Live data from Hacker News

Email Encryption Software Relies on One Guy, Who Is Going Broke

propublica.org

221–230 of 469 posts

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#221
This is a clear example of market failure. When I've been grumpy over the last year over how torrent piracy affects indie cinema (the sector where I work) it's for similar reasons; putting work out there and depending on the goodwill of the public is simply not a viable economic strategy. It's a basic fact of human psychology that people gauge the value of something by what they paid for it, or even what other people would have paid with it and what they therefore feel they're 'getting away with' if they managed to obtain it without paying.

In December, he launched a fundraising campaign that has garnered about $43,000 to date — far short of his goal of $137,000 — which would allow him to pay himself a decent salary and hire a full-time developer.

Think of what Koch might be able to achieve if he were in a position to direct other people in addition to writing code, or even to write code without the distractions of a precarious financial life.

Innovators, whether in arts, technology, or whatever sector, do not like relying on donations or shaking a hat in front of people. It's a shitty, degrading way to work. Nobody becomes better at what they do through constant negative reinforcement of their economic inferiority; and yet the notion of even the most minimal royalty obligation or assertion of a private economic interest is enough to bring out glibertarians* in droves ranting about the selfishness and futility of trying to put a price on something that has zero marginal cost of distribution. Digital assets do have zero marginal cost of distribution, but they have significant fixed costs of creation, and the failure to acknowledge that by disavowing the notion of any property interest in digital goods are undermining the entire market concept in favor of a new variation of serfdom. Saying that society should change and institute a basic income guarantee is all very well, but that's not going to put food on the table for anyone in the near term (except possibly a few enterprising economic raconteurs who are willing to take up the role of court jester).

One possible option for Koch would be to crank out the next version of GPG; post a changelog of all the desirable new features/bug fixes etc., and then run a Kickstarter to raise the funds that would persuade him to release it - in other words, to withhold the new version until people put their money where their mouths are. But I'm pretty sure he doesn't want to do that, for 3 reasons: first, many people would just carry on with whatever they currently have, regardless of security liability etc., because what's already available is 'good enough'; two, he'd become the target of the internet hate machine, albeit on a smallish scale; and three, a bunch of indignant people would fork the existing code on Github and offer their innovations for free, a hundred flowers would bloom, and 3 months later 99 of them would have shriveled up and died, while the codebase would have have irreparably fragmented.

What we need is some sort of new economic model that does not force innovators to sacrifice their comparative economic advantage (ie their primary technical or artistic skill, on which they should be concentrating their efforts) on guilt marketing, public beggary, or drafting of grant applications.The copyright system could provide such a mechanism, but focusing only on the cases where it's broken or unfair to consumers has led many hackers and digiterati to throw the baby out with the bathwater, making things much harder on small-scale producers whose interestes the system was instituted to protect in the first place.

* people who identify as libertarians but who have little experience of structural economic disadvantage

in the economic sense of things that are literally good to have

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#222
post #4

Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat. Here is a link to the donation page: https://gnupg.org/donate/index.html

Thanks for the donation link, I just used it. It seems odd to me that an article bemoaning the fact that GnuPG's author is going broke gives no information at all on how to help rectify that condition.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#223

Earlier quoted context omitted.

> open source and free for non-commercial, require a donation if it is used in a commercial product Every serious definition of 'open source' or 'free software' says that you can't discriminate by field of endeavour - if you have one set of rules for commercial use and one for non-commercial use, it's not really open source. And the nature of donations is that you can't require them. That's not to say that you can't…

Nope. We call it Free and Open Source Software for a reason. Open Source means the code is open (i.e., you can study it), Free means it's licensed under a Free Software license (it doesn't necessarily mean free of charge). People usually omit the "Free and" part when they talk about FOSS. https://en.wikipedia.org/wiki/Free_and_open-source_software // Anybody want to tell me why you vote me down? Am I wrong?

For practical purposes, free and open source software are the same things with the same licenses. They're just different philosophies and goals.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#224
post #4

Calling GnuPG "email encryption software" really understates its importance. It's also used in countless applications to encrypt data at rest, and GPG signatures are used to secure the distribution of software. For instance, GPG is an essential part of the package managers of Debian, Ubuntu, and RedHat. Here is a link to the donation page: https://gnupg.org/donate/index.html

something like this is just too important to not donate money to.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#225
post #142

Earlier quoted context omitted.

I was under the impression that there were issues, even with the LGPL. E.g. static vs. dynamic linking.

