3 ms·

>PGP is bloated and complex... Not in any relative sense. The commonly used Signal protocol for example is much more complex and is only applicable to one narr

>PGP is bloated and complex... Not in any relative sense. The commonly used Signal protocol for example is much more complex and is only applicable to one narrow category of application. In the Keyoxide case we are only doing signing so that is the only part of the OpenPGP standard that would be applicable. >...channel binding... Could you expand on how that might relate to PGP applications? >...perfect forward secrecy... ... is not relevant for the protection of things like files. Even for messaging it is rarely of any value as users like to keep their old messages around. >...poor/deprecated algos... See my other reply: * https://news.ycombinator.com/item?id=29138592 https://news.ycombinator.com/item?id=29138592 ...OpenBSD... OpenBSD needed something compatible with the license of the base distribution. The mistake made was that signify was not made to use a preexisting format. So it is an attempt to create a whole new standard in a way that provides no benefit to anyone.

Seirdy 5y ago
> In the Keyoxide case we are only doing signing so that is the only part of the OpenPGP standard that would be applicable. The problem is that PGP does a lot of stuff besides signing too; this is bad design, and is one in a long list of issues with PGP. Its network effect extends to areas where issues like the lack of channel binding and PFS are relevant (e.g. communication platforms): people use the "it's already installed (for something else)" argument far too often to justify using it for something it isn't suited for (most other things). > OpenBSD needed something compatible with the license of the base distribution. The mistake made was that signify was not made to use a preexisting format. So it is an attempt to create a whole new standard in a way that provides no benefit to anyone. Signify's standard is dead simple, and already has several implementations. The friction involved in adopting it is low enough for this to be a minor concern. The benefit is that it helps us move away from complex dependencies like GPG and towards simple ones like minisign/signify that only do what's necessary.

Seirdy 5y ago

> In the Keyoxide case we are only doing signing so that is the only part of the OpenPGP standard that would be applicable. The problem is that PGP does a lot of stuff besides signing too; this is bad design, and is one in a long list of issues with PGP. Its network effect extends to areas where issues like the lack of channel binding and PFS are relevant (e.g. communication platforms): people use the "it's already installed (for something else)" argument far too often to justify using it for something it isn't suited for (most other things). > OpenBSD needed something compatible with the license of the base distribution. The mistake made was that signify was not made to use a preexisting format. So it is an attempt to create a whole new standard in a way that provides no benefit to anyone. Signify's standard is dead simple, and already has several implementations. The friction involved in adopting it is low enough for this to be a minor concern. The benefit is that it helps us move away from complex dependencies like GPG and towards simple ones like minisign/signify that only do what's necessary.