4 ms·
Gnupg is shit but PGP itself is just fine and we recently have more modern and well tested implementations of it now like https://sequoia-pgp.org/ https://sequo
by lrvick 4y ago
Gnupg is shit but PGP itself is just fine and we recently have more modern and well tested implementations of it now like https://sequoia-pgp.org/ https://sequoia-pgp.org/
- conaclos 4y agoThe sq program is not stable yet. right?
- lrvick 4y agoNo, but it is way more tested and stable than GnuPG imo. That said limited smartcard support keeps me from using it yet, but that is in testing and rapidly maturing.
- Toreno96 4y agoWow, it seems promising. Did you have a chance to use their CLI? Is it indeed better (more intuitive, less complex, more idiot-proof) than the GnuPG one?
- megous 4y agoYeah, I'll certainly follow recomendation from someone who starts it with calling a well known successful FOSS project "shit". /s
- speed_spread 4y agoDodge K-cars were well known and succesful. They were also utter shit. Plenty of FOSS projects are of low quality but get adopted because they fulfil a need. Some dont age well. Some have poor docs. Some have insufferable interfaces. It's ok to call them shit. All code is shit anyway. Its just the smell ratio that varies.
- megous 4y agoYeah, sequoia certainly doesn't shine here either, unless you call a dump of sq https://docs.sequoia-pgp.org/sq/ https://docs.sequoia-pgp.org/sq/ help screens a useful user facing documentation. I guess it's a nice library, but it's no replacement for GnuPG. At least GnuPG has an actual user guide, FAQ, etc. with important concepts explained step by step. As a GnuPG user, it would not be hard to switch for simplistic use cases without any specialized HW, I guess. I already know most of the concepts, but for new users,... I wish them luck with sq, lol. Documentation is pretty much nonexistent, and the web page for sq tool just links to library documentation. Rust codebase is not everything.
- lrvick 4y agoIt is a giant aging and super buggy C codebase. I found a serious CVE in it myself on accident any basic test suite would have caught. It was very successful but it is nowhere near the security, documentation, testing, or UX standards of what we would call quality software today.
- megous 4y agoLooks like a typical GNU style C codebase with a few CVEs over the years. https://ubuntu.com/security/cves?q=&package=gnupg https://ubuntu.com/security/cves?q=&package=gnupg Not sure what's the grumbling about UX. Common tasks signing/verifying/encrypting are simple. Key export/import is also straightforward. So for common tasks you learn a few (~6) CLI --options by osmosis. Web of trust/key management stuff is mostly done via interactive UI where you're prompted for what's needed after you invoke some action. Not too bad I guess. Certainly easier to be prompted for what's needed than remembering a ton of random CLI options or fishing through manpages, for tasks that you'll do very infrequently.
- lrvick 4y agoYes. GNU C codebases are not written defensively or with strong test suites (if any) and tend to have piles of serious bugs that take years to spot. I use such tools heavily on a personal basis but I avoid running such things in production I high risk environments at almost all costs. I also thought the same and argued the same about UX until I had to train several large teams to use it, and found myself making piles of shell script wrappers to pacify the majority of modern devs who are intimidated by any CLI commands that do not start with npm or git. PGP is the right spec, IMO. It is just time to shift to more mature implementations that are easier to trust the defaults of and program against. The majority of Sequoia devs are former GnuPG devs btw. They realized the shortest path to a broadly library-first testable codebase, a memory safety, secure default ciphers, etc was starting over.