Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gpg.fail

gpg.fail

Post reply on HN
Print view View original

221–230 of 376 posts

Re: Gpg.fail

#221

Post by ahlCVA »

palata wrote: post #211
computerfriend wrote: post #170

Earlier quoted context omitted.

> better UX with PGP instead of SSH This might be true of comparing GPG to SSH-via-PIV, but there's a better way with far superior UX: derive an SSH key from a FIDO2 slot on the YubiKey.

I do it with FIDO2. It's inconvenient when having multiple Yubikeys (I always end up adding the entry manually with ssh-agent), and I have to touch the Yubikey everytime it signs. That makes it very annoying when rebasing a few tens of commits, for instance. With GPG it just works.

For what it's worth: You can set no-touch-required on a key (it's a generation-time option though).

Re: Gpg.fail

#222

Post by ghickPit »

talideon wrote: post #163
ghickPit wrote: post #141

Earlier quoted context omitted.

> To be frank, at this point, GPG has been a lost cause for basically decades. Why do high-profile projects, such as Linux and QEMU, still use GPG for signing pull requests / tags? https://docs.kernel.org/process/maintainer-pgp-guide.html https://www.qemu.org/docs/master/devel/submitting-a-pull-req... Why does Fedora / RPM still rely on GPG keys for verifying packages? This is a staggering ecosystem failure. If GPG h…

Let's not conflate GPG and PGP-in-general. RPM doesn't use GPG, it uses Sequoia PGP. GPG is what GP is referring to as a lost cause. Now, it can be debated whether PGP-in-general is a lost cause too, but that's not what GP is claiming.

> it can be debated whether PGP-in-general is a lost cause too, but that's not what GP is claiming

It is though what both the fine article, and tptacek in these comments, are claiming!

Re: Gpg.fail

#223

Post by ekjhgkejhgk »

UqWBcuFx6NV4r wrote: post #204
ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

You are attributing a general trend to a particular language community. I also believe that you are unjustifiably unfairly interpreting “default license” just because you disagree with what they think the “default license” is. We all know what is means by this. It just sounds like you think it should be something GPL

No, you're guessing what I'm thinking. I'm telling you that a person I spoke to TOLD ME verbatim "I chose MIT because it's the default lincense". I'm not guessing that's what they did, that's what they TOLD ME. Do you understand the concept or literally telling someone something?

Re: Gpg.fail

#224

Post by ekjhgkejhgk »

darkwater wrote: post #192
MobiusHorizons wrote: post #182

Earlier quoted context omitted.

Seems like the users are voting with their feet, right? Maybe respect the users wishes and stop preaching what users should be wanting?

Or maybe the users are just not aware. Licenses flame wars were a thing over 20 years ago, people nowadays can totally don't know about what can happen to a MIT-licensed software.

This, thank you.

Re: Gpg.fail

#226

Post by vbezhenar »

akulbe wrote: post #88
tptacek wrote: post #51

Earlier quoted context omitted.

One of those WONTFIX's is on an insane vulnerability: you can bitflip known plaintext in a PGP message to switch it into handling compression, allowing attackers to instruct GnuPG packet processing to look back to arbitrary positions in the message, all while suppressing the authentication failure message. GPG's position was: they print, in those circumstances, an error of some sort , and that's enough. It's an attac…

Is there a better alternative to GPG?

age

Re: Gpg.fail

#227

Post by palata »

ahlCVA wrote: post #221
palata wrote: post #211

Earlier quoted context omitted.

I do it with FIDO2. It's inconvenient when having multiple Yubikeys (I always end up adding the entry manually with ssh-agent), and I have to touch the Yubikey everytime it signs. That makes it very annoying when rebasing a few tens of commits, for instance. With GPG it just works.

For what it's worth: You can set no-touch-required on a key (it's a generation-time option though).

Sure, but then it is set to no-touch for every FIDO2 interaction I have. I don't want to touch for signing, but I want to touch when using it as a passkey, for instance.

Re: Gpg.fail

#228

Post by LtWorf »

ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

I'm not worried it might be the case. I'm certain that ubuntu and everyone else replacing gnu stuff with rust MIT stuff is done with the sole purpose of getting rid of copyleft components.

If the new components were GPL licensed there would be less opposition, but we just get called names and our opinions discarded. After all such companies have more effective marketing departments.

Re: Gpg.fail

#229

Post by LtWorf »

sph wrote: post #212
ekjhgkejhgk wrote: post #148

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke) GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for…

The vast majority of open-source software is written by people whose day job is building empires on top other open-source software, at zero cost and without releasing modifications, which is harder to do with the GPL.

Which is why I use copyleft licenses when I'm not getting paid

Re: Gpg.fail

#230

Post by LtWorf »

MobiusHorizons wrote: post #182
ekjhgkejhgk wrote: post #172

Earlier quoted context omitted.

It's harmful if the license of the rewrites if less protective of users, and then the rewrite ends up being very popular.

Seems like the users are voting with their feet, right? Maybe respect the users wishes and stop preaching what users should be wanting?

Users aren't voting. A few people who work at some huge corporations are making these decisions.
Post reply on HN