4 ms·

"(GPGMail support for macOS Sierra coming soon)" And that's where it still is. 41 days after the Sierra release. After every MacOS update, GPG in Apple Mail s

"(GPGMail support for macOS Sierra coming soon)" And that's where it still is. 41 days after the Sierra release. After every MacOS update, GPG in Apple Mail stops working. That's just not helping to drive adoption and it's just not acceptable IMHO.

tptacek 10y ago
"Not acceptable"? What does that mean?
- libertymcateer 10y ago
  That taking more than a month to push an update necessary to run on the most recent (and most secure) release of a major OS is not a satisfactory basis for communications software. I don't think it is reasonable to leave users hanging for 41 days. BTW, I am not judging. I understand how hard this is. But if they want mass adoption, they have to have much faster updates. Bruce Schneier joked that the user definition of an 'unacceptable' software delay is a 'noticeable' software delay [NB: I read this in Secrets and Lies - he may have been quoting someone else but I can't find a source online]. Based on that standard, this is way too long.
  - peterbraden 10y ago
    And how much do you pay for this timely an update?
    - libertymcateer 10y ago
      Is the implication that is because the software is free, the admins may be unworkably slow in releasing critical patches? Plenty free software is patched on time. Is this going to become a philosophical debate about freemium software?
      - tptacek 10y ago
        Yes, that is the (correct) implication. GnuPG isn't "freemium".
        libertymcateer 10y ago
        Communications software that has >40 days of lag between OS updates and a patch that allows the software to run on that OS is not commercial grade. I understand the value in doing the project nonetheless (research, reputation, education, academic use, public availability at no cost, etc.), but it is not reasonable to expect any corporate user to even consider adopting a communications tools with ~6-7 week lag-times to patch after OS upgrades. And I regret now mentioning freemium. That is not relevant. You can argue - very validly - that this software is a gift horse. However, it is unreasonable to be unreceptive to critique that says, simply, "projects that take this long to update after OS updates are not commercial grade." That is all I am saying. I hate the implication that just because software is free it should just be accepted that it is not well supported - if that is the point that is being made, corporate users simply won't be using the software in question.
        tptacek 10y ago
        The idea that the software is a gift to you is not so much an argument as it is a fact.
        libertymcateer 10y ago
        Right, and the point is that this gift will not achieve mass adoption unless there is better support. Edit: I checked your profile - I will likely be getting a bunch of your recommended reading material, and we clearly have a -lot- of interests in common. This is my way of saying that I have a lot of respect for your opinion and also trying to also express that while I am sure my tone is coming off as someone wry or sarcastic, I do not mean to be bluntly disrespectful. What I can tell you is that, on this count, you are very unlikely to persuade me. I spend a substantial amount of time helping people attach business models to software, and 'free' is one of those models - it can absolutely be rigorous, and you can absolutely build big, successful businesses off of software that is offered without any user cost. No business will ever be successful - ever - if the core offering is poorly supported. At this point, you may counter that GnuPG is not a business - fair point! In that case, it is a charity - but this does not change the fact that the software it is releasing is not a commercially viable product and it will not become one with this level of support. Other foundations, however, do release commercially viable software. Including, notably, the elephant in the room: Mozilla. In fact, there are donation pages right on the linked site. So, rather than take the attitude that we should be grateful for any free software, why don't we take the attitude that it is extremely bloody important at this point in history that a whole lot of people release commercial-grade encrypted communications software and try to discuss what is going wrong here with GnuPG and how it can be fixed? To put it another way: this is addressing a clear need, which is that of an independent publisher, not beholden to any particular set of third parties, publishing secure communications software. Rather than accept that it is going to be virtually impossible to get the software it releases adopted at, for instance, the law firm in which I work - why can't we accept something here is going wrong, and that other people, like Mozilla, seem to have it figured out? I'm much more interested in that discussion than basically being told I should be thankful for this gift of software that still doesn't work 42 days after the last Sierra upgrade.
saosebastiao 10y ago
> After every MacOS update, GPG stops working. That's just not helping to drive adoption and it's just not acceptable IMHO. I agree, apple should stop breaking users' code with every release.
- atonse 10y ago
  Apple has a 4-5 month beta period between when they release the OS to developers, and to the public.
  - joshka 10y ago
    I recall seeing somewhere that there was a change in things between the Sierra betas and the final release that affected GPGTools. I can't find the post / thread unfortunately. The note at [1] is as close as I can find. > Apple's changes are even more substantial this time around, then they were in the last releases. > In addition they're now using more blocks instead of methods in some places, which means that we can no longer simply hook into them, but have to completely re-implement some internal functionality of Mail, to place our code in between. > We've already rewritten a lot of parts of GPGMail and hope to have a first beta in the next few weeks. [1]: https://github.com/GPGTools/GPGMail/commit/f871731f5762cb72e6262f1d790e8dbad5319398#commitcomment-19943799 https://github.com/GPGTools/GPGMail/commit/f871731f5762cb72e...
- gmgorange 10y ago
  Maybe the GPG Suite folks should stop writing the integration in such a fragile manner. Maybe they should use the time the upcoming macOS is in developer/public beta to fix any issues ahead of the release? Maybe GPG Suite shouldn't be a thing given the lack of interest and support?
johnymontana 10y ago
I've been using GPG on Sierra for a while now and it works great - although without GPGMail. I actually didn't realize there was a mail integration...

