Hacker News Reader

Comment by nitrohorse | Hacker News Reader

"I already prevented any possible compromise of the OS. I am not capable of compromising it anymore so no form of coercion can make me do that. It's very unfortunate that things ended this way and now I guess the little money I earned from this will go to legal fees, etc." - Daniel Micay

https://twitter.com/DanielMicay/status/1006331205682384896

Apparently he's deleted the signing keys.

https://twitter.com/DanielMicay/status/1006334186725224448

View on HN

I'm wondering if destroying the signing keys will have legal consequences. Are signing keys considered company IP when their identity is "fused" with the main developer?

Reading online posts it seems that the community is trusting the developer, not the company behind him.

If those keys were generated before the company existed, and there is no explicit assignment, then they clearly belonged to him.

If they were generated later, it gets very hairy. Were they created with company resources? On company time? Is there a record of this happening? Etc etc.

Going to court would be a huge waste of money for all parties involved, at this point.

But if those keys represent Person A at Company X then who owns them? Can the company use them if they don't represent the truth anymore?

Who's responsibility is it to guard/change/dispose them?

His twitter says he originally generated them in 2009-2010 to submit packages to the aur. So he's probably in the clear.

Reply on news.ycombinator.com