Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

91–100 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#91

Post by 0cf8612b2e1e »

ReptileMan wrote: post #79
jjice wrote: post #78

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just us…

>just "my script might just use it and expect you to have it" That is one path to standardizing something - using it.

Chicken and egg problem. People use sh/bash because it is everywhere and standard. Requires energy to justify using an objectively superior tool if it is not default installed.

I would love if I could count on Just, fish, ripgrep, or any other multitude of tools that improve upon these CLI apis that were invented ad hoc and ossified in the 70s. Paved a lot of cow paths.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#92

Post by kitd »

thaumasiotes wrote: post #38
kitd wrote: post #10

> The author pronounces it [aɡe̞] with a hard g, like GIF Lol, or 'git' according to one of my more sensitive colleagues.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G.

It certainly was when I heard it.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#93

Post by tptacek »

upofadown wrote: post #85
jjice wrote: post #78

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just us…

Doing one thing and doing it well is all and good, but most people are not interested in having to manually mess around with up to 4 raw keys in the pursuit of that. That's particularly true if you are doing pipes and you don't have any good place to put all those keys. Most of the time you want to go: gpg --sign --encrypt file ... and be done with it.

This is a little vacuous. Why are you signing? Why are you encrypting? Those are different operations. What are you trying to accomplish? The biggest problem with PGP is that its most popular use cases tend to be people bodging this old clanking command line tool into cryptosystems that (a) PGP wasn't designed for and (b) purpose-built cryptosystems are much better at.

One of the reasons age is so constrained is that the problems best served by direct simple file encryption are quite narrow.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#94

Post by tptacek »

qyckudnefDi5 wrote: post #90

I know there are specialized backup tools like restic or borg, but I like to keep things simple. Is using age like this to encrypt my files before uploading them to untrusted cloud storage not ok? tar > age > cloud Some comments mention signing with minisign. Should I be doing that like this: tar > age > minisign > cloud

Use specialized backup tools! There are cryptographic constructions designed specifically for backup. You will get better backup and better encryption.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#95

Post by WhyNotHugo »

qyckudnefDi5 wrote: post #90

I know there are specialized backup tools like restic or borg, but I like to keep things simple. Is using age like this to encrypt my files before uploading them to untrusted cloud storage not ok? tar > age > cloud Some comments mention signing with minisign. Should I be doing that like this: tar > age > minisign > cloud

If you make a second backup tomorrow, you'll end up with a new (huge) encrypted tar. restic handles deltas when creating a second backup, and writes new files so that tools like rsync or rclone have to do less work to upload the new data.

That said, I don't see anything strictly _wrong_ with your approach.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#96

Post by quectophoton »

bpicolo wrote: post #77
quectophoton wrote: post #22

Earlier quoted context omitted.

Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.

The library is out in the world. Audit at will. Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile > Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtua…

I'm no cryptographer so I might be misunderstanding how all this works (also why I have to rely on whatever signal I can catch instead of just reviewing the code myself like with other more mundane dependencies), but it was my impression that in cryptography things were to be considered with skepticism until at least someone else (emphasis on "someone else") with good enough credentials/skills had attempted to break it at least once.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#97

Post by qyckudnefDi5 »

WhyNotHugo wrote: post #95
qyckudnefDi5 wrote: post #90

I know there are specialized backup tools like restic or borg, but I like to keep things simple. Is using age like this to encrypt my files before uploading them to untrusted cloud storage not ok? tar > age > cloud Some comments mention signing with minisign. Should I be doing that like this: tar > age > minisign > cloud

If you make a second backup tomorrow, you'll end up with a new (huge) encrypted tar. restic handles deltas when creating a second backup, and writes new files so that tools like rsync or rclone have to do less work to upload the new data. That said, I don't see anything strictly _wrong_ with your approach.

No deduplication is a tradeoff I'm willing to make for simplicity and less things that can go wrong :)

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#98

Post by eximius »

quectophoton wrote: post #96
bpicolo wrote: post #77

Earlier quoted context omitted.

The library is out in the world. Audit at will. Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile > Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtua…

I'm no cryptographer so I might be misunderstanding how all this works (also why I have to rely on whatever signal I can catch instead of just reviewing the code myself like with other more mundane dependencies), but it was my impression that in cryptography things were to be considered with skepticism until at least someone else (emphasis on "someone else") with good enough credentials/skills had attempted to break…

Because the vast majority of new works are not done by one of the few who would be qualified to check it.

You can think of the cryptography community as similar to the math community. If some nobody makes a new proof of a big conjecture, it is considered with skepticism until some big name comes around to verify it. If Terence Tao comes out with a new proof in one of his specialities, people are going to assume it's basically correct or will have only very minor errors that are easily fixed.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#99

Post by qyckudnefDi5 »

tptacek wrote: post #94
qyckudnefDi5 wrote: post #90

I know there are specialized backup tools like restic or borg, but I like to keep things simple. Is using age like this to encrypt my files before uploading them to untrusted cloud storage not ok? tar > age > cloud Some comments mention signing with minisign. Should I be doing that like this: tar > age > minisign > cloud

Use specialized backup tools! There are cryptographic constructions designed specifically for backup. You will get better backup and better encryption.

"Better backup" aside, as I understand that I'd miss out on deduplication and all the other things backup software can do like keeping track of what it has backed up etc.

"Better encryption": Can you explain why age's encryption isn't sufficient if it's recommended for encrypting files? Really want to understand how it's recommended for encrypting and sharing a file over an untrusted channel like email, but not recommended to encrypt a file and upload it to an untrusted server.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#100

Post by qyckudnefDi5 »

FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Have you considered writing passage in Go to integrate age and age-plugin-yubikey as a single binary to make it more convenient to setup and use?
Post reply on HN