4 ms·

Thats the point. PGP isn’t a good standard.

upofadown 6y ago
Age/Rage is not a standard at all. It is just a program. It definitely has nothing to do with a project intended to implement a particular standard. It is a non-sequitor here.
- pvg 6y ago
  PGP is a giant blob of byzantine implementation details and layers of accrued crust that people call a standard by convention and out of inertia.
  - ifmpx 6y ago
    Being a giant blob of byzantine implementation details and layers of accrued crust doesn't take away from PGP being a standard. Take a look at BMP or Postscript/PDF or even Email and tell me they're not the same. Parent's point still stands: PGP is a standard (with widespread adoption, mind you) whereas Age is not. Whether it is a good standard or not depends on how you're using it.
    - pvg 6y ago
      The parent's point was that age is 'just a program' and thus not a standard, with no mention of adoption. But PGP is arguably less of a standard than age, by that metric. As to adoption, PGP has very little adoption for actually securing anything (rather than performative use) and for those uses it's trivially replaceable because it's not actually good at them - that's pretty much the motivation behind things like 'age'.
ifmpx 6y ago
I think it's an excellent standard and its widespread adoption demonstrates this. Can you explain why you think it isn't?
- tptacek 6y ago
  It has virtually no adoption. Every modern secure messenger application sends encrypts more messages, and between more pairs of people, than OpenPGP has in its entire lifetime. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - ifmpx 6y ago
    > It has virtually no adoption. The sheer volume of gpg-signed apt/rpm/tar packages downloaded and verified everyday cast doubt on your claim. I bet the number of packages downloaded for CI alone would invalidate this claim.
    - tptacek 6y ago
      They would not; you're either drastically underestimating the number of messages modern secure messengers handle, or overestimating the number of packages verified every day. But PGP is also an archaic way to sign packages, and there is no network effect to package signature schemes; all of them can, and should, be replaced with modern schemes like minisign/signify.
      - ifmpx 6y ago
        Our disagreement here is on your claim that PGP has virtually no adoption. I brought up the monstrous amount of packages that get verified by CI/containers/OSs as an example where PGP is widely adopted. No one is claiming that dedicated tools can't do the job better. People use PGP because it is standard, widely-adopted, and does what people need it to do. From where I'm standing, people who argue against these three facts are underestimating PGP or overestimating their own favored solutions.
        tptacek 6y ago
        No, people use PGP because at the times these systems were designed, there weren't better options; in some cases, there literally wasn't materially better cryptography, and in others, the better cryptography wasn't suitably enabled by good libraries. None of that is true anymore, nobody should be using the archaic PGP format for anything new, and, in most cases, people should be investigating how to replace PGP with modern alternatives.

Age/Rage is not a standard at all. It is just a program. It definitely has nothing to do with a project intended to implement a particular standard. It is a non-sequitor here.

pvg 6y ago
PGP is a giant blob of byzantine implementation details and layers of accrued crust that people call a standard by convention and out of inertia.
- ifmpx 6y ago
  Being a giant blob of byzantine implementation details and layers of accrued crust doesn't take away from PGP being a standard. Take a look at BMP or Postscript/PDF or even Email and tell me they're not the same. Parent's point still stands: PGP is a standard (with widespread adoption, mind you) whereas Age is not. Whether it is a good standard or not depends on how you're using it.
  - pvg 6y ago
    The parent's point was that age is 'just a program' and thus not a standard, with no mention of adoption. But PGP is arguably less of a standard than age, by that metric. As to adoption, PGP has very little adoption for actually securing anything (rather than performative use) and for those uses it's trivially replaceable because it's not actually good at them - that's pretty much the motivation behind things like 'age'.

ifmpx 6y ago

I think it's an excellent standard and its widespread adoption demonstrates this. Can you explain why you think it isn't?

tptacek 6y ago
It has virtually no adoption. Every modern secure messenger application sends encrypts more messages, and between more pairs of people, than OpenPGP has in its entire lifetime. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- ifmpx 6y ago
  > It has virtually no adoption. The sheer volume of gpg-signed apt/rpm/tar packages downloaded and verified everyday cast doubt on your claim. I bet the number of packages downloaded for CI alone would invalidate this claim.
  - tptacek 6y ago
    They would not; you're either drastically underestimating the number of messages modern secure messengers handle, or overestimating the number of packages verified every day. But PGP is also an archaic way to sign packages, and there is no network effect to package signature schemes; all of them can, and should, be replaced with modern schemes like minisign/signify.
    - ifmpx 6y ago
      Our disagreement here is on your claim that PGP has virtually no adoption. I brought up the monstrous amount of packages that get verified by CI/containers/OSs as an example where PGP is widely adopted. No one is claiming that dedicated tools can't do the job better. People use PGP because it is standard, widely-adopted, and does what people need it to do. From where I'm standing, people who argue against these three facts are underestimating PGP or overestimating their own favored solutions.
      - tptacek 6y ago
        No, people use PGP because at the times these systems were designed, there weren't better options; in some cases, there literally wasn't materially better cryptography, and in others, the better cryptography wasn't suitably enabled by good libraries. None of that is true anymore, nobody should be using the archaic PGP format for anything new, and, in most cases, people should be investigating how to replace PGP with modern alternatives.