The FSF's interpretation of the GPL and LGPL has never made a distinction between static and dynamic linking. A lot of other armchair internet lawyers, make this distinction, though. ;-) Eben Moglen seems to think, as I understand it, that it depends on how you distribute the thing. If you link dynamically but distribute the whole thing together as if it were a whole, it's a single work and all should be under the GP…

This is the rub though. If you are (e.g.) distributing a desktop app that uses a LGPL library, you may not be able to assume that the library is installed on your target platform. For example, you may use libxml2 for XML parsing, but not be able to assume that it's installed on Windows (assuming for the sake of argument that libxml2 was LGPL instead of MIT licensed).

It's one thing to "cash in" on a GPL/LGPL project (e.g. writing a nice GUI around GnuPG, but not giving back to the project) where you are just wrapping the functionality of the GPL/LGPL project. It's another thing entirely to just use a support library (like an xml parser) where the library itself is not the main functionality of the program and have someone saying that your project has to be GPL.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#226
post #99

Earlier quoted context omitted.

> You are using Ubuntu, I see from your profile. How much have you paid them? It's easier for businesses to write off these type donations (and make them for significant amounts) than for private individuals to do so.

If it's a registered non profit you can donate and 'write it off' too. The idea that a 'big company' should do the donating is short sighted. That big company is made up of individuals. If everyone reading this donated $100, the problem posed by the article would disappear.

The numbers are a bit harder to meet than that, as gpg isn't the only project that needs funding. Heartbleed was caused by a similar issue.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#227
post #165

Earlier quoted context omitted.

I've sometimes wondered whether it'd be worth mid-to-large open source projects doing more triage for bugs. Because I'm in a similar position: I'm happy to make small fixes to stuff I use, but I'm not familiar enough with many codebases to fix big bugs. If I could pull up a list of bugs sorted by "expected ease of fix", I think I'd contribute a lot more.

Many people do, e.g. bugs tagged E-easy in rust bug DB https://github.com/rust-lang/rust/labels/E-easy

I stand corrected! Never seen that before. Pretty awesome.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#228
post #7

This is sad but not super surprising. Historically, if you had money and wanted a reasonable UI and cleaner integrations, you bought PGP (now from Symantec). GPG was always for people unwilling to pay. For the record I donated. I'm just pointing out that writing something that's bundled and distributed as part of something else means nobody thinks about your project, or in many cases even realizes they're using it.

PGP went commercial to deal with lawsuits, but it is still open source. I would like if someone with more understanding of the situation could outline the risks of allowing PGP to be the only implementation.

PGP is not open source.

Parts of its source code are viewable and reviewable, associated with key cryptographic functions. Much of what PGP builds is structure around that, and most of that isn't open in any sense of the word.

Phil Zimmerman (who's long since left the building) does understand the value of source review, and the team who supported PGP continued that legacy. But it was quite limited in scope.

That said, PGP also did work with other implementations, including GPG, to resolve compatibility issues -- I'm aware of a few of those personally myself.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#229

Earlier quoted context omitted.

> open source and free for non-commercial, require a donation if it is used in a commercial product Every serious definition of 'open source' or 'free software' says that you can't discriminate by field of endeavour - if you have one set of rules for commercial use and one for non-commercial use, it's not really open source. And the nature of donations is that you can't require them. That's not to say that you can't…

Nope. We call it Free and Open Source Software for a reason. Open Source means the code is open (i.e., you can study it), Free means it's licensed under a Free Software license (it doesn't necessarily mean free of charge). People usually omit the "Free and" part when they talk about FOSS. https://en.wikipedia.org/wiki/Free_and_open-source_software // Anybody want to tell me why you vote me down? Am I wrong?

Almost nobody would call merely viewable source "open source". Certainly not the OSI.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#230

I wonder sometimes if this is the legacy that RMS was thinking about. Sometimes, in my more cynical moments, it seems like we have somehow managed to trick a whole generation of programmers into giving "free stuff" to the world, enabling the creation of the very successful mega corporations which have then kept the value for themselves. Would it be impossible to create some sort of stipend program at FSF? After all t…

I don't think a generation has been tricked into giving "free" (as in beer) software; I think the generation brought it on themselves, and continues to do so. We've always been free (as in speech) to charge money for our free (as in speech) software.

People are very eager to work for free on free (as in speech) software just for the pats-on-the-back from "the community", it seems to me, at least as often as people do it because they're truly passionate about their craft.

With the rise of "have a github profile/opensource contributions" in job posting descriptions, it's only going to get worse. "Open source" is very rapidly becoming the "unpaid internship" model of hiring and distributing work in the software industry, and it breeds a sort of contempt for the notion of receiving compensation for one's efforts. I'm not sure that's a good thing with all the very-much-for-profit activity around software development.

Post reply on HN