27 ms·
GnuPG used to ask for your support to help protect online privacy
- einpoklum 5y agoIsn't it weird that some companies are willing to pay for just the brand? Or - is it perceived as a form of corporate sponsorship?
- ralph84 5y ago> Except for the actual binary of the MSI installer for Windows and client specific configuration files, all the software is available under the GNU GPL and other Open Source licenses. They’re paying for a Windows installer. Building Windows code from source is not something most Windows users are capable of.
- einpoklum 5y agoBut can't you just build an MSI installer from sources, then distribute that to users? Like you can build .deb/.rpm or flatpak packages on Linux?
- NotEvil 5y agoYou can, but then you won't have any support and any integration stuff the commercial one might
- tgsovlerkhgsel 5y agoWithout the government certification, that's worthless if you need a certified solution. Hence, those companies will pay.
- DarylZero 5y ago> Those with SEPA donations, please cancel them and redirect your funds to other projects which are more in need of financial support. The donations done via Stripe or PayPal have already been canceled.
- rectang 5y ago> Fortunately, and this is still not common with free software, we have now established a way of financing the development while keeping all our software free and freely available for everyone. > Our model is similar to the way RedHat manages RHEL and Fedora: I looked around the website for a bit and didn't find a blog post or anything indicating what they've replaced the donation revenue stream with. Have they been employed? Are they doing consulting?
- kerneis 5y agoHere is the blog post with the details of how they started making enough money in the recent years: https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html
- slashfoo 5y agoI'm confused as well, it's not clear from that post what the new structure is, or how sustainable, or if there are back-up plans. It just says, that there is a new structure essentially. I'd appreciate it if someone helped me understand, or get more context.
- moondev 5y agohttps://gnupg.com/ https://gnupg.com/ via https://gnupg.org/service.html https://gnupg.org/service.html
- dmix 5y agoThis is good news. Just using gpg isn’t good enough. Knowing how to do it properly is most important. I hope more companies throw money at these guys. Maybe they can even document some of their learnings doing deployments in a blog sort of system to give back to the community.
- mistrial9 5y agoI support some form of FOSS guilds, in moderation; that is, there is knowledge that is documented but not necessarily full, complete tutorial and discussion casually provided. Obviously many companies do this explicitly themselves now with "community documentation" or "public core" and then many other media assets that are not shared widely. This is natural and obvious, with caveats that fairness is inherently difficult, and you can't please everyone. Security practice is certainly the sort of world where that guild behavior can go badly, and many will complain, sometimes falsely. So it goes in the real world. Corporate and government users have been free-riding FOSS to ridiculous levels, in my view, and I welcome some way that actual practitioners can self-organize and at least survive. As opposed to say, divorce, substance abuse and what amounts to financial suicide, which I have seen happen to real people with good intentions and bright minds.
- BMorearty 5y agoVery confusing post. It doesn’t explain how they are now making money--which is probably relevant for some folks to trust them to protect online privacy.
- flatiron 5y agoThey used to ask for donations. They still do, but they used to too. /s
- 0xJRS 5y agorest in peace, Mitch
- fishtoaster 5y agoI think they did explain it, although I had to read it a few times to find it. If I understand correctly, they're charging for "the actual binary of the MSI installer for Windows and client specific configuration files." It sounds like they're doing so under the name "GnuPG VS-Desktop." I think it's related to selling services through https://gnupg.com/gnupg-desktop.de.html https://gnupg.com/gnupg-desktop.de.html, but I'm not entirely sure.
- repomies69 5y agohttps://gnupg.org/service.html https://gnupg.org/service.html
- seanieb 5y agoIs PGP a zombie technology that won’t ever die because there are organizations that have nailed their identity to it? (For everything you think you should use PGP for please use Age - https://github.com/FiloSottile/age https://github.com/FiloSottile/age)
- nitrogen 5y agoIs calling the main player in a space a zombie technology a zombie promotional strategy for unknown upstarts? Seems like such an old pattern.
- CiPHPerCoder 5y agoCalling age an unknown upstart is a weird take.
- ameliaquining 5y agoEh, it's pretty new, and new cryptosystems are often more likely to have vulnerabilities. It's still safer than PGP, but that's not a high bar. Hopefully over the coming years it will become more widely used and scrutinized with few vulnerabilities reported, in which case it will then be more clearly safe to rely on.
- someguydave 5y agoage is hardly a complete replacement for GPG
- CiPHPerCoder 5y agoA "complete replacement" for GPG would be a dumb idea to begin with. You want a specific tool for each of these use-cases. Choose one from the list for each use case. 1. Private messaging: Signal, WhatsApp, Cwtch 2. File encryption: age 3. Encrypted backups: age + a Reed-Solomon encoder for catching flipped bits 4. Digital signatures: minisign, signify, OpenSSH signatures The problem with GPG (and with PGP in general) is it tried to do too many things. Complexity is the enemy of security.
- deknos 5y agowell then, redirect your funds to sequoia-pgp.org then. they make a good alternative, which is more secure than gpg. several former gnupg developers work on that as werner did not want to work on citrical issues back then.
- zikohh 5y agoI've always found it annoying that there isn't a properly supported python package for gnupg. There were like two or three forks that were maintained properly but each one had its "time". It's very confusing for people to begin with using PGP since you have to understand which one to use and the history and why they all exists. A lot of fuss if you ask me.
- ArchOversight 5y agoMost of the Python packages for GPG just shell out to gnupg, which is not really the greatest API.
- tptacek 5y agoWe can use stronger terms here --- whatever else you think of PGP, the shell-out stdio "api" for PGP is dangerous (GnuPG will release unauthenticated ciphertext to "callers" of that API, with a warning you need to catch). This API was responsible for the Efail bugs --- which were horrible --- a few years ago. Don't ever do this.
