4 ms·

> 99% of the PGP-encrypted emails we get to security@golang.org are bogus security reports. Whereas “cleartext” security reports are only about 5-10% bogus. Th

> 99% of the PGP-encrypted emails we get to security@golang.org are bogus security reports. Whereas “cleartext” security reports are only about 5-10% bogus. This indicates a failing of the person who reads golang security emails. This person should be using mutt or something with similarly good support for PGP. Reading encrypted emails with a correctly configured setup is only marginally more difficult than reading cleartext emails (that is, you have to enter the key's password). You can make arguments all day about PGP usability for the average person, but not for the person reading security emails for a programming langauge maintained by Google.

benchaney 10y ago
How is that a failing of the person reading the email? They have no control whatsoever over who uses which method of communication.
- Sir_Cmpwn 10y ago
  Because that person is the person reading security@golang.org, which advertises a PGP key for encrypting emails sent to them. This is the security channel for golang. They should be comfortable using PGP and if they're not then they either need to learn it or they're the wrong person for the job.
  - deleted 10y ago
    [deleted]
  - benchaney 10y ago
    How comfortable they are with using PGP has no impact on which community members choose to use it.
    - Sir_Cmpwn 10y ago
      So? I'm talking about whether or not it matters when they do.
    - burkaman 10y ago
      There's more context in the article. The author was asked to resend their report without PGP, because using it was a hassle and usually not worth it.
vertex-four 10y ago
While theoretically the case... perhaps if real security people reporting real issues were to use GPG, there'd be an incentive to set it up properly. In practice, if 99% of emails you get via GPG are no better than spam - and in fact worse, since they require that you waste your time figuring out whether there is actually a bug - then GPG mostly just makes for a pretty good spam filter. Back in the real world, most security-minded people realise there's little chance that anything particularly awful is going to happen as a result of sending the report as an unencrypted email, and GPG is pretty dreadful to use so next to nobody uses it except for hobbyists.

benchaney 10y ago

How is that a failing of the person reading the email? They have no control whatsoever over who uses which method of communication.

Sir_Cmpwn 10y ago
Because that person is the person reading security@golang.org, which advertises a PGP key for encrypting emails sent to them. This is the security channel for golang. They should be comfortable using PGP and if they're not then they either need to learn it or they're the wrong person for the job.
- deleted 10y ago
  [deleted]
- benchaney 10y ago
  How comfortable they are with using PGP has no impact on which community members choose to use it.
  - Sir_Cmpwn 10y ago
    So? I'm talking about whether or not it matters when they do.
  - burkaman 10y ago
    There's more context in the article. The author was asked to resend their report without PGP, because using it was a hassle and usually not worth it.

vertex-four 10y ago

While theoretically the case... perhaps if real security people reporting real issues were to use GPG, there'd be an incentive to set it up properly. In practice, if 99% of emails you get via GPG are no better than spam - and in fact worse, since they require that you waste your time figuring out whether there is actually a bug - then GPG mostly just makes for a pretty good spam filter. Back in the real world, most security-minded people realise there's little chance that anything particularly awful is going to happen as a result of sending the report as an unencrypted email, and GPG is pretty dreadful to use so next to nobody uses it except for hobbyists.