Slashdot Mirror


How to Save PGP

Tomcat666 sends in: "The Register got some excerpts from an interview with Phil Zimmerman. He talks about how it might be possible to save PGP (Network Associates couldn't sell it, and will stop its development), OpenPGP and the future (industry-backed OpenPGP?)." A follow-up to our story yesterday about Network Associates mothballing PGP.

235 comments

  1. Why? by SteamedGeek · · Score: 0, Offtopic

    Who cares about PGP... if companies and investors are not opting in, there is a reason... ponder that.

    --
    Life Sucks... Have a Beer and a Smoke then Smile Damnit!!!
    1. Re:Why? by Minupla · · Score: 4, Insightful

      How about Amnesty International who uses PGP to keep their researchers who are in dangerous parts of the world, and the people who inform them safe from governments who would think nothing of searching their laptops? PGP has saved lives of good people who without it wouldn't have access to encryption secure enough to trust their lives with.

      Think about that, how many computer programs would you trust your life with?

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    2. Re:Why? by joshjs · · Score: 1

      Think about that, how many computer programs would you trust your life with?

      You mean aside from windows? ;)

    3. Re:Why? by great_flaming_foo · · Score: 1

      I don't know about you, but if I'm going to trust my life to some software I would at least like the option of looking at the source code. So, it seems like they might be better off with an open program like gpg. I now I don't want to die because of a bug in a program that could have been fixed if the source was open.

    4. Re:Why? by Anonymous Coward · · Score: 1, Insightful

      Yeah, I'd much rather die because of a bug in poorly-written public domain code, than buy from a company that has staff on hand to do quality testing, and paid programmers who can spend all day on the code.

      Oh wait... NO!!

      BEFORE you post a reply, read this:
      1) Yes, I know, microsoft software sucks. That's not what I'm arguing about.
      2) I'm also aware some companies use EULAs to eliminate their liability. You should buy from someone who doesn't do this if you need quality-certified software.
      3) This has nothing to do with linux, beowulf clusters, or Linus Torvalds.

    5. Re:Why? by Minupla · · Score: 2

      Read the previous article. The source for NAI's PGP was released. The change in policy was why P.Z. left NAI, but up till the very last version it was published source (as is traditional in cryptography software) so we could inspect the encryption and make sure it worked, and didn't contain any backdoors.

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    6. Re:Why? by gartogg · · Score: 1

      The first time I bought a copy of windows (95, and don't worry, I'm cured) I read through the licence. Why does it have to tell me specifically that nuclear fail-safes should not be run under windows, nor should any live-saving medical devices?

      --
      I'm a concientious .sig objector.
    7. Re:Why? by Pussy+Is+Money · · Score: 1

      Damn right! I'd much rather buy my clothes from the government, who has experts working on the problem day and night, than some handmade outfit by a glamorous designer!

      --
      Pushin' 'n dealin', shovin' 'n stealin'
    8. Re:Why? by Graymalkin · · Score: 2

      It means they are legally exempt from rampant idiocy. Java's SDK says the same thing. The GPL generalizes it more saying the author is responsible in no way for the software. Regulations for nuclear control equipment and medical devices only allow for qualifying software to be run on such devices, being stated in the EULA on Windows and many other programs is merely compliance with these regulations.

      --
      I'm a loner Dottie, a Rebel.
    9. Re:Why? by jazman_777 · · Score: 1
      The first time I bought a copy of windows (95, and don't worry, I'm cured) I read through the licence. Why does it have to tell me specifically that nuclear fail-safes should not be run under windows, nor should any live-saving medical devices?

      Because someone in the Government would think it's a great idea to manage a nuclear power plant with Windows 95, except that Microsoft said not to.

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    10. Re:Why? by Anonymous Coward · · Score: 0

      Someone how knows nothing about security brings this up every time PGP is mentioned, and it is total BS. Governments who would think nothing of searching your laptop would also think nothing of beating you bloody for you passphrase. Whether you give it to them or not you're probably just as dead. Folks like Amnesty try not to make t obvious what they are doing.

      BTW the only mention of PGP on www.amnesty.org is, "Pahari Gano Parishad (PGP or Hill Peoples Council)"

    11. Re:Why? by Minupla · · Score: 2

      Quoted from: http://www.chiark.greenend.org.uk/pipermail/ukcryp to/1998-December/003102.html

      "If you're talking about the British government or the American government,
      they're virtually permanently tapping all of our stuff and using voice and
      character recognition," Gregory says. "I know what technology they've got.
      "The Tunisians [where a new office is being set up] aren't as subtle as the
      Americans and the British. It's a bit like heavy breathing on the line."

