens of thousands of software packages in it. We're working from a simple text editor to system control units to very specialized stuff for specific tasks. The goal of Debbie is to be all free software. We take that ethos very seriously. What we want is the software freedoms are freedom to use. However you like, freedom to redistribute, freedom to modify, freedom to redistribute your modifications. We take that seriously that we think it's really important people should be able to take Debbie in and produce something else. I'm responsible for maintaining a handful of packages within Debbie in. We've not been doing the most work on recently has been a new PG and the sort of family of projects around new PG. In Debbie in, all of the Debbie in developers must have an open PGP key. That's what they use to identify themselves and we use that actually not so much for the secrecy that a PGP often provides but to use it for authentication. If you're going to make an official statement that you want the project to act on, then you'll need to sign that statement. There's a couple of statements that you might want to make. You might want to say, here's a new version of Package X. You might want to say, I think the project needs to hold a vote on something. You might want to say, I want to take a vote. I want to act in my role as a Debbie in project member on this vote that's coming up. If I want to add something to the archive, I sign it with my key as a Debbie developer. Then I upload it and the archive checks it and says, this is verified, this is signed by one of Debbie developer keys, it's the KG's key and I'll go ahead and upload it. It'll be laid into the archive or the vote happens or say, I want it to resign. I don't want someone to be able to forge a mail that says, I resign and post it to the Debbie in mail and this. Anybody can post anything to Debbie mailing this. Forging email is easy. People who rely on Debbie end up relying on KUMPG as well. We do that because when we distribute software, the software that we're distributing also needs to be signed. If you're installing any software today and you're not verifying it cryptographically, you've opened yourself to an attack by whoever can modify the software as it's in transit. When I say an attack, what are the kinds of things that I mean? They can make you run arbitrary code. You think you're fetching a copy of Firefox. If it's not actually Firefox, they can put something on your computer that spies on all of your web browsing. It looks like Firefox to you, but you don't know. Debbie and Signs everything that it releases and the tools generally will not let you install something by accident that hasn't actually been signed by the project. All of those signatures are done with KUMPG. In addition to looking within the project and outside of the project, we're also trying to verify that the software that we get from the outside of Debbie is actually cryptographically signed. That's not universal, but we're doing that as well. In general, we're trying to protect the integrity of the software ecosystem by ensuring that the software that we're using, that we know where it came from, and that we have vouchers for it, as we're by the different people who are touching it along the way. The big scary boogie man, of course, is sort of nation-state actors. I don't know how well we can actually effectively defend against a really dedicated, advanced persistent threat like that. But they certainly would need to do a lot more work than if we weren't using GPTA to defend it. But there's way many, many, many more other actors besides that who want to be able to control what software you run on your machine. There's content delivery companies. There's your ISP. There's advertisers. There's a whole range of folks who want you to run their software because they can make a buck off of you running your software or they can make a buck off of learning your habits. And the more that we can defend our users against that kind of scam artist, the better off our users will be. The better off the ecosystem will be as a whole because as you just will be able to do what they want to do. We've seen software that's been compromised by attacks on the infrastructure and we catch those attacks because they're missing cryptographic signatures. I would say that the majority of people who rely on GPG have no idea that it's there. And I'd say this not just from first order effects but from second and third order effects as well. The majority of people who run an operating system don't even think about how do we verify that the software that we're installing is the right piece of software. So whether or not you have a GPG key, whether or not you ever send encrypted mail, you're relying on GPG to ensure that your software updates actually work the way that you expect. You're relying on a bunch of other stuff as well but without GPG that other stuff wouldn't actually be effective. In addition, many operating systems, many free software operating systems are installed on servers and those servers run somewhere and you interact with them and everyone who interacts with them is actually depending on that software behaving the way it is expected to behave. So even if you've never run free software on your own computer in your life, you've interacted with software running on a server someplace and that software is running on a server that's running an operating system and that operating system has updates and that operating system is not getting compromised by someone sending it bad data because it's relying on GPG. So even if you've never touched free software and you have no plan on ever touching it, this is the second and third of under effects. You're actually still relying on that working because it's part of this critical part of the infrastructure.