Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GnuPG Fundraising Rally

gnupg.org

Post reply on HN
Print view View original

21–28 of 28 posts

Re: GnuPG Fundraising Rally

#21

Post by cJ0th »

102030485868 wrote: post #12
VMG wrote: post #7

Should I fund improvements to Signal instead?

Both GnuPG and Signal are great projects, but GnuPG has a different use case from Signal. You should, ideally, try to fund improvements to both projects.

> [...] Signal are great projects

If I may derail this thread even further: I find XMPP+OMEMO even better. The security concept is basically identical to Signal but users don't have to rely on particular servers and a widespread adaption would end the problem that people who use different servers/clients can't talk to each other.

Also, there are great apps for XMPP. For desktop user there is Gajim[0], for Android there is conversations[1] and the apple folks have ChatSecure [2].

[0] https://gajim.org/ [1] https://conversations.im/ [2] https://chatsecure.org/

Re: GnuPG Fundraising Rally

#22

Post by Xylakant »

anilshanbhag wrote: post #15
hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Exactly my thoughts. Also, many people have given up signing emails with pgp as most recipients use cloud based service like Gmail making it almost useless. This leaves a small niche community where both ends are outside the cloud based email network like journalist usecase maybe.

signing emails is by far not the only use-case for gpg. The entire package signing infrastructure of all linux distributions is underpinned by gpg. Even if they spend all of the 15K each month on having a single developer audit and improve the code-base, I'd be fine with that.

Re: GnuPG Fundraising Rally

#23

Post by lmm »

VMG wrote: post #7

Should I fund improvements to Signal instead?

No. Signal identities are connected to phone numbers (which is fine for most people, but not fine for the very people who actually need end-to-end encryption) and Signal is not fully open-source like GPG is.

Re: GnuPG Fundraising Rally

#24

Post by im_down_w_otp »

hdhzy wrote: post #13
im_down_w_otp wrote: post #5

I'll happily fund however much it will take to get them to religiously follow SemVer. Because there are soooo many breaking changes in patch releases that it's nearly impossible to keep our automation pipeline around gpg2 working consistently.

Out of curiosity: what kind of automation? Signing artifacts?

Creating keys, certifying keys, signing artifacts, publishing keys, etc.

Re: GnuPG Fundraising Rally

#25

Post by nickpsecurity »

waldfee wrote: post #16
hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable. Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

"Useful spending of that money would be UX issues, making the horror that is using this stuff bearable."

100%. Freeze all work on crypto except for fixes for new problems that show up. All rest of money goes to hiring a UX expert for a design that anyone can pick up for common case and then implementing it.

Re: GnuPG Fundraising Rally

#26

Post by VMG »

102030485868 wrote: post #12
VMG wrote: post #7

Should I fund improvements to Signal instead?

Both GnuPG and Signal are great projects, but GnuPG has a different use case from Signal. You should, ideally, try to fund improvements to both projects.

> You should, ideally, try to fund improvements to both projects.

And a thousand more. The question is where to channel scarce resources.

Re: GnuPG Fundraising Rally

#27

Post by heypete »

RX14 wrote: post #3

I hope they spend some of that money on the keyservers, they seem to be down every time I want to grab some gpg keys.

I run one of the many keyservers. I have various checks running regularly to make sure everything's fine, both on my own server, some selected other servers, and the pool in general.It's rare to have an issue, and bad servers get taken out the pool within an hour thanks to the pool's automated checks (which are completely separate from my own).

What sort of issues are you seeing? What server are you querying? Where in the world are you located?

There's a bunch of servers out there -- https://sks-keyservers.net/status/ -- but most tend to be in North America and Europe. That might be an issue, depending on where you are.

Re: GnuPG Fundraising Rally

#28

Post by confounded »

waldfee wrote: post #16
hasteur wrote: post #14

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products. It seems like things that were sponsored by major organizations because they saw the good in having their n…

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable. Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

An alternative might just be to expose more of the underlying functionality via non-interactive interfaces, to encourage third-party/FOSS simplified interfaces for specific tasks.

Even trying to use a bash script to automate things is tricky because of gpg2's interactivity. I'm sure it was put there to improve usability, of course :) (which it does, in the interactive case).

Post reply on HN