      However, even though Amnesty staff can automatically encode any message sent
      in Notes with its built-in encryption - certain staff use far stronger PGP
      encryption - Gregory says the US export ban on strong encryption still
      leaves it in a difficult situation.


      Remember, not all countries that AI investigates can be as unsubtle as to beat passphrases out of people, and the person couriering the data need not have the passphrase to have it beat out of them.

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    12. Re:Why? by blibbleblobble · · Score: 2

      Hence the reason that encryption is only the first step.

      Second step is steganography, hiding the message, either by attaching it to the end of a zip file, or by weaving it into an image.

      Third step is to have an encryption system which allows alternate passwords: each password reveals a different set of data, and the password you get forced to tell someone reveals not much at all.

      You need more than just encryption to hide your data from governments.

    13. Re:Why? by ergo98 · · Score: 1

      What does the commercial success of PGP under NAI, with universally acknowledged horrid marketing, have to do with the adoption of PGP and variants in the marketplace? There are millions of people out there using either the free version available from http://www.pgpi.com, or the many open standard PGP variants. PGP is an incredibly valuable piece of software and it will live on regardless of what NAI does.

  2. Why not... by mstrjon32 · · Score: 2, Funny

    Just open source it...but then again open source and security software aren't best used in the same sentence.

    1. Re:Why not... by kiltedtaco · · Score: 0

      `Closed Source` and `security software` are allot more dangerous when combined.

    2. Re:Why not... by Anonymous Coward · · Score: 0

      Because as we know, we should look to the closed source community (Microsoft, what?) for all our security needs. At least open source doesn't try to deal with security problems by denying they exist.

    3. Re:Why not... by gartogg · · Score: 2, Informative

      The best way to run it is open source. There is peer review on open source programs, and also anyone who want to modify it (to get rid of keylength caps) can. If you think, you will sound more intelligent.

      The source and encryption methodology betray nothing about how to decrypt a message. That is why PGP is pretty good. Also, is anyone really going to run a company that seems so inable to make money? As least people should have source to play with if they company is going under.

      --
      I'm a concientious .sig objector.
    4. Re:Why not... by aridhol · · Score: 2

      Um...because NAI doesn't want to? They own it now, I believe. And they want to profit from it somehow.

      --
      I can't say that I don't give a fuck. I've just run out of fuck to give.
    5. Re:Why not... by Gaijin42 · · Score: 2

      Actually, any good encryption algorythm is not dependant upon the secrecy of the algorythm. It is dependant on the secrecy of the keys involved.

      The formula for PGP, as well as twofish, blowfish, RC5, and every other major encryption tech in widespread use now is well known. Part of the process of becoming a good scheme is submitting the algorythm to acedemic (mostly mathematical and statistical) review.

    6. Re:Why not... by caspper69 · · Score: 4, Insightful

      Because as we know, we should look to the closed source community (Microsoft, what?) for all our security needs. At least open source doesn't try to deal with security problems by denying they exist.

      It didn't even take 10 minutes... Can someone tell me what PGP being open/closed source has to do with Microsoft? Last I checked NAI was the vendor of the product, and it was CLOSED source. From what I've heard this is an excellent product, and it's a shame to loose, no matter what plaform you run. Just because something is Open Source doesn't mean it's better. Do you think that the majority of the best coders do work for free, or for profit? And despite what you may think, some of the most talented people in this industry work at Microsoft (and NAI for that matter)... As for public vs. non-public disclosure of security issues, I'm sure that MS has plenty of reasons for NOT releasing their vulnerabilities. They have to take things into consideration that the Open Source community does not. With all the MS haters out there, as SOON as a vulnerability is announced, there are tens of thousands of script kiddies in their basement trying to wreak havoc on the Internet. Should there be vulnerabilities? No, but it's a fact of ANY software development. It doesn't mean there aren't a thousand people at MS slaving away trying to make their products better. Have a little more respect and appreciation for the scale of the systems we are even able to create nowadays. Damn zealots.

    7. Re:Why not... by gartogg · · Score: 1

      Ummm... except that encryption with computationally intensive cracks are only useful until the advent of real quantum computing, and then secret algorithms (or idiot codes) will be the only way to keep a secret.

