3 ms·
I really wish that the article did not use the old EFAIL thing. Is that really the worst aspect of the GnuPG API? From that one might get the impression that th
by upofadown 6y ago
I really wish that the article did not use the old EFAIL thing. Is that really the worst aspect of the GnuPG API? From that one might get the impression that the API must be pretty awesome if everyone keeps bringing up something that is, after all, a legitimate difference of opinion.
- anderskaseorg 6y agoThe article is clear about deferring fully to GnuPG on this difference of opinion: “gpg signaled an error; the applications didn’t adhere to the API contract. I have to agree with the GnuPG developers, …” yet making the additional point that if your API leaves room for a difference of opinion to result in a serious security vulnerability, your API might have room for improvement: “… and add: gpg’s interface was (and remains) a disaster waiting to happen, because it doesn’t guide the user to do the right thing.”