Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

121–130 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#121

Post by Ferret7446 »

klabb3 wrote: post #21
quectophoton wrote: post #19

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.

Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.

What if the author has become malicious or is being blackmailed? N+1, N+2 is a common expectation in many fields (science replication, all manner of independent audits/investigations, nuclear launch codes, etc).

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#122

Post by stavros »

sharperguy wrote: post #40
ggpsv wrote: post #9

Earlier quoted context omitted.

Can you elaborate on how age (and the downstream packages) has made a difference in your workflows?

With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…

I use git-crypt for this, and love it.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#123

Post by stavros »

thaumasiotes wrote: post #38
kitd wrote: post #10

> The author pronounces it [aɡe̞] with a hard g, like GIF Lol, or 'git' according to one of my more sensitive colleagues.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

As opposed to "age"?

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#124

Post by stavros »

kitd wrote: post #10

> The author pronounces it [aɡe̞] with a hard g, like GIF Lol, or 'git' according to one of my more sensitive colleagues.

Is the "like gif" part a joke? You can't use a famously ambiguous word as an example of pronunciation!

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#125

Post by upofadown »

tptacek wrote: post #93
upofadown wrote: post #85

Earlier quoted context omitted.

Doing one thing and doing it well is all and good, but most people are not interested in having to manually mess around with up to 4 raw keys in the pursuit of that. That's particularly true if you are doing pipes and you don't have any good place to put all those keys. Most of the time you want to go: gpg --sign --encrypt file ... and be done with it.

This is a little vacuous. Why are you signing? Why are you encrypting? Those are different operations. What are you trying to accomplish? The biggest problem with PGP is that its most popular use cases tend to be people bodging this old clanking command line tool into cryptosystems that (a) PGP wasn't designed for and (b) purpose-built cryptosystems are much better at . One of the reasons age is so constrained is tha…

>Why are you encrypting?

In any case I can think of, people encrypt things because they want to restrict who can know what those things are.

>Why are you signing?

In the context of encrypted files, you would sign because you want to know if an attacker has modified or more simply just replaced your file. Authenticated encryption is considered more or less standard these days.

>Those are different operations.

Except for niche applications like password storage, most people want/need authentication. Giving someone a raw encryption utility like Age is almost always going to result in a situation where that user is not protected against modification/replacement when they do asymmetrical encryption. That is assuming that they can figure out the keys for even just the encryption.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#126

Post by thaumasiotes »

stavros wrote: post #123
thaumasiotes wrote: post #38

Earlier quoted context omitted.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

As opposed to "age"?

No, "age" is not only a preexisting word, it's one that's common as dirt.

Having the rust port be "rage" only compounds the problem.

The author's rather Italian-looking name tends to suggest that he wouldn't view a hard G as a possibility for the word "age" either (and the pronunciation link specifically goes to a synthetic Italian pronunciation of the word "aghe"...), so something else is going on.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#127

Post by stavros »

thaumasiotes wrote: post #126
stavros wrote: post #123

Earlier quoted context omitted.

As opposed to "age"?

No, "age" is not only a preexisting word, it's one that's common as dirt. Having the rust port be "rage" only compounds the problem. The author's rather Italian-looking name tends to suggest that he wouldn't view a hard G as a possibility for the word "age" either (and the pronunciation link specifically goes to a synthetic Italian pronunciation of the word "aghe"...), so something else is going on.

I don't understand how the author wants to pronounce it. "ag-ay"? It's very confusing that it's an extremely common word which this program decides to pronounce differently.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#128

Post by lifeisstillgood »

fmajid wrote: post #6
lifeisstillgood wrote: post #4

Recommended in here I believe: https://www.latacora.com/blog/2020/03/12/the-soc-starting/

No, it’s here (scroll all the way to the bottom): https://www.latacora.com/blog/2019/07/16/the-pgp-problem/

Thank you - my bookmarks are all in my head :-(

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#130

Post by dolmen »

0cf8612b2e1e wrote: post #91
ReptileMan wrote: post #79

Earlier quoted context omitted.

>just "my script might just use it and expect you to have it" That is one path to standardizing something - using it.

Chicken and egg problem. People use sh/bash because it is everywhere and standard. Requires energy to justify using an objectively superior tool if it is not default installed. I would love if I could count on Just, fish, ripgrep, or any other multitude of tools that improve upon these CLI apis that were invented ad hoc and ossified in the 70s. Paved a lot of cow paths.

Perl is everywhere, standard (there is a single implementation, with a strong culture of backward compatibility) and an objectively superior tool.
Post reply on HN