      --
      I'm a concientious .sig objector.
    8. Re:Why not... by Anonymous Coward · · Score: 1, Interesting

      The biggest problem with PGP (IMO) is that Microsoft and Netscape never thought to integrate it into their mailers, instead choosing SMIME (which requires buying a certificate). Thus, PGP was always relegated to non-standard plug-in hackery.

    9. Re:Why not... by jazman_777 · · Score: 1
      Um...because NAI doesn't want to? They own it now, I believe. And they want to profit from it somehow.

      Maybe they want to integrate it with some of these games. Surely there's lots of money to be made sometime in the future.

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    10. Re:Why not... by Anonymous Coward · · Score: 0
      Just because something is Open Source doesn't mean it's better.

      No but if something is free it is better!

    11. Re:Why not... by Anonymous Coward · · Score: 0

      No, there will always be new ways to muddle things up. As soon as computers are really fast, some age old previously unsolvable problems will become the source for new encryption schemes. We will never run out of prime numbers for instance - they go all the way to infinity and beyond... ;-)

    12. Re:Why not... by Anonymous Coward · · Score: 0

      Lenny Bruce, always said that the best humor was about the things that we're not supposed to laugh about.

    13. Re:Why not... by Zeinfeld · · Score: 2
      Just open source it...but then again open source and security software aren't best used in the same sentence.

      PGP does not depend on keeping the code secret for security.

      However the idea that open source automatically means good security software is not generally accepted in the crypto community. The canonical example being Kerberos whose design and code were public for 10 years before a major flaw was found.

      The point is that the ability to review code does not translate into the code being reviewed and where security code is concerned who is doing the review matters. Open or closed source does not make as much difference as expert or inexpert review.

      Most of the crypto code in use in closed source software is based on BSafe which has been extensively reviewed by at least as many crypto specialists as PGP.

      It is a pity that folk talk about 'death of PGP' rather than 'using encrypted email'. How the email gets encrypted is not as important as the ability to encrypt. The major commercial email packages have been supporting S/MIME for a long time now.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    14. Re:Why not... by afidel · · Score: 4, Informative

      Actually just prime factoring goes out the door with quantum computers, eliptic curves and other methods are resilient to attack by quantum computers.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    15. Re:Why not... by Anonymous Coward · · Score: 0
      Mod this down,quick before my brain has time to absorb it!

      Must...not..succumb...to...rational..argument...mu st....embrace....open....source....must....double. ...think

    16. Re:Why not... by Anonymous Coward · · Score: 0

      It's spelled LOSE, fuckstick.

    17. Re:Why not... by wmrowland · · Score: 1

      You take an interesting stand for a posting on slashdot. I myself have always wondered why so much energey is spent castigating M$, er, MS, instead of on the positive aspects of other platforms and applications.

      It would certainly make this forum a much more productive place to spend time.

      As far as (open)PGP goes, I like the technology and I trust that Mr. Zimmerman will succeed in his quest to keep it alive and kicking.

      I certainly hope so, anyway.

  3. The lesson learned is... by qurob · · Score: 2, Insightful


    Make your pet projects free from the start.

    Notice that Phil wants to release it under a BSD style license. As much as we'd all like that, it probably isn't going to happen.

    1. Re:The lesson learned is... by Anonymous Coward · · Score: 0

      Phil's project was free from the start. Only gui version is not.

    2. Re:The lesson learned is... by Heinrich · · Score: 1

      PGP was free from the start, just check out the license of PGP 2.6.3. But even if it starts free, copyright holders can turn their package into a non-free status in later releases.

  4. Re: Opensource PGP by scorcherer · · Score: 2

    Isn't GPG (an OS implementation of the PGP protocol) exactly what you suggest? It's been around for quite some time.

    --

    --
    The Cap is nigh. Time to get a fresh new account.

  5. RTFA by BlackSol · · Score: 4, Insightful

    This isn't the end of PGP. OpenPGP is always going to be around. (or almost always - its open but everyone could decide to trash it if they like)

    This is the end of commercial PGP. This isn't a good thing for PGP to be used in commercial settings. Also this is the end of the PGPDesktop which was the only thing close to an option for (l)users.

    Hopefully NSI will release the code in a manner that will allow a smaller company to add value and repackage it to large corporations.

