3 ms·
If one or two clients don't implement the standard correctly, the clients are broken. If all but one or two clients don't implement the standard correctly, the
by Analemma_ 9y ago
If one or two clients don't implement the standard correctly, the clients are broken. If all but one or two clients don't implement the standard correctly, the standard is broken. Part of what makes good standard design is knowing how to avoid pitfalls in client implementation.
- zokier 9y agoMost clients do not implement (correctly or incorrectly) PGP at all. Instead they delegate the PGP parts to GnuPG, and failed to handle the warnings that GPG emitted. So your logic could be applied to GPG and argued that it is broken.
- Forge36 8y agoIf true in curious how error handling is being done. Throwing an exception if possible might cause this case to crash the program. Or not returning the decoded content on exception and printing an error message in place of the content
- TooBrokeToBeg 8y ago> So your logic could be applied to GPG and argued that it is broken. That's a pretty common claim and has been for a long time. It's not just verification of identity, but verification of integrity that the encryption is supposed to enforce. Instead, it throws a warning for one case and will not decrypt for another. The binary client is broken, as a security tool (insofar as it fails to provide the security it claims). If the integrity of the message is compromised, why show a version of the decrypted message at all? There's no guarantee that's correct and has led to this.