3 ms·

There are a couple alternatives to GPG being developed right now. One is reop (https://github.com/tedu/reop https://github.com/tedu/reop). The cryptography is

There are a couple alternatives to GPG being developed right now. One is reop (https://github.com/tedu/reop https://github.com/tedu/reop). The cryptography is done by libsodium and it is well-written. Another is NetPGP (http://www.netpgp.com/ http://www.netpgp.com/). The cryptography is done by the OpenPGP SDK. The NetPGP code is well-written but the OpenPGP SDK code looks like OpenSSL. Both are promising and deserve everyone's support.

stormbrew 12y ago
Reop looks exciting, perhaps as being exactly what a "fresh start" should look like. I see the section on not supporting key revocation at all and it worries me, because it seems to me there should be some way to do so. But perhaps the key here is that this particular tool is not trying to solve the key distribution problem, which is a whole other kettle of fish? It is possible that PGP fails partly because it tries to do both. But that does mean that a solution still needs to be found for that problem, even if you switch to reop.
fab13n 12y ago
> OpenPGP SDK code looks like OpenSSL. I wouldn't be surprised to learn that intelligence services sabotage open source crypto projects by helping turning their codebase into an arcane mess, which scares away the million eyeballs which are supposed to make bugs shallow. I've worked on OpenSSL quite a long time ago; I thought they kept it so messy in order to sell their expertise through consulting. At that time, only tinfoil hat folks would have believed that spooks would spend millions sabotaging everything and anything crypto-related... Now I believe that infiltrating open-source SSL / TLS / PGP developper communities is at least as strong a priority as infiltrating terrorist communities for them, so I'm utterly convinced they're trying, and I'd rather bet they succeed.

3 ms·

There are a couple alternatives to GPG being developed right now. One is reop (https://github.com/tedu/reop https://github.com/tedu/reop). The cryptography is

by eliteraspberrie 12y ago

stormbrew 12y ago
Reop looks exciting, perhaps as being exactly what a "fresh start" should look like. I see the section on not supporting key revocation at all and it worries me, because it seems to me there should be some way to do so. But perhaps the key here is that this particular tool is not trying to solve the key distribution problem, which is a whole other kettle of fish? It is possible that PGP fails partly because it tries to do both. But that does mean that a solution still needs to be found for that problem, even if you switch to reop.
fab13n 12y ago
> OpenPGP SDK code looks like OpenSSL. I wouldn't be surprised to learn that intelligence services sabotage open source crypto projects by helping turning their codebase into an arcane mess, which scares away the million eyeballs which are supposed to make bugs shallow. I've worked on OpenSSL quite a long time ago; I thought they kept it so messy in order to sell their expertise through consulting. At that time, only tinfoil hat folks would have believed that spooks would spend millions sabotaging everything and anything crypto-related... Now I believe that infiltrating open-source SSL / TLS / PGP developper communities is at least as strong a priority as infiltrating terrorist communities for them, so I'm utterly convinced they're trying, and I'd rather bet they succeed.