Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email Encryption Software Relies on One Guy, Who Is Going Broke

propublica.org

Post reply on HN
Print view View original

41–50 of 469 posts

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#41

Post by smutticus »

agwa wrote: post #16
unreal37 wrote: post #2

There does seem to be a need for an "Internet fund". Pick 100 of the core free technologies that everyone relies on and pay people to maintain them.

I'm really dismayed that the Core Infrastructure Initiative, which was created in the aftermath of Heartbleed to fund OpenSSL and other critical software, has chosen to prioritize NTP , and not GnuPG[1]. Most of the companies that rely on OpenSSL are probably using a distro that uses GPG to securely distribute the OpenSSL package. [1] http://www.linuxfoundation.org/programs/core-infrastructure-...

NTP is important as well. If I remember correctly, that decision was made around the time that NTPD was found to have multiple exploits allowing amplification attacks. Given that there are so many publicly available NTP servers, that makes it a pretty important project.

The fact is that all of these projects need better funding. Frankly it surprises me that large multinational corporations that care about security don't just fund these people. The downside risk for them is terrible.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#42

Post by jordigh »

ChuckMcM wrote: post #34

I wonder sometimes if this is the legacy that RMS was thinking about. Sometimes, in my more cynical moments, it seems like we have somehow managed to trick a whole generation of programmers into giving "free stuff" to the world, enabling the creation of the very successful mega corporations which have then kept the value for themselves. Would it be impossible to create some sort of stipend program at FSF? After all t…

> I wonder sometimes if this is the legacy that RMS was thinking about.

No.

Free software was never about no money being involved. In fact, RMS himself used to get a lot of money by selling free software. Back in the day when Emacs was too big for the internet, RMS used to sell Emacs tapes at 100 USD each (with documentation and source code, of course).

In fact, he still thinks that you should be charging money for distributing free software:

    Distributing free software is an opportunity to raise funds for
    development. Don't waste it!
https://www.gnu.org/philosophy/selling.html

He also thinks selling exceptions to the GPL is another good way to support yourself. FFTW and Qt are two prominent projects I can think of that did this.

https://www.fsf.org/blogs/rms/selling-exceptions

The GPL itself is anti-freeloading. We give you the code, you can do whatever you want with it, but if you want to build on top of ours, you have to give back. It's all about levelling the playing field for everyone.

I have really hoped that the current app store model would turn out to be a great way to sell free software. A convenient way to pay, and you can download and install whatever you want. Optionally, you can have a link to the source code.

Sadly, it doesn't seem to be happening this way. I don't understand why not. Perhaps I too am being too idealistic.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#43

Post by pquerna »

minopret wrote: post #5
unreal37 wrote: post #2

There does seem to be a need for an "Internet fund". Pick 100 of the core free technologies that everyone relies on and pay people to maintain them.

I agree more would be better, but aren't there several now, such as the Free Software Foundation, the Software Freedom Conservancy, and the Apache Software Foundation?

Apache Software Foundation does not pay any software developers -- so its a very different model than what you are proposing.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#44

Post by digikata »

gommm wrote: post #37

I've just donated. It's an important project and Werner Koch needs to be rewarded. I feel that we, as a community, are really bad at supporting some of the opensource projects that powers our infrastructure. I'm not sure what can be done to improve this. Maybe we need a foundation that raises money for those projects and does the marketing needed to remind us to donate. I for one wouldn't mind giving say 30 euros/mon…

After the big openssl bug, wasn't there some intent among some of the existing foundations to try to identify open source keystone projects and get them additional attention & support? It seems like the privacy advocacy groups might route some spending to GPG just as a pragmatic matter.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#45

Post by AlyssaRowan »

angersock wrote: post #27
agwa wrote: post #4

Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat. Here is a link to the donation page: https://gnupg.org/donate/index.html

What is the simplest program out there right now, open-source, that will let me sign binaries with a key? I'm experimenting to do a dead-simple licensing system using SSL certs and signing--rough idea is, cert is from me, and when it expires, software says "lol no get new cert". I'm sure this has been done before, but the amount of custom license management code I've seen in the wild makes me wonder...

Probably OpenBSD's signify.

You are of course aware signatures don't solve the licensing problem however, which is a Trusted Client problem (i.e. unsolvable).

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#47

Post by angersock »

AlyssaRowan wrote: post #45
angersock wrote: post #27

Earlier quoted context omitted.

What is the simplest program out there right now, open-source, that will let me sign binaries with a key? I'm experimenting to do a dead-simple licensing system using SSL certs and signing--rough idea is, cert is from me, and when it expires, software says "lol no get new cert". I'm sure this has been done before, but the amount of custom license management code I've seen in the wild makes me wonder...

Probably OpenBSD's signify. You are of course aware signatures don't solve the licensing problem however, which is a Trusted Client problem (i.e. unsolvable).

I'll check that out. Thank you!

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#49

Post by mseebach »

tptacek wrote: post #32
mseebach wrote: post #26

Given the general scarcity of talent in the business, it should really be trivial for a high end IT security consultancy to pay Werner a €3000/month (ie. enough to live on, if not extravagantly) retainer to be available ~10 hours a month to consult on encryption matters (or something like that). I wonder if it all really comes down to "Really I am better at programming than this business stuff." or if there is some u…

The task of maintaining GPG isn't principally cryptographic. GPG is one of those classic un-fun projects that the open source community is notorious for neglecting. So the problem isn't finding and funding cryptographic experts to work on it; the problem is finding Werner Koches who are willing to take on the slog of making sure GPG continues to work. Look at how many crappy, trivially broken crypto messaging systems…

Whether the work is "principally cryptographic" or not means fantastically little for it's business value, what matters is that the fraction of the value Werner is capturing is almost unmeasurably small. What Werner needs isn't donations, it's a vehicle for capturing some of the value he's creating.

The idea I suggested (a consultancy retainer) is a way of converting his name into cash. At 10 hours a month, his function would mostly be limited to the company being able to say that he works for them, maybe have him join some high-level meetings, more than actually doing programming for clients.

You're in the general security business, you seem to be pretty good at business in general: don't you know someone who could turn hiring Werner and two devs to work on GPG into cash?

Post reply on HN