3 ms·
Additionally, NaCl/libsodium is actually designed as a misuse-resistant API to perform real-world tasks, unlike GPG, where the API is "call this binary and use
by moosingin3space 8y ago
Additionally, NaCl/libsodium is actually designed as a misuse-resistant API to perform real-world tasks, unlike GPG, where the API is "call this binary and use its crappy out-of-band signaling mechanism to figure out if anything went wrong".
- pferde 8y agoThis is what bugs me most about GnuPG - there's no real API, just an executable program with sometimes unreliable output. I mean, there is the GPGME library which wraps the executable calls in a C API (plus few other language bindings on the side), but it doesn't handle all the features the executable offers, often leaving you with a mix of GPGME API calls and "manual" calls to the gpg executable. I'd welcome some full-fledged libgpg that would reliably implement gpg the executable's functionality, similar to e.g. libcurl vs. the curl executable.
- lmm 8y agoEveryone would welcome it, but no-one's putting their money behind it. I suspect one of the real reasons that Signal uses a proprietary protocol (or rather, one of the real reasons that Signal was able to attract funding and improvements to GPG have not) is that having a locked-in userbase makes it easier to persuade VCs that there's a potential profit to be had. Whereas improving GPG would benefit everyone, but there's a tragedy of the commons around it.
- computerfriend 8y agoThe Signal protocol isn't proprietary, though. But yes, you make a good point. Although I'm not sure how much VC funding Signal really attracts.
- tptacek 8y agoZero. It's grant-funded.
- computerfriend 8y agoYeah, I expressed that badly, but meant to imply that they might receive VC funding in the future. For the record, I'm a Signal user and advocate.
- tptacek 8y agoWhat VCs are you talking about? Signal isn't VC-funded. It's grant-funded.