3 ms·

There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. This is a very bad thing, because it is no

There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. This is a very bad thing, because it is not in fact the case that there is one cryptosystem equally suited to all these tasks. That you chose OpenSSL as your corroborating example is especially funny, because there is exactly one thing that OpenSSL is actually well-suited to doing (setting up TLS sessions), and then 20+ years of people getting themselves into grave trouble trying to get that library to do other things.

lrvick 1y ago
You spend a lot of energy steering people away from PGP, but what is your alternative to solve the same problems with the same threat models? What do you want to shift the entire software supply chain security foundation of the internet to use instead and how? Complaining the existing solution is not good enough is easy. Making things better and educating on current best efforts without creating centralized points of trust is hard.
- tptacek 1y ago
  Did you not read the post I linked upthread? You were quite confident in refuting its claims, so I assume we shared an understanding here. Update It looks like you drastically edited your comment after I replied to it, in ways that change the meaning of your prompt. That makes it impossible for us to continue discussing anything.
  - lrvick 1y ago
    I hit send too fast before I was actually done typing/thinking because I was going too fast, and you somehow got a response in seemingly instantly. My bad on this one.
  - johnisgood 1y ago
    > Did you not read the post I linked upthread? Oh THAT is why you are steering people away from OpenPGP, gotchu. I have read it a long time ago. I remain to be convinced. The blog post just reeks of "I can't use it, too complex for me therefore it sucks". Yeah, it can be misused, I do not deny that. (BTW I could not care less about e-mail.)
    - tptacek 1y ago
      That's your comeback? That PGP is too complex for me to use?
      - johnisgood 1y ago
        No? It is what the blog post you linked says, essentially. You linked it. In fact, I said "The blog post just reeks of "I can't use it, too complex for me therefore it sucks"". I do not know if you have written it or not, if you were the one, then yeah.

lrvick 1y ago

You spend a lot of energy steering people away from PGP, but what is your alternative to solve the same problems with the same threat models? What do you want to shift the entire software supply chain security foundation of the internet to use instead and how? Complaining the existing solution is not good enough is easy. Making things better and educating on current best efforts without creating centralized points of trust is hard.

tptacek 1y ago
Did you not read the post I linked upthread? You were quite confident in refuting its claims, so I assume we shared an understanding here. Update It looks like you drastically edited your comment after I replied to it, in ways that change the meaning of your prompt. That makes it impossible for us to continue discussing anything.
- lrvick 1y ago
  I hit send too fast before I was actually done typing/thinking because I was going too fast, and you somehow got a response in seemingly instantly. My bad on this one.
- johnisgood 1y ago
  > Did you not read the post I linked upthread? Oh THAT is why you are steering people away from OpenPGP, gotchu. I have read it a long time ago. I remain to be convinced. The blog post just reeks of "I can't use it, too complex for me therefore it sucks". Yeah, it can be misused, I do not deny that. (BTW I could not care less about e-mail.)
  - tptacek 1y ago
    That's your comeback? That PGP is too complex for me to use?
    - johnisgood 1y ago
      No? It is what the blog post you linked says, essentially. You linked it. In fact, I said "The blog post just reeks of "I can't use it, too complex for me therefore it sucks"". I do not know if you have written it or not, if you were the one, then yeah.