    --
    $sig=$1 if($brain =~ /idea\s+(.*)/i);
    1. Re:RTFA by Anonymous Coward · · Score: 0

      Hopefully NSI will release the code in a manner that will allow a smaller company to add value and repackage it to large corporations
      If you did RTFA *and* read into the story behind it you would know that is *very* unlikely to heapon.
      Here`s why:

      - Nai did not find someone who wants the code/userbase (thats what the story is about!), if you look at how attractive this package is to a small company you know the only reason nai didn`t sell is becouse they asked to much for pgp.com.
      - Nai has invested *a lot* in this code, becouse pgp is not yet intergrated as standard in applications (outlook) Nai had to make pgp.com a complete and attractive package/"application" on its own (pgpphone/pgpnet/pgpdisk), they will never give this code away.

      The only way nai is ever gonna release pgp code is if they are sure they can still make some money from it to pay for the development, and a redhat like consultancy/support way is this is to unlikely.

  6. Let's create a /. Corporation by Choco-man · · Score: 5, Interesting

    /. get's about what, a million unique hits? NAI put 36 million into PGP, and since they're not finding a buyer, we can assume they'd be willing to take somewhat less for it.. let's say 25 million. If /. changes it's subscribtion pay pal account instead to be a funding house to purchase PGP, each user could donate 25 dollars,and we'd have a co-op that now owns PGP. This co-op could then market it as an inexpensive payware product, available for download complete with source code for a $5 license fee. This rids the need for /. subscriptions by generating income, opens the most current version of source code up for review, and allows independant programmers to modify this source code to continually improve the product.

    A win win situation! 8-)

    IANAL. This is tongue in cheek. I hate having to explain myself...

    1. Re:Let's create a /. Corporation by kolevam · · Score: 1

      Aren't they dumping the PGP dept because they can't make any money off of it? What makes you think this co-op /. corp would be able to?

    2. Re:Let's create a /. Corporation by Choco-man · · Score: 1

      because they're not open sourceing the code, and charging 50 bucks a pop. i suggest open sourcing the code, charging 5 bucks a pop.

      'course i also said it was tongue in cheek. it's an interesting idea, but i can't imagine the administrative duties involved with maintaining a co-op of that size...

    3. Re:Let's create a /. Corporation by kolevam · · Score: 1

      Aside from whether or not it was viable... I thought it was a pretty cool idea! :)

    4. Re:Let's create a /. Corporation by donutz · · Score: 1

      "This co-op could then market it as an inexpensive payware product, available for download complete with source code for a $5 license fee."

      Ok, so what license is this hypothetical corporation going to put the code under? Is it going to be some yet-to-be-concocted proprietary license? Will it be a GPL or BSD license for the source code in general, but pay the $5 for the commercial "do as you like" license? If it's a Free license, then what's to stop someone from taking the source and putting it up on sourceforge for all to download? If it's not free, then what's the incentive for people to improve or add to the code?

      Its an interesting idea and all, and I like open source as much as the next guy, but I dont see a viable business plan here. Keep trying....they say something like 95% of businesses fail. 19 more tries and maybe you'll have a winner.

    5. Re:Let's create a /. Corporation by jazman_777 · · Score: 2, Funny

      I'd be happy to set this up. If everyone would send their money to my PayPal account, we could get rolling. You can trust me, I have over 6000 positive eBay transactions!

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    6. Re:Let's create a /. Corporation by Anonymous Coward · · Score: 0

      Just got spam from this guy. I'd like his yahoo account to be filled with spam, just to return the favor. 'scuse me.
      atipper@yahoo.com
      atipper@yahoo.com
      atipper @yahoo.com
      atipper@yahoo.com
      atipper@yahoo.com
      atipper@yahoo.com
      atipper@yahoo.com

    7. Re:Let's create a /. Corporation by ostiguy · · Score: 2

      because someone would sell the vpn client on its own, instead of only in a $100 per desktop package - I needed a vpn client, not 8 apps to confuse my mac using graphic artists.

      ostiguy

    8. Re:Let's create a /. Corporation by mwalker · · Score: 2, Troll

      If /. changes it's subscribtion pay pal account instead to be a funding house to purchase PGP, each user could donate 25 dollars

      That's a great idea. However, the economics don't hold up in the face of current customer research. Right now the max "penetration rate" for subsciptions is hovering at about 20%, best case. In short, 80% of the people who read Slashdot are freeloaders who won't even pay to read their favorite web site. Couple that with the unavailability of a flat rate subsciption (despite overwhelming market preference for flat rate) and you've got a virtually nil chance of success. What makes you think Slashdot readers are going to pay for software of all things?

