3 ms·

> Today you can do all this with GnuPG though admittedly this is a rotting, buggy, and badly maintained c codebase. I don't understand why this would be called

> Today you can do all this with GnuPG though admittedly this is a rotting, buggy, and badly maintained c codebase. I don't understand why this would be called "rotting". Sure, it's old, but it's actively maintained by its original author, a Gmbh has been established around its maintenance and it retains a few developers for the purpose. We do not call the Linux operating system rotting, which is a project in a similar position to gpg, nor do we call the git project rotting. All of these are old C code bases but are actively maintained. They are in c, but they've squashed a lifetime's worth of bugs. Git is notoriously bad on the command line to use, but we still use both gpg and git because they're both useful and super stable. Calling something rotting just because it's not written in Rust ignores the years and years that their maintainers have put into it. This is to say nothing of geopolitics. It's difficult for Europe to trust anything made in America. It was for this reason that Richard Stallman encouraged Germans to make encryption software, the import of which America allowed but the import of American encryption software in the Germany was illegal. This is why Werner Koch started gpg. Sequoia seems to be made by a foundation based in America. I doubt a significant following in Europe will pick it up. Too often this sensitive topic is ignored, particularly with regard to encryption. Just recently gitea was taken over by an American corporation. The project was soft forked because the community was outraged. But they didn't change the license to AGPL, they just maintain the soft fork under a European company. The problem clearly isn't the license then, it's the country of origin. And that's just for source control. Using the original gpg is a great way to show more international unity, but we all know that's a secondary reason to use software. The primary reason is that it's a quality piece of work that will be very difficult to reproduce.

worksonmine 4y ago
> It's difficult for Europe to trust anything made in America. It was for this reason that Richard Stallman encouraged Germans to make encryption software, the import of which America allowed but the import of American encryption software in the Germany was illegal. This is why Werner Koch started gpg. Nitpicking but I think you got this part the wrong way around. The US had export restrictions on encryption including PGP so Europe had to create their own.
- djha-skin 4y ago
  Thank you for this.
lrvick 4y ago
GnuPG is a large C codebase and CVEs are readily found simply because of poor testing, poor abstractions, etc. C codebases are also very expensive to review for things like memory safety. As just one example I filed CVE-2018-9234 myself which allowed me to violate key usage restrictions which is pretty fundamental and just did not have a test. Much of the core development team of GnuPG left to work on the Sequoia Rust rewrite which is IMO already much better tested than GnuPG for the features that have parity. Also, it is rust, so memory safety you mostly get for free. They even went as far as to implement three different backends for crypto primitives to easily test they all behave the same way. https://tests.sequoia-pgp.org/ https://tests.sequoia-pgp.org/ Honestly once Sequioa finishes smartcard support and chameleon (gpg cli emulator), then GnuPG should be deprecated IMO.
deknos 4y ago
> I don't understand why this would be called "rotting". Sure, it's old, but it's actively maintained by its original author, a Gmbh has been established around its maintenance and it retains a few developers for the purpose. It is called rotting, because quite a few times critical vulnerabilities were found, but even former members of the GnuPG project could not convince Werner Koch to fix it before publication. Werner Koch also withholds updating the OpenPGP standard to make it up2date for current threatmodels. He's basically holding GnuPG hostage at that point and that threatens security. Sequoia tries to fix this, but Werner Koch does not want to change anything apparently. > This is to say nothing of geopolitics. It's difficult for Europe to trust anything made in America. It was for this reason that Richard Stallman encouraged Germans to make encryption software, the import of which America allowed but the import of American encryption software in the Germany was illegal. This is why Werner Koch started gpg. Sequoia seems to be made by a foundation based in America. I doubt a significant following in Europe will pick it up. Neither the NLlabs or the p=p foundation are set in america. Both are european efforts and in part paid by the european council. This is just FUD what you are telling here. > Using the original gpg is a great way to show more international unity, but we all know that's a secondary reason to use software. The primary reason is that it's a quality piece of work that will be very difficult to reproduce. Well, that is the same with sequoia which is basically made mostly by europeans which make much less money than all the consultants which produce daily cloudstuff which does not generate any value for society than taxes. to be honest, you should get your facts straight before telling FUD about seqouia.

worksonmine 4y ago

> It's difficult for Europe to trust anything made in America. It was for this reason that Richard Stallman encouraged Germans to make encryption software, the import of which America allowed but the import of American encryption software in the Germany was illegal. This is why Werner Koch started gpg. Nitpicking but I think you got this part the wrong way around. The US had export restrictions on encryption including PGP so Europe had to create their own.

djha-skin 4y ago
Thank you for this.

lrvick 4y ago

GnuPG is a large C codebase and CVEs are readily found simply because of poor testing, poor abstractions, etc. C codebases are also very expensive to review for things like memory safety. As just one example I filed CVE-2018-9234 myself which allowed me to violate key usage restrictions which is pretty fundamental and just did not have a test. Much of the core development team of GnuPG left to work on the Sequoia Rust rewrite which is IMO already much better tested than GnuPG for the features that have parity. Also, it is rust, so memory safety you mostly get for free. They even went as far as to implement three different backends for crypto primitives to easily test they all behave the same way. https://tests.sequoia-pgp.org/ https://tests.sequoia-pgp.org/ Honestly once Sequioa finishes smartcard support and chameleon (gpg cli emulator), then GnuPG should be deprecated IMO.

deknos 4y ago

> I don't understand why this would be called "rotting". Sure, it's old, but it's actively maintained by its original author, a Gmbh has been established around its maintenance and it retains a few developers for the purpose. It is called rotting, because quite a few times critical vulnerabilities were found, but even former members of the GnuPG project could not convince Werner Koch to fix it before publication. Werner Koch also withholds updating the OpenPGP standard to make it up2date for current threatmodels. He's basically holding GnuPG hostage at that point and that threatens security. Sequoia tries to fix this, but Werner Koch does not want to change anything apparently. > This is to say nothing of geopolitics. It's difficult for Europe to trust anything made in America. It was for this reason that Richard Stallman encouraged Germans to make encryption software, the import of which America allowed but the import of American encryption software in the Germany was illegal. This is why Werner Koch started gpg. Sequoia seems to be made by a foundation based in America. I doubt a significant following in Europe will pick it up. Neither the NLlabs or the p=p foundation are set in america. Both are european efforts and in part paid by the european council. This is just FUD what you are telling here. > Using the original gpg is a great way to show more international unity, but we all know that's a secondary reason to use software. The primary reason is that it's a quality piece of work that will be very difficult to reproduce. Well, that is the same with sequoia which is basically made mostly by europeans which make much less money than all the consultants which produce daily cloudstuff which does not generate any value for society than taxes. to be honest, you should get your facts straight before telling FUD about seqouia.