Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gpg.fail

gpg.fail

Post reply on HN
Print view View original

181–190 of 376 posts

Re: Gpg.fail

#181

Post by bruce511 »

ekjhgkejhgk wrote: post #168
rendaw wrote: post #158

Earlier quoted context omitted.

How would MIT make anyone lose control of it?

The way it works is: A company adopts some software with a free but not copyleft license. Adopts means they declare "this is good, we will use it". Developers help develop the software (free of charge) and the company says thank you very much for the free labour. Company puts that software into everything it does, and pushes it into the infrastructure of everything it does. Some machines run that software because an…

>> A some point the company says "you know what, we like this software so much that we're going to fork it, but the fork isn't going to be free or open source. It's going to be just ours, and we're not going to share the improvements we made"

Right. So at that point all those contributing developers are free to fork, and maintain the fork. You have just as much control as you always did.

And of course being MIT or GPL doesn't make a difference, the company is permitted to change the license either way. [1]

So here's the thing, folk are free to use the company product or not. Folk are free to fork or not.

In practice of course the company version tends to win because products need revenue to survive. And OSS has little to zero revenue. (The big revenue comes from, you know, companies who typically sell commercial software.)

Even with the outcome you hypothesize (and clearly that is a common outcome) OSS is still ahead because they have the code up to the fork. And yes, they may have contributed to earn this fork.

But projects are free to change license. That's just built into how licenses work. Assuming that something will be GPL or MIT or whatever [2] forever is on you, not them.

[1] I'm assuming CLA us in play because without that your explanation won't work.

[2] yes, I think GPL sends a signal of intention more than MIT, but it's just a social signal, it doesn't mean it can't change. Conversely making it GPL makes it harder for other developers to adopt in the first place since most are working in non-GPL environments.

Re: Gpg.fail

#182

Post by MobiusHorizons »

ekjhgkejhgk wrote: post #172
loop22 wrote: post #151

Earlier quoted context omitted.

I think that's a feature not a bug for upstream projects encouraging these rewrites.

It's harmful if the license of the rewrites if less protective of users, and then the rewrite ends up being very popular.

Seems like the users are voting with their feet, right? Maybe respect the users wishes and stop preaching what users should be wanting?

Re: Gpg.fail

#183

Post by bfkwlfkjf »

MobiusHorizons wrote: post #182
ekjhgkejhgk wrote: post #172

Earlier quoted context omitted.

It's harmful if the license of the rewrites if less protective of users, and then the rewrite ends up being very popular.

Seems like the users are voting with their feet, right? Maybe respect the users wishes and stop preaching what users should be wanting?

[flagged]

Re: Gpg.fail

#184

Post by bfkwlfkjf »

grayhatter wrote: post #177
ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

> Is anyone else worried that [...] the Rust world [...] slap on it MIT license because it's [reason you don't like]? No... I don't think that's how software works. Do you have an example of that happening? Has any foss project lost control of the "best" version of some software? > Not everything in software is about features. I mean, I would happily make the argument that the ability to use code however I want witho…

[flagged]

Re: Gpg.fail

#185

Post by DetectDefect »

snorremd wrote: post #146
larusso wrote: post #35

Earlier quoted context omitted.

I did the switch this year after getting yet another personal computer. I have 4 in total (work laptop, personal sofa laptop, Mac Mini, Linux Tower). I used Yubi keys with gpg and resident ssh keys. All is fine but the configuration needed to get it too work on all the machines. I also tend to forget the finer details and have to relearn the skills of fetching the public keys into the keychain etc. I got rid of this…

I’ve ended up the same place as you. I had previously set up my gpg key on a Yubikey and even used that gpg key to handle ssh authentication. Then at some point it just stopped working, maybe the hardware on my key broke. 2FA still works though. In any case I figured storing an SSH key in 1Password and using the integrated SSH socket server with my ssh client and git was pretty nice and secure enough. The fact the pr…

> I had previously set up my gpg key on a Yubikey and even used that gpg key to handle ssh authentication. Then at some point it just stopped working, maybe the hardware on my key broke

Did you try to SSH in verbose mode to ascertain any errors? Why did you assume the hardware "broke" without anyone objective qualifications of an actual failure condition?

> I figured storing an SSH key in 1Password and using the integrated SSH socket server with my ssh client and git was pretty nice and secure enough

How is trusting a closed-source, for-profit, subscription-based application with your SSH credential "secure enough"?

Choosing convenience over security is certainly not unreasonable, but claiming both are achieved without any compromise borders on ludicrous.

Re: Gpg.fail

#186

Post by MobiusHorizons »

bfkwlfkjf wrote: post #183
MobiusHorizons wrote: post #182

Earlier quoted context omitted.

Seems like the users are voting with their feet, right? Maybe respect the users wishes and stop preaching what users should be wanting?

[flagged]

Obviously I am aware that not all user actions represent choices, but the hypothetical being proposed was specifically in the context of good established free software alternatives existing. In that context users switching to software with more permissive licenses would imply a choice on the users part. It is reasonable to assume this choice implies the users value something about the other software more than they value what the GPL incumbent has to offer. Of course such a choice could be motivated by many things like newer features, slick website, the author’s marketing, but whatever the case if the license was not sufficient enticement to stay, this feels significant.

Re: Gpg.fail

#187

Post by ethin »

LexiMax wrote: post #180
ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

I find that this is something reflective of most modern language ecosystems, not just Rust. I actually first started noticing the pervasiveness of MIT on npm. For me, I am of two minds. On one hand, the fact that billion-dollar empires are built on top of what is essentially unpaid volunteer work does rankle and makes me much more appreciative of copyleft. On the other hand, most of my hobbyist programming work has c…

I love the MPL and I use it wherever I get the opportunity. IMO it has all the advantages of the GPL and lacks the disadvantages (the viral part) that makes the GPL so difficult to use.

Re: Gpg.fail

#188

Post by commandersaki »

ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

Not really, gpg isn't something worth losing.

Re: Gpg.fail

#189

Post by [deleted] »

ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

[deleted]

Re: Gpg.fail

#190

Post by zimmerfrei »

baobun wrote: post #107
akulbe wrote: post #88

Earlier quoted context omitted.

Is there a better alternative to GPG?

sq (sequoia) is compatible and is available in your favorite distro. It's the recommended replacement. https://book.sequoia-pgp.org/about_sequoia.html

This is the right answer.

The problem mostly concerns the oldest parts of PGP (the protocol), which gpg (the implementation) doesn't want or cannot get rid of.

Post reply on HN