Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Felony – An open-source PGP keychain

github.com

Post reply on HN
Print view View original

121–130 of 241 posts

Re: Felony – An open-source PGP keychain

#121

Post by dom96 »

nickpsecurity wrote: post #83

Most are focused on the name, which is terrible, while only one other (so far) noticed the big problem: Electron, React, and Redux. A secure messenger needs to have strong endpoint security. Easiest way to do that is using safe, system languages with simple implementation, as few dependencies as possible, and isolation of app from rest of the system. That's one of safe C's, restricted C++, SafeD, Ada/SPARK, Component…

Agreed. Although I think that the name is also a problem. It feels like most of the upvotes are coming in because of the pretty image in the readme...

Re: Felony – An open-source PGP keychain

#122

Post by danjoc »

mwcampbell wrote: post #111
biokoda wrote: post #78

Earlier quoted context omitted.

> How does the app handle encryption? Has there been a security review? It's built on Electron, React and Redux. There is no security as it is a fundamentally insecure environment.

It's fashionable around here to criticize that tech stack, but do you have anything to back up that claim?

Besides NPMgate?

http://incolumitas.com/2016/06/08/typosquatting-package-mana...

https://github.com/npm/npm/pull/4016

http://blog.npmjs.org/post/141702881055/package-install-scri...

Re: Felony – An open-source PGP keychain

#123

Post by biokoda »

mwcampbell wrote: post #111
biokoda wrote: post #78

Earlier quoted context omitted.

> How does the app handle encryption? Has there been a security review? It's built on Electron, React and Redux. There is no security as it is a fundamentally insecure environment.

It's fashionable around here to criticize that tech stack, but do you have anything to back up that claim?

Running a large list of dependencies controlled by someone else. Stores data on disk unencrypted. Stores code that gets executed, on disk in text form unencrypted and unsigned. Executes code while running directly from a website (github).

All in all an order of magnitude less security then a native app to put it mildly.

http://blog.scottlogic.com/2016/03/09/As-It-Stands-Electron-...

Re: Felony – An open-source PGP keychain

#124

Post by SNvD7vEJ »

krisdol wrote: post #102
SNvD7vEJ wrote: post #93

Earlier quoted context omitted.

Please change the name of the app. I'm Swedish, and to me the name sounds really repelling. Maybe someone could fork the application and rename it to something cool that I can use?

You seriously can't do this yourself? Clone the repo and change the name using find-and-replace and run install. No need to insult.

Sorry, did not mean to insult. Just stating how I interpreted the name.

There seems to be a number of forks already (currently 12).

Re: Felony – An open-source PGP keychain

#125

Post by sixothree »

henryboldi wrote: post #24
cdnsteve wrote: post #16

Earlier quoted context omitted.

This looks like an interesting project but has a poor name choice. If it's targeted at non technical users, it may actually prevent them from using it, out of fear that just using it is illegal.

It's not targeted at entirely non technical users. That's why it's on Hacker News ;)

How about "Constitution".

Re: Felony – An open-source PGP keychain

#126

Post by madgar »

jameskegel wrote: post #69
madgar wrote: post #64

Earlier quoted context omitted.

"It's just a word which makes it stand out as a product" So you think calling a product "nigger" is a good idea? It's just a word and it would certainly stand out. (Before responding directly to my comment, please consider that I'm criticizing your logic, and don't actually want anyone to create a product with a hateful name)

That is a needlessly crass example. I get your point, but that's not the best way you could have made it.

I disagree. If someone has deactivated their own humanity enough to say "It's just a word" then they probably need a shocking reminder of the power of words. Making an abstract argument about words won't move the needle for a wet robot.

Re: Felony – An open-source PGP keychain

#127

Post by theli0nheart »

Gargoyle wrote: post #52
masukomi wrote: post #29

Earlier quoted context omitted.

Absolutely horrible choice of a name. There's so much BS regarding the use of encryption and it keeps coming up in criminal cases, that normal folks are going to avoid using a think that might somehow be linked with a felony.

Fork it, name it whatever you want. Problem solved, welcome to open source.

I really dislike this attitude. Sure, you can change the name (or do whatever you want) by forking, but what would that really achieve? Forking for a reason like this without a conversation isn't polite, nor will it likely achieve the best outcome.

Re: Felony – An open-source PGP keychain

#129

Post by pmlnr »

frakkingcylons wrote: post #106
henryboldi wrote: post #8

Earlier quoted context omitted.

Thanks! We found it randomly by searching available .io domain names.

The satire writes itself. What's wrong with .org/.net?

Not trendy. I would always prefer .net over .io though, but I'm oldschool.

Re: Felony – An open-source PGP keychain

#130

Post by pmlnr »

henryboldi wrote: post #9
brian_cloutier wrote: post #4

It's not obvious from the readme, how does key exchange work?

Once your key is generated you can click the 'copy' icon to the right of your name in the header. After that you can share the key on any platform you like, including Keybase.io :)

keybase.io... right. I've been waiting for an invite letter for a year.

Please stop referring to non publicly open platforms as they were actually usable.

There is keys.gnupg.net, pool.sks-keyservers.net, pgp.mit.edu, etc. These are the well-known ones that had been around for a while.

Post reply on HN