- zikohh 5y agoAgreed, but the problem here isn't provided by the caller, but it's by the python package that claims it's an api to GnuPG.
- franga2000 5y agoHow is that any more dangerous than a "real" library doing the same? Your code would still have to check whether the message passed the integrity check or not, just like it has to look for the warning on stderr. I can't imagine why doing a stream search for i.e. "WARNING: Verification failed!" is any less secure than checking result.verificationPassed (assuming the CLI messages won't change, which they won't since they're basically an API).
- tptacek 5y agoReal libraries wouldn't do the same thing.
- tptacek 5y agoThis is good; donating to GnuPG was not an especially effective way of protecting at-risk users, and it's better that the project be supported by the niche userbase (apparently: the German government) that actually uses PGP in 2021, rather than trying to make a social cause out of a (pretty controversial) file format.
- rectang 5y agoI think there are multiple reasons it's good. It's good for security as you've articulated. It's also good as an example of sustainable open source development via the consulting model. We've seen a lot of hand-wringing about FOSS funding lately. It may not be as flashy or high-profile as VC-funded open core projects with all their ubiquitous marketing, beautiful websites, and submarine PR. But it's a way to make a living by exchanging useful value in exchange for moderate fees, rather than asking for charity or signing up for an unsustainable investment deal.
- tptacek 5y agoI agree. That seems like the real story here, and it's good that the top of this thread is still about the funding mechanics at play here and not another endless relitigation of the (contested) value of PGP itself. (Not that I've shied away from that downthread.)
- SloopJon 5y agoThis is a nice turnaround from 2015: > Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded. https://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-broke https://www.propublica.org/article/the-worlds-email-encrypti... https://news.ycombinator.com/item?id=9003791 https://news.ycombinator.com/item?id=9003791 Recall that this was in the wake of Heartbleed, a vulnerability that exposed our dependence on OpenSSL, another critical, and chronically underfunded project. The project got a nice boost after that article, leading to this Ars Technica story about the windfall: > Given the ramshackle state of massive GnuPG code base, it's not clear what's the best path forward. http://arstechnica.com/security/2015/02/once-starving-gnupg-crypto-project-gets-a-windfall-but-can-it-be-saved/ http://arstechnica.com/security/2015/02/once-starving-gnupg-... https://news.ycombinator.com/item?id=9011138 https://news.ycombinator.com/item?id=9011138 Nonetheless, a fundraising campaign followed just two years later. It turns out that $150K isn't actually that much of a windfall.
- aborsy 5y agoComparing the list of CVEs for major cryptographic software OpenSSL, OpenVPN, OpenSSH and GnuPG implementation of OpenPGP, GnuPG has stood up pretty well for three decades: https://www.cvedetails.com/vendor/4711/Gnupg.html https://www.cvedetails.com/vendor/4711/Gnupg.html The main shortcoming of OpenPGP standard is lack of modern authentication. It has MDC, which works in most cases, but isn’t best practice nowadays. There is an update to RFC4880 in progress, RFC4880bis draft, which is presumably considered by sequoia-gpg. The file format is also apparently disliked by some people, but end users care about results. If RFC4880bis is standardized, the gap between OpenPGP and alternatives is closed. Then, using a heavily audited standard and code is preferred. I read GnuPG is used by organizations requiring high security, eg, intelligence agencies, NSA, state-level actors (presumably shadow brokers etc), banks etc. It’s still good to have competing options. But let’s focus on facts.
- CiPHPerCoder 5y ago> GnuPG has stood up pretty well for three decades Make sure you also look for libgcrypt, which had a lot of cryptographic weaknesses in the 2010s. https://www.cvedetails.com/vulnerability-list/vendor_id-4711/product_id-25777/Gnupg-Libgcrypt.html https://www.cvedetails.com/vulnerability-list/vendor_id-4711...
- tptacek 5y agoThis does not look like an especially reassuring track record! People should keep in mind that GnuPG is a legacy C codebase. Nobody would implement a tool like GnuPG in 2021 the way GnuPG is implemented; we accept its implementation because of path dependency, not because it's especially sound. I don't think your supposition that GnuPG is beloved of "NSA and state-level actors" really qualifies as "facts". The industry standard "secure email" system for banks is simply a TLS web interface that you post your emails to; banks don't use PGP for secure communications. I haven't, of course, worked for all the banks, so if you've got a counterexample, please provide those facts for us to evaluate. Obviously, the documentation of a proposed design for AEAD support in an RFC doesn't close the gap --- users care about results, as you say, and so what matters, to the exclusion of all else --- is what the installed base of GnuPG clients supports. Which is why Sequoia's years of support of (I think?) EAX mode AEAD encryption hasn't moved the needle for the moribund PGP ecosystem.
- tgsovlerkhgsel 5y agoGPG is severely hampered by two issues: 1. a lack of good support via an API/libraries (the standard way to communicate with it seemed to be shelling out to the binary and trying to parse its output for a long time) 2. terrible UX, especially around the trust model - web of trust is great in theory and for geeks but doesn't work well in practice, and the terms used to explain it invited dangerous misinterpretations (to mark a key as trusted in the sense of "I verified that this fingerprint belongs to that person", you're expected to sign it, NOT mark it as "trusted" - the latter actually causes all keys signed by that key to be trusted, making it a "CA"). These may be addressed by now, but I think this is too little too late.
- deleted 5y ago[deleted]
- eknkc 5y agoI dont think those are addressed now. I needed gpg for the first time recently. After fiddling with documentation and weird terms, approaches etc I decided it is not worth whatever it does. My time would be better spent if I learned how to knit or something.