3 ms·

And how much do you pay for this timely an update?

libertymcateer 10y ago
Is the implication that is because the software is free, the admins may be unworkably slow in releasing critical patches? Plenty free software is patched on time. Is this going to become a philosophical debate about freemium software?
- tptacek 10y ago
  Yes, that is the (correct) implication. GnuPG isn't "freemium".
  - libertymcateer 10y ago
    Communications software that has >40 days of lag between OS updates and a patch that allows the software to run on that OS is not commercial grade. I understand the value in doing the project nonetheless (research, reputation, education, academic use, public availability at no cost, etc.), but it is not reasonable to expect any corporate user to even consider adopting a communications tools with ~6-7 week lag-times to patch after OS upgrades. And I regret now mentioning freemium. That is not relevant. You can argue - very validly - that this software is a gift horse. However, it is unreasonable to be unreceptive to critique that says, simply, "projects that take this long to update after OS updates are not commercial grade." That is all I am saying. I hate the implication that just because software is free it should just be accepted that it is not well supported - if that is the point that is being made, corporate users simply won't be using the software in question.
    - tptacek 10y ago
      The idea that the software is a gift to you is not so much an argument as it is a fact.
      - libertymcateer 10y ago
        Right, and the point is that this gift will not achieve mass adoption unless there is better support. Edit: I checked your profile - I will likely be getting a bunch of your recommended reading material, and we clearly have a -lot- of interests in common. This is my way of saying that I have a lot of respect for your opinion and also trying to also express that while I am sure my tone is coming off as someone wry or sarcastic, I do not mean to be bluntly disrespectful. What I can tell you is that, on this count, you are very unlikely to persuade me. I spend a substantial amount of time helping people attach business models to software, and 'free' is one of those models - it can absolutely be rigorous, and you can absolutely build big, successful businesses off of software that is offered without any user cost. No business will ever be successful - ever - if the core offering is poorly supported. At this point, you may counter that GnuPG is not a business - fair point! In that case, it is a charity - but this does not change the fact that the software it is releasing is not a commercially viable product and it will not become one with this level of support. Other foundations, however, do release commercially viable software. Including, notably, the elephant in the room: Mozilla. In fact, there are donation pages right on the linked site. So, rather than take the attitude that we should be grateful for any free software, why don't we take the attitude that it is extremely bloody important at this point in history that a whole lot of people release commercial-grade encrypted communications software and try to discuss what is going wrong here with GnuPG and how it can be fixed? To put it another way: this is addressing a clear need, which is that of an independent publisher, not beholden to any particular set of third parties, publishing secure communications software. Rather than accept that it is going to be virtually impossible to get the software it releases adopted at, for instance, the law firm in which I work - why can't we accept something here is going wrong, and that other people, like Mozilla, seem to have it figured out? I'm much more interested in that discussion than basically being told I should be thankful for this gift of software that still doesn't work 42 days after the last Sierra upgrade.

Is the implication that is because the software is free, the admins may be unworkably slow in releasing critical patches? Plenty free software is patched on time. Is this going to become a philosophical debate about freemium software?

tptacek 10y ago
Yes, that is the (correct) implication. GnuPG isn't "freemium".
- libertymcateer 10y ago
  Communications software that has >40 days of lag between OS updates and a patch that allows the software to run on that OS is not commercial grade. I understand the value in doing the project nonetheless (research, reputation, education, academic use, public availability at no cost, etc.), but it is not reasonable to expect any corporate user to even consider adopting a communications tools with ~6-7 week lag-times to patch after OS upgrades. And I regret now mentioning freemium. That is not relevant. You can argue - very validly - that this software is a gift horse. However, it is unreasonable to be unreceptive to critique that says, simply, "projects that take this long to update after OS updates are not commercial grade." That is all I am saying. I hate the implication that just because software is free it should just be accepted that it is not well supported - if that is the point that is being made, corporate users simply won't be using the software in question.
  - tptacek 10y ago
    The idea that the software is a gift to you is not so much an argument as it is a fact.
    - libertymcateer 10y ago
      Right, and the point is that this gift will not achieve mass adoption unless there is better support. Edit: I checked your profile - I will likely be getting a bunch of your recommended reading material, and we clearly have a -lot- of interests in common. This is my way of saying that I have a lot of respect for your opinion and also trying to also express that while I am sure my tone is coming off as someone wry or sarcastic, I do not mean to be bluntly disrespectful. What I can tell you is that, on this count, you are very unlikely to persuade me. I spend a substantial amount of time helping people attach business models to software, and 'free' is one of those models - it can absolutely be rigorous, and you can absolutely build big, successful businesses off of software that is offered without any user cost. No business will ever be successful - ever - if the core offering is poorly supported. At this point, you may counter that GnuPG is not a business - fair point! In that case, it is a charity - but this does not change the fact that the software it is releasing is not a commercially viable product and it will not become one with this level of support. Other foundations, however, do release commercially viable software. Including, notably, the elephant in the room: Mozilla. In fact, there are donation pages right on the linked site. So, rather than take the attitude that we should be grateful for any free software, why don't we take the attitude that it is extremely bloody important at this point in history that a whole lot of people release commercial-grade encrypted communications software and try to discuss what is going wrong here with GnuPG and how it can be fixed? To put it another way: this is addressing a clear need, which is that of an independent publisher, not beholden to any particular set of third parties, publishing secure communications software. Rather than accept that it is going to be virtually impossible to get the software it releases adopted at, for instance, the law firm in which I work - why can't we accept something here is going wrong, and that other people, like Mozilla, seem to have it figured out? I'm much more interested in that discussion than basically being told I should be thankful for this gift of software that still doesn't work 42 days after the last Sierra upgrade.