    9. Re:Let's create a /. Corporation by Anonymous Coward · · Score: 0

      I don't have a subscription, and I support slashdot just fine. They *DO* make money off the ads. The ads don't bother me, I continue reading with them, and slashdot gets money. I don't see how this is "freeloading." If I blocked the ads, sure. :)

    10. Re:Let's create a /. Corporation by Anonymous Coward · · Score: 0

      Because 14 year old dateless 1337 h4x0r wannabee boys living in their mommy's basement are far more qualified to run a company than experienced businessmen.

    11. Re:Let's create a /. Corporation by Anonymous Coward · · Score: 0

      How do you know the spam actually came from that address? From: and Sender: headers can easily be forged. You might be causing an innocent person to be spammed for the crimes of someone else.

    12. Re:Let's create a /. Corporation by jswitte · · Score: 1
      I think this is good idea (really, I do. Yes, I am a pie-in-the-sky [or shall we say, open-source-in-the-sky] optimist) I do think that this would be rather hard to pull of logistically - we'd need to figure out how to get a bunch of /.'ers to agree and form some kind of BOD [board of directors] and need to find a lawyer and probably an auditor that wouldn't charge the Earth in fees.. But that might be doable.

      IMO there is all sorts of software this kind of model could be used for. BeOS is my favorite example. It's a well-designed, incredibly stable, fast OS (from what I've heard; I've never used it myself), and now that Palm has bought it, it will probably never see the light of day as a desktop OS again.

      I see this as one of the great ironies of U.S. antitrust law: because Microsft has about 90% market-share and therefore is a "monopoly", the DOJ can sue Microsoft for "potentially" stifling innovation (which is only provable when there was an actual technology that was "crushed", like Java [maybe]). But Palm can go right ahead and sit on the BeOS forever, clearly supressing innovation (since it is a demonstrable fact that the BeOS as a desktop OS did exist before Palm go it and stopped devlopment), and the DOJ can do nothing, because Palm is not a "monopoly" having at most 25% market-share.

      Part of the rationale behind the anti-trust laws should be to foster innovation ("idea competition"), not just to foster price-competition. It should be I think, but sadly it isn't.

      My other pet piece of source-code I'd like to see released is parts of the code relating to the Apple Newton, but that's another comment [on Apple and the NewtonOS].

  7. Please do correct me if I'm wrong, but by joshjs · · Score: 1

    Isn't PGP kind of a dead end, ultimately? Based on my limited (and quite possibly wrong) understanding, as quantum computing research continues, it will become possible to break this encryption. Right?

    1. Re:Please do correct me if I'm wrong, but by Choco-man · · Score: 2, Insightful

      of course, advances in magnetics and flight will eventually make tires on land vehicles obsolete too. unfortunately, neither of them has advanced to the point of feasibility yet, nor has quantum computing. until such time as that happens, there's a need for good ol' fashioned tires. or encryption.

    2. Re:Please do correct me if I'm wrong, but by Captoo · · Score: 1

      Eventually it will be dead for this reason, but we can still get many good years of life out of it. Even when someone builds a suitable quantum computer for cracking PGP, there won't be very many such computers around for many more years.

    3. Re:Please do correct me if I'm wrong, but by gartogg · · Score: 1

      (on topically) speaking of quantum breaking cryptography...
      Is there any type of encryption that is uncrackable with quantum computers?

      --
      I'm a concientious .sig objector.
    4. Re:Please do correct me if I'm wrong, but by Anonymous Coward · · Score: 0

      One Time Pad.

    5. Re:Please do correct me if I'm wrong, but by BlueFall · · Score: 1

      It's already possible to break any encryption. The feasibility is the issue. Using brute force techniques, PGP takes a long, long time to break using today's computers, but it is possible. Quantum computers (if they are ever constructed) will only make the process much faster.

    6. Re:Please do correct me if I'm wrong, but by mmacdona86 · · Score: 2, Insightful

      People discuss quantum computing as if it were inevitable, when in fact it is not at all clear that the difficulty of getting n bits entangled in a quantum computer does not scale as exp(n)--in other words, the difficulty of getting a quantum computer working may scale just as quickly as the computational advantage you get from it. A useful quantum computer being impossible to build would not be surprising at all. Lots of neato quantum effects are in fact impossible to scale to the macro world.

    7. Re:Please do correct me if I'm wrong, but by Evangelion · · Score: 1


      Quantum Encryption.

      Read up on it -- Quantum Computing has the ability to make conventional encryption look like a toy, as well as provide a truly unbreakable substitute.

      No worries.

