17 ms·
Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatur
by agwa 12y ago
Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat.
Here is a link to the donation page: https://gnupg.org/donate/index.html https://gnupg.org/donate/index.html
- gandalfu 12y agoThanks for the link, just donated!
- adl 12y agoGPG is an integral part of the Open and Free internet. Imagine all the workflows that depend on verified encryption signatures like Debian, Ubuntu, etc and that's just software distribution, not counting privacy issues like journalists, political dissidents, whistle blowers, etc using it for secure communications. It was pretty easy to donate, took me less than 2 minutes. I encourage everybody that is able to make a donation, however small, every euro counts.
- malandrew 12y agoMe too. This software is too important to not have someone dedicated to it full time. I left a note that he (like the EFF and the ACLU) should have a recurring donation option, or at least an option to receive a once yearly email asking for a donation. There are many people that would happily go with a recurring donation if that option were available.
- eitland 12y agoThis might be one of a few places where I will upvote "me too"-comments. And, as others have pointed out it is easy and you can choose between cc and PayPal.
- clarkm 12y agoThis is one of the few instances that I've heard about something for the first time and immediately pulled out my credit card to donate.
- tempestn 12y agoDitto. Was just talking with one of my employees this week about setting up encrypted email. Right now we use OTR chat for any sensitive stuff, but that's not always the most convenient channel. Like most others I had no idea this project was so under-funded.
- jgmmo 12y agoMe too.
- 64598u3wieodsk 12y agoMe too! 25EUR. Many thanks for bringing this to my attention
- takluyver 12y agoWatching the bar on the GnuPG homepage is pretty encouraging. Since the article was written, we've donated nearly €30k more. It looks like the problem was that people hadn't heard about it, not that we're all too selfish to donate. I just chipped in $25. Edit: Over €10k more in the hour since this comment. It's now 2/3 of the way to the funding target.
- acqq 12y agoIt still progresses, now (21:47 UTC) only 12% left to the target.
- jpatokal 12y agoTarget exceeded, and I don't think this even includes the EUR 100k from Stripe & Facebook.
- Fuxy 12y agoThis was posted on HN 2 months before I donated £50 at that time so i wouldn't say it didn't get enough exposure. It's just that it takes a lot of media attention to get you to your goal plus a lot of the donations a coming from regular developer who understand the importance of this instead of the big companies profiting from this software.
- eterm 12y ago(me too) Interesting to see more people have donated so far in 2015 than the whole of 2014.
- gcv 12y agoI donated last year, and just donated again. Really happy to see that this post on HN has traction, and delighted to watch the counter go up. GPG and other security projects need a way better tech PR push.
- masmullin 12y agoMe too!
- angersock 12y agoWhat is the simplest program out there right now, open-source, that will let me sign binaries with a key? I'm experimenting to do a dead-simple licensing system using SSL certs and signing--rough idea is, cert is from me, and when it expires, software says "lol no get new cert". I'm sure this has been done before, but the amount of custom license management code I've seen in the wild makes me wonder...
- AlyssaRowan 12y agoProbably OpenBSD's signify. You are of course aware signatures don't solve the licensing problem however, which is a Trusted Client problem (i.e. unsolvable).
- angersock 12y agoI'll check that out. Thank you!
- AlyssaRowan 12y agoBy all means. Ed25519 (which underlies signify) is a pretty decent modern signature scheme. (tweetnacl.c also implements it, in less code.) It also seems you want to expire things, so I do feel I have to warn you that signatures are a totally separate thing to a secure time source, which is a whole different bag of marbles. However, since what you're designing sounds like a logic bomb/copy protection/DRM system, I must say what I've been saying for the last quarter-century or so: please do not design your software to deliberately fail. That is a bad call: trust me on this one. Any crypto that you do to support it, even if the crypto itself is sound, is just tapdancing around a failure state.
- angersock 12y agoSo, use case would be something like: Software is shareware, gets a little naggy within 30 days of license expiration, send money to get a new license file, which makes the nagging go away. No cessation of service. I'm not worried about clock spoofing--I assume basically good-faith customers. Signing would help people from just copy-pasting certificates around. If they want to go into the executable and rewrite the routines, well, there's only so much one can do, yes?
- rmc 12y agoWhy aren't those organisations paying him money?
- hf 12y agoYou are using Ubuntu, I see from your profile. How much have you paid them? This is how the stories goes: we haven't figured out how to make good work worthwhile. Perhaps we can learn something from our vast experience in profitably peddling shit?
- pyre 12y ago> You are using Ubuntu, I see from your profile. How much have you paid them? It's easier for businesses to write off these type donations (and make them for significant amounts) than for private individuals to do so.
- fnordfnordfnord 12y ago>It's easier for businesses Far simpler not to even bother at all.
