Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email Encryption Software Relies on One Guy, Who Is Going Broke

propublica.org

Post reply on HN
Print view View original

71–80 of 469 posts

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#71

Post by hf »

peapicker wrote: post #61
agwa wrote: post #4

Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat. Here is a link to the donation page: https://gnupg.org/donate/index.html

Seems odd that the MANY projects dependent on GPG don't donate enough to GPG to employ one guy. Do Free Software project with funding 'pay it forward' to the volunteers on other projects they heavily depend on? (I don't really know) If not, they deserve to suffer the consequences.

I freely confess to being flabbergasted by these displays of less-than-rigorous thought processes.

How would a free software project 'pay it forward'?

They are in a very similar position, aren't they?

Edit: For some reason, I can't reply to child comments (probably a cool-off time-out at work?).

Just a short note here, then: $1.25e6 for the FSF translates to 10 developers like Koch being paid (the donation page quotes "120000 EUR").

That's ten. For the whole FSF. As an example of a well-funded project. I'm not going to comment on that. HN would rightly give me months of cool-off time.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#73

Post by malkia »

ctdonath wrote: post #54

But wait, I thought fame and accomplishment and helping lots of people were supposed to be enough for software authors, that somehow making people pay for software was evil, that it's OK if everyone just copies your source code and uses it, that an Open And Free Internet would be self-sustaining? /sarc

Making people pay for software might still be evil, but supporting software with teaching how to use it, documenting it, publishing books about it, making conferences, supporting it is what I think is a reasonable way for oss spirited souls to make money.

SQLite comes as an example - while completely free, public-domain, what might (I don't know for sure) be making money for the three people behind it is the extensive test suite, various other extensions (compression, security) and possibly support/integration/customizations for specific needs (less memory/cpu usage, or who knows what..)

I'm also amazed at Mike Pall's luajit's effort, and he keeps his sponsors page here: http://luajit.org/sponsors.html

I've never used directly GPG, but since I'm debian/ubuntu user I've donated money after reading one of the posts here.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#74

Post by daddykotex »

csl wrote: post #50

So I just donated €20 and I invite others to do it as well. (And they use Stripe for payments, which of course is relevant here on HN. And as a first time user, it was a breeze to donate.)

I gave a little €5, but I'll gladly give more when I have more income, I'm still a student :P

I used PayPal and it went like a breeze too.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#75

Post by spiralpolitik »

jordigh wrote: post #42
ChuckMcM wrote: post #34

I wonder sometimes if this is the legacy that RMS was thinking about. Sometimes, in my more cynical moments, it seems like we have somehow managed to trick a whole generation of programmers into giving "free stuff" to the world, enabling the creation of the very successful mega corporations which have then kept the value for themselves. Would it be impossible to create some sort of stipend program at FSF? After all t…

> I wonder sometimes if this is the legacy that RMS was thinking about. No. Free software was never about no money being involved. In fact, RMS himself used to get a lot of money by selling free software. Back in the day when Emacs was too big for the internet, RMS used to sell Emacs tapes at 100 USD each (with documentation and source code, of course). In fact, he still thinks that you should be charging money for d…

It doesn't seem to be happening this way because FSF fundamentalists like RMS want the whole hog to be 'Free Software' not just 'Open Source'. Any compromise is unacceptable even if it means cutting off their nose to spite their face.

See what happened to VLC as an example.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#76

Post by pyre »

nitrogen wrote: post #24
pyre wrote: post #19

Earlier quoted context omitted.

I knew that the developer pool for GPG was pretty small, and that this is a big reason why development isn't always fast. On the other hand, I had no idea that he was working full-time on it, and having money trouble. Also: If you search for "GPG Koch" you can come across this comment: https://news.ycombinator.com/item?id=6942254 EDIT: An example of development that is slow-coming: library support. Most GPG "librarie…

Wrapping the command line should be a little bit safer from a security perspective, since a memory exfiltration bug won't transfer across processes. Just don't use the shell between the wrapper and the command.

Is this really the case? I recall that proper library support is slow-coming, not because of security model concerns, but because "doing it right" takes more time / money that there is in GPG development at the moment.

EDIT: For example, I believe that it would require rewriting a lot of code, and that means said code would need to be audited to make sure no security bugs were introduced. It's "easier" to just wrap the current command-line tools because they are a known quantity.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#77

Post by X-Istence »

angersock wrote: post #27
agwa wrote: post #4

Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat. Here is a link to the donation page: https://gnupg.org/donate/index.html

What is the simplest program out there right now, open-source, that will let me sign binaries with a key? I'm experimenting to do a dead-simple licensing system using SSL certs and signing--rough idea is, cert is from me, and when it expires, software says "lol no get new cert". I'm sure this has been done before, but the amount of custom license management code I've seen in the wild makes me wonder...

Yes it has, there are a variety of licensing solutions for Mac OS X that do this (the openssl verify signed cert for licensing).

For example: https://github.com/glebd/cocoafob or https://github.com/bdrister/AquaticPrime

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#80

Post by sophacles »

hf wrote: post #71
peapicker wrote: post #61

Earlier quoted context omitted.

Seems odd that the MANY projects dependent on GPG don't donate enough to GPG to employ one guy. Do Free Software project with funding 'pay it forward' to the volunteers on other projects they heavily depend on? (I don't really know) If not, they deserve to suffer the consequences.

I freely confess to being flabbergasted by these displays of less-than-rigorous thought processes. How would a free software project 'pay it forward'? They are in a very similar position, aren't they? Edit: For some reason, I can't reply to child comments (probably a cool-off time-out at work?). Just a short note here, then: $1.25e6 for the FSF translates to 10 developers like Koch being paid (the donation page quote…

There are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year. These projects are usually end user facing, in a way that their dependencies aren't.

It seems reasonable that these projects should consider adding items to their budget to redistribute funds to projects that they depend on.

Some probably do this, however I think the GP was suggesting that something like this become more common.

Post reply on HN