3 ms·

The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start askin

by maqp 9mo ago

The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatures.

singpolyma3 9mo ago
Note that minisign was also vulnerable in the gpg.fail exposures
- woodruffw 9mo ago
  Yes, but not nearly to the same extent. The GPG vulns are staggering in comparison.
- maqp 9mo ago
  All software has bugs. But having a small purpose-built program do one thing well is much smaller attack surface. The Unix philosophy also makes a pretty good security argument.
Avamander 9mo ago
For starters I'd like to see ssh-agent not being replaced with gpg-agent. Those who need it should install it themselves.