- deleted 12y ago[deleted]
- briandear 12y agoIf it's a registered non profit you can donate and 'write it off' too. The idea that a 'big company' should do the donating is short sighted. That big company is made up of individuals. If everyone reading this donated $100, the problem posed by the article would disappear.
- pyre 12y agoMy point is that it's probably easier to get a company that is turning a profit off of something to donate a single large sum, than to convince a million people to donate $1.
- peapicker 12y agoSeems odd that the MANY projects dependent on GPG don't donate enough to GPG to employ one guy. Do Free Software project with funding 'pay it forward' to the volunteers on other projects they heavily depend on? (I don't really know) If not, they deserve to suffer the consequences.
- hf 12y agoI freely confess to being flabbergasted by these displays of less-than-rigorous thought processes. How would a free software project 'pay it forward'? They are in a very similar position, aren't they? Edit: For some reason, I can't reply to child comments (probably a cool-off time-out at work?). Just a short note here, then: $1.25e6 for the FSF translates to 10 developers like Koch being paid (the donation page quotes "120000 EUR"). That's ten. For the whole FSF. As an example of a well-funded project. I'm not going to comment on that. HN would rightly give me months of cool-off time.
- sophacles 12y agoThere are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year. These projects are usually end user facing, in a way that their dependencies aren't. It seems reasonable that these projects should consider adding items to their budget to redistribute funds to projects that they depend on. Some probably do this, however I think the GP was suggesting that something like this become more common.
- davidw 12y ago> There are many free software projects that are decently or well funded. Which ones are those?
- copsarebastards 12y agoDebian, Ubuntu, OpenSSH, Firefox, Apache, etc. In addition, some projects that are not well-funded as a project are "funded" in the sense that companies pay people to work on them, for example Microsoft paying Simon Peyton Jones to work on GHC.
- higherpurpose 12y agoShouldn't it be part of that Core Infrastructure Initiative project then?
- agwa 12y agoMatthew Green, who sits on the CII's advisory board, tweeted: "CII does what's beneficial to its members. Privacy tools aren't" [https://twitter.com/matthew_d_green/status/563388993203867649 https://twitter.com/matthew_d_green/status/56338899320386764...] ...which indicates to me that GnuPG wasn't sold properly. It's not just a "privacy tool" -- it's one of the ways that software (including OpenSSL) is securely distributed. I would guess that quite a few of the CII's members benefit from GnuPG and don't even realize it.
- joshstrange 12y agoIn what world are privacy tools not beneficial to the CII? And how does OpenSSL not fall under "privacy tool"??
- rakoo 12y agoGPG's goal is about privacy, while OpenSSL is more of a toolbox with most of the tools you need for anything crypto-related. I imagine those people need to control integrity of the software, to make sure it is deployed correctly on their servers and distributed securely to their clients and users, and OpenSSL has all they need for that. Privacy, OTOH, is unneeded because they are not (or rather much less) after their own or their users' privacy.
- sukilot 12y agoCII is a consortium of consumers of free software, not publishers. If openSSL meds gpg, openssl should spend its funding on gpg. Perhaps via a "Free Core Infrastructure Initiative"
- dankohn1 12y agoThe Linux Foundation's Core Infrastructure Initiative agreed to fund Werner $60,000 several weeks ago for his critical GnuPG work. https://twitter.com/gnupg/status/563456662024228865 https://twitter.com/gnupg/status/563456662024228865
- Lord_Zero 12y agoI dont see a way to contact anyone there. Can they please add bitcoin?
- agwa 12y ago"If you like to donate Bitcoins you may use the Wau Holland Stiftung account too." Link: https://www.wauland.de/en/donation.html#61 https://www.wauland.de/en/donation.html#61
- hf 12y agoThe counter on the kindly linked donation page went from EUR 49.470 to EUR 65.126 in the last 60 minutes (precisely).
- foomoo 12y agoThat's really cool. When people unite... My name isn't even on the list of recent donors anymore, that's going fast! Maybe he'll wake up tomorrow and hit refresh a couple times to be sure there's nothing wrong with the counter, hehe.
- sliverstorm 12y agoOf course on the other hand, it is overstated here too. Email Encryption Software Relies on One Guy Err... did PGP recently go bankrupt? Edit: Crap, it's worse, they seem to have been acquired by Symantec. Is it still any good?
- pdonis 12y agoThanks for the donation link, I just used it. It seems odd to me that an article bemoaning the fact that GnuPG's author is going broke gives no information at all on how to help rectify that condition.
- killertypo 12y agosomething like this is just too important to not donate money to.
- em3rgent0rdr 12y agoWas unware about funding issues. Just donated 20 EUR.
- plainOldText 12y agoAlright. Donated.
- trhway 12y ago> It's also used in countless applications to encrypt data at rest exactly. Given the number of corporate laptops encrypted by the corporate IT with that software , and thus definitely some "license" style good money were paid by the corporations to some entities ... i never believed in the magical concept of trickle down and sounds like it doesn't work here too.