    8. Re:Please do correct me if I'm wrong, but by Zeinfeld · · Score: 2
      Isn't PGP kind of a dead end, ultimately? Based on my limited (and quite possibly wrong) understanding, as quantum computing research continues, it will become possible to break this encryption. Right?

      Well PGP is a dead end but not for the reasons you give!

      Quantum computing is practically irrelevant for mainstream crypto. If someone does build a big enough quantum computer it is unlikely that we will ever know about it. But we do know that there are some pretty severe limits on what it can do, it is not a magic wand. A quantum computer does not help against AES or SHA-1 for example. I suspect that long before Quantum computing is real there will be replacements for RSA that are robust against quantum computing.

      The reason PGP is a dead end is that it was only deployed for email and only gives good privacy. PGP is not a good mechanism for signing binding e-commerce contracts.

      It would be much better if people spent their time persuading people to use the crypto that is already built into Outlook Express, Communicator, Notes etc. rather than trying to resurect a competing message format.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    9. Re:Please do correct me if I'm wrong, but by sab39 · · Score: 3, Interesting

      Encryption (S/MIME) in Netscape and outlook is it's own worst enemy, because of the requirement to submit your personal information to a "trusted" third party (ie, a corporation - who many of those smart enough to know that encryption isn't a good idea won't trust at all) and then rely on the same "trusted" party to verify that everyone else in the world is who they say they are.

      There's nothing wrong with S/MIME as a message format, but the implementations fall far short of what (as I understand it) PGP does: allowing you to generate your key without anyone having to verify it, and then YOU choose to ask specific people to verify it too. If you try to do this with any S/MIME client that I know of, it will claim that the certificate is untrustworthy because Friendly Trusted Company, Inc hasn't signed for it. PGP will try to find a way through the "web of trust" via a chain of people who all trust each other, from you to the person in question.

      If someone were to integrate the S/MIME message format with PGP-style keysigning and webs of trust, and persuade the email clients to stop insisting that only TrustedCompany signed keys are trustworthy, I suspect that encryption would be a lot more widely used...

      Stuart.

    10. Re:Please do correct me if I'm wrong, but by Zeinfeld · · Score: 4, Informative
      Encryption (S/MIME) in Netscape and outlook is it's own worst enemy, because of the requirement to submit your personal information to a "trusted" third party (ie, a corporation - who many of those smart enough to know that encryption isn't a good idea won't trust at all) and then rely on the same "trusted" party to verify that everyone else in the world is who they say they are.

      You don't have to be a corporation to sign keys. In fact there is a certificate signer distributed with every copy of Microsoft Office and Windows XP. Code to create X.509 certs is available as freeware in many open source distributions.

      If you try to do this with any S/MIME client that I know of, it will claim that the certificate is untrustworthy because Friendly Trusted Company, Inc hasn't signed for it.

      You can select the certificate and say 'trust this certificate' explicitly in all the popular implementations.

      If you don't like the way the S/MIME cert handling is done it is easy enough to do it any way you choose.

      Another scheme would be to set up an XKMS interface to a PGP web of trust and then drop an XKMS client into the CAPI or cryptoAPI layer of your favorite email client. Then you can configure any trust semantics you like in your Web O' trust service. No different in principle from using the BaL keyserver at MIT but a lot more powerful.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
  8. Why save PGP? by crush · · Score: 2, Troll
    specifically what does it add over GPG? Would it not be better for GPG if PGP were to die?

    I actually have no objections to it being presevered and developed, especially if it were Free Software, what I'm asking for is reasons for it to be preseved from the point of view of Free Software advocates.

    1. Re:Why save PGP? by aridhol · · Score: 4, Insightful

      specifically what does it add over GPG?

      Usability? GUI?

      --
      I can't say that I don't give a fuck. I've just run out of fuck to give.
    2. Re:Why save PGP? by Asic+Eng · · Score: 1

      $25 million for a GUI? Doesn't seem like a fair price.

    3. Re:Why save PGP? by crush · · Score: 2

      What "usability" is added by PGP? I'm actually interested having never used anything except commandline PGPi on Linux and GPG. I never found any usability problems with it once I understood what the ideas behind it were (took about a day of reading as I had absolutely no clue about encryption).

    4. Re:Why save PGP? by mvdwege · · Score: 1

      I know you might not see this, but I suggest that whoever modded your post Insightful is on crack.

      In case you are really not aware of this, GPG comes with a GUI tool, the Gnu Privacy Assistant.