tptacek 10y ago

"Not acceptable"? What does that mean?

libertymcateer 10y ago
That taking more than a month to push an update necessary to run on the most recent (and most secure) release of a major OS is not a satisfactory basis for communications software. I don't think it is reasonable to leave users hanging for 41 days. BTW, I am not judging. I understand how hard this is. But if they want mass adoption, they have to have much faster updates. Bruce Schneier joked that the user definition of an 'unacceptable' software delay is a 'noticeable' software delay [NB: I read this in Secrets and Lies - he may have been quoting someone else but I can't find a source online]. Based on that standard, this is way too long.
- peterbraden 10y ago
  And how much do you pay for this timely an update?
  - libertymcateer 10y ago
    Is the implication that is because the software is free, the admins may be unworkably slow in releasing critical patches? Plenty free software is patched on time. Is this going to become a philosophical debate about freemium software?
    - tptacek 10y ago
      Yes, that is the (correct) implication. GnuPG isn't "freemium".
      - libertymcateer 10y ago
        Communications software that has >40 days of lag between OS updates and a patch that allows the software to run on that OS is not commercial grade. I understand the value in doing the project nonetheless (research, reputation, education, academic use, public availability at no cost, etc.), but it is not reasonable to expect any corporate user to even consider adopting a communications tools with ~6-7 week lag-times to patch after OS upgrades. And I regret now mentioning freemium. That is not relevant. You can argue - very validly - that this software is a gift horse. However, it is unreasonable to be unreceptive to critique that says, simply, "projects that take this long to update after OS updates are not commercial grade." That is all I am saying. I hate the implication that just because software is free it should just be accepted that it is not well supported - if that is the point that is being made, corporate users simply won't be using the software in question.
        tptacek 10y ago
        The idea that the software is a gift to you is not so much an argument as it is a fact.
        libertymcateer 10y ago
        Right, and the point is that this gift will not achieve mass adoption unless there is better support. Edit: I checked your profile - I will likely be getting a bunch of your recommended reading material, and we clearly have a -lot- of interests in common. This is my way of saying that I have a lot of respect for your opinion and also trying to also express that while I am sure my tone is coming off as someone wry or sarcastic, I do not mean to be bluntly disrespectful. What I can tell you is that, on this count, you are very unlikely to persuade me. I spend a substantial amount of time helping people attach business models to software, and 'free' is one of those models - it can absolutely be rigorous, and you can absolutely build big, successful businesses off of software that is offered without any user cost. No business will ever be successful - ever - if the core offering is poorly supported. At this point, you may counter that GnuPG is not a business - fair point! In that case, it is a charity - but this does not change the fact that the software it is releasing is not a commercially viable product and it will not become one with this level of support. Other foundations, however, do release commercially viable software. Including, notably, the elephant in the room: Mozilla. In fact, there are donation pages right on the linked site. So, rather than take the attitude that we should be grateful for any free software, why don't we take the attitude that it is extremely bloody important at this point in history that a whole lot of people release commercial-grade encrypted communications software and try to discuss what is going wrong here with GnuPG and how it can be fixed? To put it another way: this is addressing a clear need, which is that of an independent publisher, not beholden to any particular set of third parties, publishing secure communications software. Rather than accept that it is going to be virtually impossible to get the software it releases adopted at, for instance, the law firm in which I work - why can't we accept something here is going wrong, and that other people, like Mozilla, seem to have it figured out? I'm much more interested in that discussion than basically being told I should be thankful for this gift of software that still doesn't work 42 days after the last Sierra upgrade.

saosebastiao 10y ago

> After every MacOS update, GPG stops working. That's just not helping to drive adoption and it's just not acceptable IMHO. I agree, apple should stop breaking users' code with every release.

atonse 10y ago
Apple has a 4-5 month beta period between when they release the OS to developers, and to the public.
- joshka 10y ago
  I recall seeing somewhere that there was a change in things between the Sierra betas and the final release that affected GPGTools. I can't find the post / thread unfortunately. The note at [1] is as close as I can find. > Apple's changes are even more substantial this time around, then they were in the last releases. > In addition they're now using more blocks instead of methods in some places, which means that we can no longer simply hook into them, but have to completely re-implement some internal functionality of Mail, to place our code in between. > We've already rewritten a lot of parts of GPGMail and hope to have a first beta in the next few weeks. [1]: https://github.com/GPGTools/GPGMail/commit/f871731f5762cb72e6262f1d790e8dbad5319398#commitcomment-19943799 https://github.com/GPGTools/GPGMail/commit/f871731f5762cb72e...
gmgorange 10y ago
Maybe the GPG Suite folks should stop writing the integration in such a fragile manner. Maybe they should use the time the upcoming macOS is in developer/public beta to fix any issues ahead of the release? Maybe GPG Suite shouldn't be a thing given the lack of interest and support?

johnymontana 10y ago

I've been using GPG on Sierra for a while now and it works great - although without GPGMail. I actually didn't realize there was a mail integration...