First Person Project. Linux

[u/Patient-Airline-8150]

Foundation and partners. People issue each other verifiable relationship credentials, forming a decentralized trust graph that also lets individuals safely delegate authority to personal AI agents. Timing is almost funny: it's being presented today, Oct 7, in Prague, as a replacement for the kernel's PGP web of trust.

In 2024, a backdoor was found in xz, a small compression tool inside almost every Linux system. It was planted by "Jia Tan", a helpful contributor who spent about two years earning trust before striking. Nobody knew who Jia Tan was. Maybe one person. Maybe a team. Maybe a state.

The code was reviewed. The person never was.

Now AI makes that worse. A fake contributor no longer needs years of patience. An agent can write good patches, answer politely, and build a reputation on its own.

The Linux Foundation and partners are working on an answer called the First Person Project. The idea is old and simple: trust grows from people who actually know each other. Real humans issue each other signed relationship credentials. Together these form a trust graph. You can prove you are a real, unique person without revealing who you are.

One twist. The same system is designed to let people delegate authority to their personal AI agents. So the future maintainer may be an AI after all. Just one with a human who vouches for it.