      Mart
      --
      "I know I will be modded down for this": where's the option '-1, Asking for it'?
  9. Re:Save it WHY? by Colosse · · Score: 4, Insightful

    That's not the real problem. PGP don't create terrorist, and we all know that encrypted mail/files aren't the only way to pass secret information. I belive we should all care about crypto. Like Phill Zimmerman says roughly: E-Mails are like postcards, PGP is just a tool to get you mail messages into an envelope. Privacy is the real issue about tools like PGP, if you are willing to let it go, goverments, industries and peoples will sooner or later abuse you rights. You're not free when you are always looked upon.

    --
    Colosse.
  10. GPG, OpenPGP, and what needs saving by PureFiction · · Score: 5, Insightful

    In the article Phil focuses on easy to use GUI interfaces for less technically adept end users as the major feature that the OpenPGP/GPG projects need to focus on. This is the main advantage that the commerical version provided, and the main thing lacking in all the other alternatives.

    He clearly states that the PGP protocol is in no danger whatsoever, and will continue to remain widely implemented.

    Having spent many hours deciphering gpg command lines to use PGP to its full potential makes you realize how usefull a simple, easy to use GUI interface to a PGP would be. (Implicit in this task is integration with other applications, however, you can find plugin support for almost anything that you wish to use PGP in)

    1. Re:GPG, OpenPGP, and what needs saving by aridhol · · Score: 3, Interesting

      How 'bout putting the algorithm into a library? If there's one library for PGP (written in ISO-standard C), front-ends could be written for it for any platform. One back-end to watch for major bugs, and front-ends that allow the interfaces people are used to.

      --
      I can't say that I don't give a fuck. I've just run out of fuck to give.
    2. Re:GPG, OpenPGP, and what needs saving by PureFiction · · Score: 4, Informative

      How 'bout putting the algorithm into a library?

      This has been asked many, many times of the GPG developers, and they always have a very sound, technically reasonable explanation: Making a shared or static library for the GPG code would be a security risk.

      Once you have the code linked in (statically or dynamically) you can do Bad Things to the GPG code. Manipulate static variables, change environment settings, corrupt memory, all in an attempt to compromise security.

      This makes integration a bit more difficult, but there are still a number of wrapper libraries that provide similar functionality using fork() and exec() with the command line.

      Personally I prefer a bit more integration effort with more security than vice versa.

    3. Re:GPG, OpenPGP, and what needs saving by Ami+Ganguli · · Score: 2
      Once you have the code linked in (statically or dynamically) you can do Bad Things to the GPG code. Manipulate static variables, change environment settings, corrupt memory, all in an attempt to compromise security.

      What? That doesn't seem plausible to me at all. That would mean that any malicious software using (for example) libc could take over any other application using libc? No way.

      Besides, there are lots of other security libs that work without problems. If libSSL is possible then why not libGPG?

      --
      It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
    4. Re:GPG, OpenPGP, and what needs saving by Syberghost · · Score: 2

      The problem isn't that Bad Guys will do all of those things on purpose to compromise security.

      The problem is that well-meaning programmers will do all of those things by accident, and it's a damn sight harder to do so with an executable.

  11. I don't get it... by Ryu2 · · Score: 4, Insightful

    The commerical PGP is only one implementation of the open PGP standard. Even up to 6.5.8, full source code was available from Network Associates.

    Plus, there is GPG, PGPi, and other freeware implementations of the standard (under the umbrella of OpenPGP.org).

    I don't see why "PGP" as a whole is going down.

    It's like saying if Microsoft or Netscape decided to stop relasing browsers, then the entire WWW is doomed, when there's still Konquerer, Opera, Mozilla, and the whole W3C standards body, etc...

    --
    There's 10 types of people in this world, those who understand binary and those who don't.
  12. Open Source probably the solution but not BSD! by Semi_War · · Score: 4, Interesting
    I've read the article and can derive three possible solutions.
    • Slick interface
    • Good sponsor
    • Open source
    Since a slick interface would mean development and they current development is in limbo(with two shipable inferfaces in stock!!) I really don't think that an option. Second option is a sponsor, but since nobody is willing to buy pgp, I don't really think sponsorship will be attrictive to sponsors. Leaves only one option :)
    1. Re:Open Source probably the solution but not BSD! by Ded+Bob · · Score: 2

      What do any of your words have to do with the license?

  13. Check this box to GPL abandonware by dattaway · · Score: 4, Funny

    I was doing my taxes today (oh joy) and marked the box that mentioned something like $3 to the Presidential election campaign fund. Perhaps we could have a few donation check boxes to buy lucrative abandonware into the open source world.

