5 ms·

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP

by jjice 2y ago

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just use it and expect you to have it" kind of standard.

ReptileMan 2y ago
>just "my script might just use it and expect you to have it" That is one path to standardizing something - using it.
- 0cf8612b2e1e 2y ago
  Chicken and egg problem. People use sh/bash because it is everywhere and standard. Requires energy to justify using an objectively superior tool if it is not default installed. I would love if I could count on Just, fish, ripgrep, or any other multitude of tools that improve upon these CLI apis that were invented ad hoc and ossified in the 70s. Paved a lot of cow paths.
  - dolmen 2y ago
    Perl is everywhere, standard (there is a single implementation, with a strong culture of backward compatibility) and an objectively superior tool.
packetlost 2y ago
Isn't POSIX userspace mostly standardized? We should be pretty conservative with what goes into such a standard, but something like age and jq IMO meet that level of utility to justify it.
- jjice 2y ago
  Yeah POSIX standardizes a bunch of tools, mostly the ones you'd expect (cut, cat, file, etc). I agree with the conservative standardization for the most part, but I selfishly would love these more niche tools to be available on a fresh box. Good point though, I just want to be a little lazier in my script writing I guess :) I've always used this site as reference: https://pubs.opengroup.org/onlinepubs/9699919799/ https://pubs.opengroup.org/onlinepubs/9699919799/
  - packetlost 2y ago
    I guess distros are the next layer over POSIX standard. Distributions have the ability to, mostly arbitrarily, select the default packages they ship in their releases.
upofadown 2y ago
Doing one thing and doing it well is all and good, but most people are not interested in having to manually mess around with up to 4 raw keys in the pursuit of that. That's particularly true if you are doing pipes and you don't have any good place to put all those keys. Most of the time you want to go: gpg --sign --encrypt file ... and be done with it.
- tptacek 2y ago
  This is a little vacuous. Why are you signing? Why are you encrypting? Those are different operations. What are you trying to accomplish? The biggest problem with PGP is that its most popular use cases tend to be people bodging this old clanking command line tool into cryptosystems that (a) PGP wasn't designed for and (b) purpose-built cryptosystems are much better at. One of the reasons age is so constrained is that the problems best served by direct simple file encryption are quite narrow.
  - upofadown 2y ago
    >Why are you encrypting? In any case I can think of, people encrypt things because they want to restrict who can know what those things are. >Why are you signing? In the context of encrypted files, you would sign because you want to know if an attacker has modified or more simply just replaced your file. Authenticated encryption is considered more or less standard these days. >Those are different operations. Except for niche applications like password storage, most people want/need authentication. Giving someone a raw encryption utility like Age is almost always going to result in a situation where that user is not protected against modification/replacement when they do asymmetrical encryption. That is assuming that they can figure out the keys for even just the encryption.
    - arcxi 2y ago
      sign&encrypt does not protect you either, and asymmetrical encryption is authenticated if you keep your recipient key a secret. see https://words.filippo.io/dispatches/age-authentication/ https://words.filippo.io/dispatches/age-authentication/
abdusco 2y ago
Could zipping the file with a password work as an encryption?
Omnikron13 2y ago
People might assume you have ripgrep, or fd, I suppose? Ultimately, though, I think the importance of having a guarantee that the OS has the complete built-in 'swiss army chainsaw' (to borrow a Perl-ism) just isn't as high priority in the age of modern package managed, dependency graphed, fibre connected always online systems vs. big monolithic beasts that you maybe 'make install' the odd extra piece of software you heard about on usenet, once the 300 baud modem is done bleep-blooping out the source from the CVS repository. =P That said, we do get new toys, right up to the kernel level; compression algorithms like zstd, hashing algorithms like xxhash, the slow & steady (glacial?) advance of BTRFS features... If there is demand for something like age, you'd expect it'll filter through into the base of distros, become 'de facto standard', glom onto the kernel, etc. etc. like other stuff people find useful and want, no? (Even if not, it's written in go, so... 'go install filippo.io/age/cmd/...@latest'? =d Issues aside, modern lang-specific package managers make it stupidly easy to grab software these days.)

by jjice 2y ago

ReptileMan 2y ago

>just "my script might just use it and expect you to have it" That is one path to standardizing something - using it.

