5 ms·

> Fortunately, and this is still not common with free software, we have now established a way of financing the development while keeping all our software free a

> Fortunately, and this is still not common with free software, we have now established a way of financing the development while keeping all our software free and freely available for everyone. > Our model is similar to the way RedHat manages RHEL and Fedora: I looked around the website for a bit and didn't find a blog post or anything indicating what they've replaced the donation revenue stream with. Have they been employed? Are they doing consulting?

kerneis 5y ago
Here is the blog post with the details of how they started making enough money in the recent years: https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html
slashfoo 5y ago
I'm confused as well, it's not clear from that post what the new structure is, or how sustainable, or if there are back-up plans. It just says, that there is a new structure essentially. I'd appreciate it if someone helped me understand, or get more context.
moondev 5y ago
https://gnupg.com/ https://gnupg.com/ via https://gnupg.org/service.html https://gnupg.org/service.html
- dmix 5y ago
  This is good news. Just using gpg isn’t good enough. Knowing how to do it properly is most important. I hope more companies throw money at these guys. Maybe they can even document some of their learnings doing deployments in a blog sort of system to give back to the community.
  - mistrial9 5y ago
    I support some form of FOSS guilds, in moderation; that is, there is knowledge that is documented but not necessarily full, complete tutorial and discussion casually provided. Obviously many companies do this explicitly themselves now with "community documentation" or "public core" and then many other media assets that are not shared widely. This is natural and obvious, with caveats that fairness is inherently difficult, and you can't please everyone. Security practice is certainly the sort of world where that guild behavior can go badly, and many will complain, sometimes falsely. So it goes in the real world. Corporate and government users have been free-riding FOSS to ridiculous levels, in my view, and I welcome some way that actual practitioners can self-organize and at least survive. As opposed to say, divorce, substance abuse and what amounts to financial suicide, which I have seen happen to real people with good intentions and bright minds.
formerly_proven 5y ago
"GnuPG VS-Desktop" has been approved by the BSI for encrypting secret files/messages in the German government (VS=Verschlusssache) so I'm guessing that's where most of the money is coming from.
- vmception 5y ago
  How is that a government contract at all? Sounds like a bullshit handout if anything, and I’ve seen pretty dumb government contracts before. Well whatever works!
  - Schroedingersat 5y ago
    The german government appear to have fairly widely realised that the available options are support open source, or provide free intel to the US.
    - vmception 5y ago
      So instead of using the open source tool themselves they find a reason to capitalize the stewards, hm alright
      - na85 5y ago
        Don't vote for them if you don't like their decisions.
        vmception 5y ago
        I’m not a voter in Germany and I didnt say I didnt like it
        vmception 5y ago
        (at the part you replied to)
  - 5y ago
colechristensen 5y ago
“ GnuPG.com, Düsseldorf, Germany Offers commercial grade support, customized development, porting to new platforms, help with integrating GnuPG into customer projects, code audits, and more. GnuPG.com is a brand of g10code GmbH; owned and run by GnuPG´s and Gpg4win´s principal authors.”
- rectang 5y ago
  There is certainly a need for consultants to help organizations do PGP-style security well. And it doesn't look like they're transforming GnuPG into an open core product model with critical components only available commercially. So, this seems good? It doesn't look like they've been bought by anybody (e.g. a VC) who's going to require the sort of rate of return that can only be attempted (and probably not achieved) by doing things incompatible with GnuPG's role in the open source ecosystem. Not every company has to be huge — GnuPG can have outsized positive impact on the world while remaining small and sustainable.
zikduruqe 5y ago
https://gpgtools.org/support-plan https://gpgtools.org/support-plan maybe?
vmception 5y ago
Is this one of those things where you could technically pay for Winrar, but perhaps should never admit to doing so?

kerneis 5y ago

Here is the blog post with the details of how they started making enough money in the recent years: https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html

slashfoo 5y ago

I'm confused as well, it's not clear from that post what the new structure is, or how sustainable, or if there are back-up plans. It just says, that there is a new structure essentially. I'd appreciate it if someone helped me understand, or get more context.

moondev 5y ago

https://gnupg.com/ https://gnupg.com/ via https://gnupg.org/service.html https://gnupg.org/service.html

dmix 5y ago
This is good news. Just using gpg isn’t good enough. Knowing how to do it properly is most important. I hope more companies throw money at these guys. Maybe they can even document some of their learnings doing deployments in a blog sort of system to give back to the community.
- mistrial9 5y ago
  I support some form of FOSS guilds, in moderation; that is, there is knowledge that is documented but not necessarily full, complete tutorial and discussion casually provided. Obviously many companies do this explicitly themselves now with "community documentation" or "public core" and then many other media assets that are not shared widely. This is natural and obvious, with caveats that fairness is inherently difficult, and you can't please everyone. Security practice is certainly the sort of world where that guild behavior can go badly, and many will complain, sometimes falsely. So it goes in the real world. Corporate and government users have been free-riding FOSS to ridiculous levels, in my view, and I welcome some way that actual practitioners can self-organize and at least survive. As opposed to say, divorce, substance abuse and what amounts to financial suicide, which I have seen happen to real people with good intentions and bright minds.

formerly_proven 5y ago

"GnuPG VS-Desktop" has been approved by the BSI for encrypting secret files/messages in the German government (VS=Verschlusssache) so I'm guessing that's where most of the money is coming from.

vmception 5y ago
How is that a government contract at all? Sounds like a bullshit handout if anything, and I’ve seen pretty dumb government contracts before. Well whatever works!
- Schroedingersat 5y ago
  The german government appear to have fairly widely realised that the available options are support open source, or provide free intel to the US.
  - vmception 5y ago
    So instead of using the open source tool themselves they find a reason to capitalize the stewards, hm alright
    - na85 5y ago
      Don't vote for them if you don't like their decisions.
      - vmception 5y ago
        I’m not a voter in Germany and I didnt say I didnt like it
        vmception 5y ago
        (at the part you replied to)
- 5y ago

colechristensen 5y ago

“ GnuPG.com, Düsseldorf, Germany Offers commercial grade support, customized development, porting to new platforms, help with integrating GnuPG into customer projects, code audits, and more. GnuPG.com is a brand of g10code GmbH; owned and run by GnuPG´s and Gpg4win´s principal authors.”

rectang 5y ago
There is certainly a need for consultants to help organizations do PGP-style security well. And it doesn't look like they're transforming GnuPG into an open core product model with critical components only available commercially. So, this seems good? It doesn't look like they've been bought by anybody (e.g. a VC) who's going to require the sort of rate of return that can only be attempted (and probably not achieved) by doing things incompatible with GnuPG's role in the open source ecosystem. Not every company has to be huge — GnuPG can have outsized positive impact on the world while remaining small and sustainable.

zikduruqe 5y ago

https://gpgtools.org/support-plan https://gpgtools.org/support-plan maybe?

vmception 5y ago

Is this one of those things where you could technically pay for Winrar, but perhaps should never admit to doing so?