gpg is crucial software, find a hole and you get your name in lights. I assume security researchers are looking at it all the time. Here's what they've found l

gpg is crucial software, find a hole and you get your name in lights. I assume security researchers are looking at it all the time. Here's what they've found lately: CVE-2014-4617 (DOS only) CVE-2013-4576 (RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis -- awesome, but not exactly practical) CVE-2013-4402 (DOS only) CVE-2013-4242 (RSA side channel attack) CVE-2012-6085 (invalid keys could corrupt memory) -- 5 years with not a single security hole -- CVE-2007-1263 (bug in signed message verification) Compare this with the security history of the browser you are using to view this comment, and weep..