3 ms·
I think it would be more accurate (and more helpful) to say that the two factions in the OpenPGP standards schism[1] have pulled away from the idea of consensus
by upofadown 10mo ago
I think it would be more accurate (and more helpful) to say that the two factions in the OpenPGP standards schism[1] have pulled away from the idea of consensus. There is a fundamental philosophical difference here. The LiberePGP faction (GnuPGP) is following the traditional PGP minimalism when it comes to changes and additions to the standard. The RFC-9580 faction (Sequoia) is following a kind of maximalist approach where any potential issue might result in a change/addition.
Fortunately, it turned out that there wasn't anything particularly wrong with the current standards so we can just do that for now and avoid the standards war entirely. Then we will have interoperability across the various implementations. If some weakness comes up that actually requires a standards change then I suspect that consensus will be much easier to find.
[1] https://articles.59.ca/doku.php?id=pgpfan:schism https://articles.59.ca/doku.php?id=pgpfan:schism
- tptacek 10mo agoI'm sure getting a "nothing's particularly wrong with the current standards" vibe from this talk.
- singpolyma3 10mo agoThe talk doesn't even cover anything from the current afaict
- tptacek 10mo agoI believe that's incorrect but we may be referring to different things as "current".
- upofadown 10mo agoSome of these are suggesting that an attacker might trick the victim into decrypting a message before sending to the attacker. If that is really the best sort of attack you can do against PGP then, yeah, that is the kind of vibe you might get.