0cf8612b2e1e 2y ago
Chicken and egg problem. People use sh/bash because it is everywhere and standard. Requires energy to justify using an objectively superior tool if it is not default installed. I would love if I could count on Just, fish, ripgrep, or any other multitude of tools that improve upon these CLI apis that were invented ad hoc and ossified in the 70s. Paved a lot of cow paths.
- dolmen 2y ago
  Perl is everywhere, standard (there is a single implementation, with a strong culture of backward compatibility) and an objectively superior tool.

packetlost 2y ago

Isn't POSIX userspace mostly standardized? We should be pretty conservative with what goes into such a standard, but something like age and jq IMO meet that level of utility to justify it.

jjice 2y ago
Yeah POSIX standardizes a bunch of tools, mostly the ones you'd expect (cut, cat, file, etc). I agree with the conservative standardization for the most part, but I selfishly would love these more niche tools to be available on a fresh box. Good point though, I just want to be a little lazier in my script writing I guess :) I've always used this site as reference: https://pubs.opengroup.org/onlinepubs/9699919799/ https://pubs.opengroup.org/onlinepubs/9699919799/
- packetlost 2y ago
  I guess distros are the next layer over POSIX standard. Distributions have the ability to, mostly arbitrarily, select the default packages they ship in their releases.

upofadown 2y ago

Doing one thing and doing it well is all and good, but most people are not interested in having to manually mess around with up to 4 raw keys in the pursuit of that. That's particularly true if you are doing pipes and you don't have any good place to put all those keys. Most of the time you want to go: gpg --sign --encrypt file ... and be done with it.

tptacek 2y ago
This is a little vacuous. Why are you signing? Why are you encrypting? Those are different operations. What are you trying to accomplish? The biggest problem with PGP is that its most popular use cases tend to be people bodging this old clanking command line tool into cryptosystems that (a) PGP wasn't designed for and (b) purpose-built cryptosystems are much better at. One of the reasons age is so constrained is that the problems best served by direct simple file encryption are quite narrow.
- upofadown 2y ago
  >Why are you encrypting? In any case I can think of, people encrypt things because they want to restrict who can know what those things are. >Why are you signing? In the context of encrypted files, you would sign because you want to know if an attacker has modified or more simply just replaced your file. Authenticated encryption is considered more or less standard these days. >Those are different operations. Except for niche applications like password storage, most people want/need authentication. Giving someone a raw encryption utility like Age is almost always going to result in a situation where that user is not protected against modification/replacement when they do asymmetrical encryption. That is assuming that they can figure out the keys for even just the encryption.
  - arcxi 2y ago
    sign&encrypt does not protect you either, and asymmetrical encryption is authenticated if you keep your recipient key a secret. see https://words.filippo.io/dispatches/age-authentication/ https://words.filippo.io/dispatches/age-authentication/

abdusco 2y ago

Could zipping the file with a password work as an encryption?

Omnikron13 2y ago

People might assume you have ripgrep, or fd, I suppose? Ultimately, though, I think the importance of having a guarantee that the OS has the complete built-in 'swiss army chainsaw' (to borrow a Perl-ism) just isn't as high priority in the age of modern package managed, dependency graphed, fibre connected always online systems vs. big monolithic beasts that you maybe 'make install' the odd extra piece of software you heard about on usenet, once the 300 baud modem is done bleep-blooping out the source from the CVS repository. =P That said, we do get new toys, right up to the kernel level; compression algorithms like zstd, hashing algorithms like xxhash, the slow & steady (glacial?) advance of BTRFS features... If there is demand for something like age, you'd expect it'll filter through into the base of distros, become 'de facto standard', glom onto the kernel, etc. etc. like other stuff people find useful and want, no? (Even if not, it's written in go, so... 'go install filippo.io/age/cmd/...@latest'? =d Issues aside, modern lang-specific package managers make it stupidly easy to grab software these days.)