Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email Encryption Software Relies on One Guy, Who Is Going Broke

propublica.org

Post reply on HN
Print view View original

381–390 of 469 posts

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#381

Post by bigiain »

morb wrote: post #343
copsarebastards wrote: post #260

Earlier quoted context omitted.

Debian, Ubuntu, OpenSSH, Firefox, Apache, etc. In addition, some projects that are not well-funded as a project are "funded" in the sense that companies pay people to work on them, for example Microsoft paying Simon Peyton Jones to work on GHC.

Firefox is kinda special because they get a lot money from whoever pays them to be the default search engine, doesn't matter if it's Google or Microsoft or Yahoo. There's only so much software that can get away with that, GPG certainly can't. All of the Debian developers are volunteers, am I wrong? Slackware can barely support one employee, the founder. OpenSSH falls under OpenBSD, which also supports just the founde…

Perhaps GPG should annually auction off which nation-state security service or online advertising company's public key gets automatically added to the recipients list for each encrypted message?

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#382

Post by logn »

unfamiliar wrote: post #105
teamhappy wrote: post #6

I've been complaining about this on HN before; lot's of startups built chat apps on top of GPG during the whole Snowden thing and Werner can't raise $120,000. I'm really glad Pro Publica picked it up, but I also think we need to change to way we think about critical software like GPG. The GPG Tools team (GPG for Apple Mail) recently stated they need to charge for the tool in the future because they simply can't handl…

>I also think we need to change to way we think about critical software like GPG Maybe the lesson here is not to license important software under such permissive licenses. Make it open source and free for non-commercial, require a donation if it is used in a commercial product. I don't really see how you can give something away for free and then expect companies to volunteer to pay for it.

Affero GPL would be a much better choice.

GPL lets anyone running a webapp pretty much ignore everything in the GPL license.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#383

Post by notsony »

Alupis wrote: post #340
sophacles wrote: post #80

Earlier quoted context omitted.

There are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year. These projects are usually end user facing, in a way that their dependencies aren't. It seems reasonable that these projects should consider adding items to their budget to redistribute funds to projects that they depend on. Some probably do this, howev…

> There are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year. Too bad OpenSSL wasn't one of them until after the big "heartbleed" incident. The core infrastructure projects don't seem to get as much funding as they ought to, especially given almost everyone relies on them (even if they don't realize it). Prior t…

Over the next three years, the Linux Foundation will receive a combined total of $3.9 million from Google, Intel, Amazon and others to fund core infrastructure projects such as OpenSSL. Sounds good until you take a step back...

> Intel will invest "$300 million to help improve the pipeline for women and minorities, actively support the hiring and retention of diverse candidates, and fund programs that support the positive representation of women and minorities in technology and gaming industries."

http://www.wired.com/2015/01/intel-diversity/

> "Google Gives $775,000 to Nonprofit for Tech Diversity CODE2040 said Monday it received $775,000 in grants from the tech giant to support the launch of free training programs for more than 5,000 black and Latino college engineering students over the next two years."

http://blogs.wsj.com/digits/2015/02/02/google-gives-775000-t...

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#384

Post by davmre »

tdicola wrote: post #377
seizethecheese wrote: post #306

Apparently Stripe and Facebook just stepped in to pledge $50K/year each. https://twitter.com/stripe/status/563449352635432960

That's awesome, but it's weird to me that Facebook, etc. will happily pay a senior engineer a total compensation of $200k+ yet only pledge $50k for the maintainer of a critical tool. Not trying to look a gift horse in the mouth here, just odd perception of the priorities here.

Facebook gets all of the value produced by their own developers, but the benefits of GPG are shared. If every big tech company matched Facebook's $50k, the total sponsorship would be equivalent to several engineer salaries.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#386

Post by fnordfnordfnord »

toyg wrote: post #364
fnordfnordfnord wrote: post #122

Earlier quoted context omitted.

Probably because we're talking about encryption software ITT, and nobody would trust closed source encryption software.

> nobody would trust closed source encryption software. ORLY? Have you read much source for BitLocker or FileVault, recently? WhatsApp? Skype? And those are just the most popular ones off the top of my head...

No, and I wouldn't trust myself to read it either. But, there's a fair chance that someone I trust eventually will and that they'll point it out when they see something fishy.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#387

Post by jimktrains2 »

chkuendig wrote: post #138
hf wrote: post #109

Earlier quoted context omitted.

Those are some rather interesting documents, thanks! In 2013 FSF paid $ 689,239 in salaries and, astoundingly!, $ 48,995 in credit card fees.

FIY: That's 3.8% assuming everybody donated by credit card. Anybody got an idea why they pay so much?

As someone else pointed out 2.75%-2.9% is common, often thre is a charge per transaction too (on the order of 25cents after it's all said and done). The fee can change based on the card type (the merchant pays a higher fee on rewards cards normally...someone has to pay for rewards!) and international purchases can have additional fees. Charges backs can also bump up fees, ditto for outsourced fraud protection.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#388

Post by emmanueloga_ »

unreal37 wrote: post #2

There does seem to be a need for an "Internet fund". Pick 100 of the core free technologies that everyone relies on and pay people to maintain them.

I was thinking the same thing. It would be nice if there was some donations hub for open source projects with some sort of mixed Patreon/Humble-Bundle mechanic were you could donate N bucks to X open source software projects, one time or in a monthly basis.

The difficulties I see with this approach is 1) getting a trustworthy intermediate and 2) how to select the projects to allow the donations for. But 2) shouldn't be that hard because the users could, in the end, pick who they want to donate to.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#389

Post by logn »

takluyver wrote: post #147
malandrew wrote: post #40

Earlier quoted context omitted.

I'm wondering if there is a meta-donation page that lists a bunch of the most important open source projects, how you can donate to them and their yearly funding goals (and how many developers are being supported).

That could be an interesting project for someone. I suspect the hardest bit would be how you determine which projects are most important or most deserving of donations. As soon as money is involved, people will try to game it and spam it.

I think the package managers should add links to donate to projects. So I open up Synaptic to install GPG and in the description see that I can donate and they're only at 25% of their funding goal.

Another key would be to add a real commercial justification to pay for projects instead of just donating. Often for tax and regulatory purposes businesses can't just spend money on fun, frivolous things unless they want to make a mess of their accounting. Maybe something like for each $50 you spend you get to ask one question on a mailing list or message board.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#390

Post by abandonliberty »

dredmorbius wrote: post #228
abandonliberty wrote: post #11

Earlier quoted context omitted.

PGP went commercial to deal with lawsuits, but it is still open source. I would like if someone with more understanding of the situation could outline the risks of allowing PGP to be the only implementation.

PGP is not open source. Parts of its source code are viewable and reviewable , associated with key cryptographic functions. Much of what PGP builds is structure around that, and most of that isn't open in any sense of the word. Phil Zimmerman (who's long since left the building) does understand the value of source review, and the team who supported PGP continued that legacy. But it was quite limited in scope. That sa…

Could the unreviewed code be a liability?
Post reply on HN