4 ms·
I would like to repost a comment from reddit[1] that makes some good points: "That title is pretty laughable. Enterprise E-Mail Encryption solutions do NOT us
by bndr 12y ago
I would like to repost a comment from reddit[1] that makes some good points:
"That title is pretty laughable.
Enterprise E-Mail Encryption solutions do NOT use gnupg, and most enterprise customers do not even use openpgp, they use X.509/SMIME.
I know the world top 10 server side enterprise e-mail encryption solutions and the majority uses java with either bouncycastle or ajak encryption, for PGP or openssl/bouncycastle for SMIME. There are some solutions that use gnupg but those are very small and again - most people do not use openpgp in the business world. Mostly automotive uses it like Porsche, VW etc. for encrypting e-mail traffic.
Gnupg is mostly used for e-mail by your skilled engineers in private or while communicating with kernel developers etc. Either by using enigmail/mutt/command line whatever.
Nothing based on e-mail would "break" if gnupg went missing.
Now lets get back to Mr. Koch - gnupg was sponsored by the German Government - in all these years - Mr. Koch tried to build a consulting company/enterprise solution out of it - but he failed because there were already existing solutions that were far better than anything he could come up with. Moreover asking Mr. Koch to fix specific bugs in gnupg which was as i said sponsored resulted in simply "pay me XXX amount or i wont do it" - thats how Mr. Koch worked.
Ask any code auditor/reviewer worth his salt and he will tell you gnupg is a mess, it is worse than openssl in most cases - why ? Ask Mr. Koch.
I just want to remind everyone carefully judge, before thinking about donating to Mr. Koch or his company. I already noticed he received well over 50k today just because of this false article.
This guy got funding multiple times from the german government for implementing and maintaing gnupg. This was never a fulltime job - adding patches and a few features is what any open source developer does in his free time. Mr. Koch tried to build a business upon this government funded software, and it failed. He already had multiple fundraisers in his careers to keep his company going. Does he deserve your money ? It is not like gnupg would be dead without him - he is not the only one doing anything - there are many developers in the community who are doing their share too.
Arent there other things more deserving of funding than the failed economical existence of one guy ? An open source developer that wants to contribute free software does not need your money to survive! Did Mr. Richard Stallman or Linus Torvalds ever beg people for money because they cant buy their next meal ? Did the BSD Foundation plea to you they cant make days end ? No - they never did - and they still were able to produce free open source software.
Mr. Koch does not deserve your money, if anything successors of him should receive funding if they need to - but not to survive - because they most likely got a real job already and doing this in their free time.
"
[1] http://www.reddit.com/r/programming/comments/2uw2gt/the_worlds_email_encryption_software_relies_on/coc9qxv http://www.reddit.com/r/programming/comments/2uw2gt/the_worl...
- stesch 12y agoThe complete post (not just this comment) was removed. The post had more comments and votes than another (dupe) post but was still removed. (removed) Post with many comments and votes: http://www.reddit.com/r/programming/comments/2uw2gt/the_worlds_email_encryption_software_relies_on/ http://www.reddit.com/r/programming/comments/2uw2gt/the_worl... Post with less comments and votes (at the time): http://www.reddit.com/r/programming/comments/2uvzpa/the_worlds_email_encryption_software_gnupg_relies/ http://www.reddit.com/r/programming/comments/2uvzpa/the_worl...
- stesch 12y agoNow both posts to /r/programming are removed.
- zvrba 12y agoI tried to submit a patch for GnuPG that would enable it to use "proprietary" PKCS#11 smart-cards instead of "open" OpenPGP smart-cards. Line of though being, users may already have S/MIME generated keys on their smart-cards, so why not use the same keys with PGP too? In the end, a key is just a number. The request was refused [1] with ridiculous arguments [1] about PKCS#11 not being "needed in free software world". After that, I started playing with S/MIME and found out it was much more user-friendly than GPG. (After the initial setup.) [1] Here you can find links to relevant threads: http://zvrba.net/software/gpg_pkcs11.html http://zvrba.net/software/gpg_pkcs11.html
- dd9jn 12y agoIt was not about proprietary smartcards but about the proprietary driver software required to use those smartcards. If the vendors would open the specs of their smartcards it would be easy to write a driver. Some did and we support them in GnuPG. Most of them don't and we may even assume they want to hide their little secrets in their drivers. It is all the same as with all the proprietary hardware drivers. Look at decades of LKML for similar discussions.
- zvrba 12y ago