Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GnuPG Fundraising Rally

gnupg.org

Post reply on HN
Print view View original

11–20 of 28 posts

Re: GnuPG Fundraising Rally

#11

Post by AbacusAvenger »

RX14 wrote: post #10
AbacusAvenger wrote: post #4

Earlier quoted context omitted.

Keyservers are hosted by volunteers as part of a distributed pool of hosts: https://sks-keyservers.net/ And the pool's automated management infrastructure prunes misbehaving hosts pretty quickly (e.g. not responding, out of sync, etc). See "servers in the pool" and "servers currently not in the pool" here: https://sks-keyservers.net/status/

Well I'm just reporting the reality that the keyservers are down when I want to use them, almost without fail. I suspect that gpg isn't trying multiple servers in the pool but only trying the first A record it finds. I've had to edit hosts to select a functioning key server in the pool many times.

Before I learned about the SKS Keyservers pool, I had my "keyserver hkp://pgp.mit.edu" in my ~/.gnupg/dirmngr.conf, and that never failed for me unless I was in a strangely firewalled environment. Maybe try that?

Re: GnuPG Fundraising Rally

#13

Post by hdhzy »

im_down_w_otp wrote: post #5

I'll happily fund however much it will take to get them to religiously follow SemVer. Because there are soooo many breaking changes in patch releases that it's nearly impossible to keep our automation pipeline around gpg2 working consistently.

Out of curiosity: what kind of automation? Signing artifacts?

Re: GnuPG Fundraising Rally

#14

Post by hasteur »

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products.

It seems like things that were sponsored by major organizations because they saw the good in having their name associated with a product or service in favor of getting the "internet at large" to pay for things that have become ingrained as "But it's free so why should we pay for it?"

Re: GnuPG Fundraising Rally

#15

Post by anilshanbhag »

hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Exactly my thoughts. Also, many people have given up signing emails with pgp as most recipients use cloud based service like Gmail making it almost useless. This leaves a small niche community where both ends are outside the cloud based email network like journalist usecase maybe.

Re: GnuPG Fundraising Rally

#16

Post by waldfee »

hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable.

Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

Re: GnuPG Fundraising Rally

#17

Post by philjackson »

I wonder if they've reached out to news organisations like The Guardian and NYT. Also, perhaps human rights charities could make reasonable contributions once someone explains the importance of the project?

Re: GnuPG Fundraising Rally

#18

Post by simias »

hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

The page gives some informations about where the money will go:

> This money will firstly allow us to continue our maintenance of GnuPG. We also intend to use it to fund our work on the Gnuk security token. And, one new project that it will support is a book called "An Advanced Introduction to GnuPG." A book for developers who want to integrate GnuPG into their programs, and need to understand the various concepts, the important security tradeoffs, and common pitfalls; for digital security trainers who need to understand GnuPG to be able to make sound recommendations to users; and, of course, for enthusiasts.

I agree with waldfee that it would probably be a very good idea to invest a chunk of that money into UI improvements. GnuPG is not exactly the friendliest program out there, even for those of us who are very comfortable doing everything from the command line.

Re: GnuPG Fundraising Rally

#19

Post by cJ0th »

waldfee wrote: post #16
hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable. Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

I'd generally agree. Although I think this is rather something the people behind Enigmail should figure out. The vast majority of gpg users will never interact with it over the terminal, probably.

Re: GnuPG Fundraising Rally

#20

Post by waldfee »

cJ0th wrote: post #19
waldfee wrote: post #16

Earlier quoted context omitted.

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable. Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

I'd generally agree. Although I think this is rather something the people behind Enigmail should figure out. The vast majority of gpg users will never interact with it over the terminal, probably.

You're right. Not only GnuPG but everything around it (mostly email clients) are in dire need of a UX overhaul.

Presenting such a complicated technical topic only in it's purely technical form is not enough imho. Clear and concise explanation for each and every action and item that gets displayed (and the whys!) would do wonders.

Post reply on HN