21–30 of 36 posts
> the BSI (Germany's Federal Office for Information Security) migrated back from Linux to Windows I'm curious to hear why the BSI migrated back to Windows, but didn't find anything with a quick search. Any more information on this?
Earlier quoted context omitted.
The concern many have with military involvement in encryption and other security standards is that while they want for themselves exactly what we want for ourselves, they have an internal conflict of interests due to the fact that they want a bit of the exact opposite for other actors¹ which, if those concerns win out and they have the influence to force through or block changes, this could lead security issues² that…
That's why it's a good thing it's a FLOSS solution. Despite a track record of bad code and security, GPG has always been good-willed, and has progressed over the years. For sure having more eyes/resources on the code can only help. Also the recent Sequoia PGP project can prove to be an inspiration for further improvements.
And as other recent issues highlight, open to many eyeballs does not necessarily imply completely robust and secure code.
They partnered with https://en.wikipedia.org/wiki/Rohde_%26_Schwarz - so basically GnuPG is now funded by military auxiliaries…
They are one of the big 3 in this field along with Anritsu and Keysight.
I thought this project was supported by GNU
> the BSI (Germany's Federal Office for Information Security) migrated back from Linux to Windows I'm curious to hear why the BSI migrated back to Windows, but didn't find anything with a quick search. Any more information on this?
Let‘s put it this way: Legacy Software, Office format problems, lack of user training and a heck of money from Microsoft…
> the BSI (Germany's Federal Office for Information Security) migrated back from Linux to Windows I'm curious to hear why the BSI migrated back to Windows, but didn't find anything with a quick search. Any more information on this?
Let‘s put it this way: Legacy Software, Office format problems, lack of user training and a heck of money from Microsoft…
It's not really surprising that a 100b company who specializes in writing software for specific business office-ish use-cases can beat an ad-hoc group of corporate volunteers mostly focused on the developer experience and the server space.
[2] https://www.cryptologie.net/article/502/alternatives-to-pgp/
GnuPG needs to push to update OpenPGP to stay alive. OpenPGP needs to be updated. It lacks modern AEAD (the practical impact of a better authentication might be low in many use cases; but it has become a political problem). The code base and CLI could also be modernized so that developers could easily use its API. Sequoia is doing a good job here. Otherwise, it risks becoming obsolete.
>...the practical impact of a better authentication might be low in many use cases; but it has become a political problem... In the ways that GnuPG is normally used the practical impact is zero because that is not how a stateless, offline protocol works. The content is authenticated by signing it directly, thus avoiding the extra complexity of a stateful connection oriented authentication scheme. The details here: *…
On the one hand, I am glad it finally got the proper funding. On the other hand, I would prefer more effort going into more modern implementations [1] or protocols[2][3]. [1] https://sequoia-pgp.org/ [2] https://www.cryptologie.net/article/502/alternatives-to-pgp/ [3] https://blog.gtank.cc/modern-alternatives-to-pgp/
In my day we used GPG and we liked it. Need to use a smartcard with a GPG key to SSH? well tie an onion to your belt and get ready to pull a standing triple gainer in bash. did you get the password prompt? well now its time to dive further young Padawan. Ease the cover of your X11 book open and pour through the warm inviting text of no fewer than three pinentry programs. balance the PGP and GPG manuals on each knee (thats what the onions for ya goof!) and study the .gpg config, as ed25519 may, or may not even be a PGP standard... perhaps the pin is entered properly in another TTY, so plug in your TTY monitor and get to work! easy as pie. still doesnt work? perhaps you still need to do a subkey cross-signature for your detatched authentication keys? it is now 4 AM which is when most "people" sleep but the prime witching hour for GPG divinations, stay true and persist!
now some people might say "validation and trust" are issues but back in my day we had key signing parties. oh they were all the rage, haughty and formal door-knob licking festivals (pre covid mind you) where you could greet your colleagues balancing a stale cookie on a plate and confirm --in the flesh-- this key was honest, and true and matched perfectly the arabica halitosis of the keyholder as they spittle their way through tales of last years divorce. Did your colleague from brussels get a haircut? hes dead to you now. revoke the key, burn every chair in your home, and seek out his new truth. to the GPG key servers!
and kids now a days will bemoan "keysevers!" rubbish. why, theres no more telltale glory than to sit at the helm of a CGI web form from 1991 as its calcified backend tucked deep in the bowels of some learn-a-torium lurches along the SUNOS disk platters querying an ocean, NAY, a veritable drowning pool of old keys of yore from anyone and anything. the mirthful chuckle from your first 512 bit key 17 years ago will sustain you! as you begin encrypting your message in no fewer than the seven keys listed for the faculty member to wihch you wish to divulge your nanas fudge recipe.