    Then again, sometimes it might be good to just start some projects completely over. Remember Netscape?

    1. Re:Check this box to GPL abandonware by Frizzle+Fry · · Score: 1
      Remember Netscape?

      No.
      --
      I'd rather be lucky than good.
    2. Re:Check this box to GPL abandonware by Anonymous Coward · · Score: 0

      Notice how it used to be $2.00 for the presidential election fund? Ever wonder why it is not $3.00?

      Because people didn't want to contribute in large enough numbers for them to make the kind of money that they wanted, so they are soaking all of you saps who do for an extra dollar.

      No new taxes! We'll just raise the old ones.

  14. Seen as a bumper sticker... by gartogg · · Score: 5, Funny

    GnuPG. Because only the technically oriented deserve privacy.

    --
    I'm a concientious .sig objector.
    1. Re:Seen as a bumper sticker... by mmacdona86 · · Score: 0, Offtopic

      The 3,500 figure for Afghani non-combatant dead is highly disputed. In any case, and this may seem callous, it's kind of a drop in the bucket in the face of the death toll of their continuing civil war. By finishing the war quickly and efficiently, we probably saved Afghan lives in the long run.

    2. Re:Seen as a bumper sticker... by gartogg · · Score: 1

      I was pointing out that a significant percentage of the death were terrorists, in response to This guy's sig

      --
      I'm a concientious .sig objector.
    3. Re:Seen as a bumper sticker... by scorcherer · · Score: 2

      Shit! You told what the first G stands for.. I was anxious to have to explain 'GPG' as 'GPG Privacy Guard' which would fit the GNU humour, oops, I mean gnumour.

      --

      --
      The Cap is nigh. Time to get a fresh new account.

    4. Re:Seen as a bumper sticker... by Anonymous Coward · · Score: 0

      How exactly are you demonstrating that? I expected the link to go to an article somewhere that discussed the issue, but it's just a link to somebody's Slashdot info page. If you have information to back up your claim it would be better if you provided it. Unsupported assertions don't make very effective arguments.

    5. Re:Seen as a bumper sticker... by istartedi · · Score: 1

      As a general rule, I think we are going to see Israel vs. Palestine and USA vs. terrorists shaking out pretty much the same way: Low casualty figures in the "allied" countries consisting mostly of civilians. High casualty figures in the "axis" countries consisting mostly of military.

      Of course, the Axis countries always like to count starving civilians as casualties, but when their leaders divert most resources to soldiers and weapons and ignore the needs of the civilians, whose fault is it?

      You know what they say... I went to a statisticians conference, and a hockey game broke out... or something like that. Or was that, "lies, damn lies, and casualty figures"?

      --
      For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
    6. Re:Seen as a bumper sticker... by gartogg · · Score: 1

      I am referencing his sig, go read it. If you want to find the info, learn to use google, the numbers are everywhere (though i need to add some, Us commandos got some al-quaeda ppl recently)

      --
      I'm a concientious .sig objector.
    7. Re:Seen as a bumper sticker... by The+Famous+Druid · · Score: 1

      Well, if Israel continues it's nasty habit of launching air and artillery attacks on refugee camps, "targetted killings" of known Palestinian leaders by firing rockets at their cars as they drive through the local market, etc etc ad nauseum, I doubt if they'll be able to claim the bulk of their victims are "military"

      Of course, in Israeli military parlance, "terrorist" and "Palestinian" are synonyms.

      --
      Quidquid Latine dictum sit, altum videtur (anything said in Latin sounds important)
  15. Sorta Phil's fault by argoff · · Score: 3, Informative


    If he would have put it under the GPL from the beginning we would not be seeing this. He would be like the Linus of crypto, but he was so determined to controll the things he shouldn't be controlling that he lost controll over the things he should be.

    1. Re:Sorta Phil's fault by Slynkie · · Score: 3, Insightful

      Or, since back in 1991(?) when Phil first started his PGP work there was virtually NO corporate use of GPL'd software, PGP would have buried itself.

      I think it was definitely advantageous to have the corporate support of PGP in order to get it entrenched (however deeply it is) in the business world. Now, with commercial PGP going away, it's possible companies will have no choice but to move to open sourced alternatives and implementations if they wish to keep their security and privacy intact.

    2. Re:Sorta Phil's fault by FrostedChaos · · Score: 2, Informative

      Grow up.

      The PGP algorithm was not Phil Zimmerman's to sell. He basically made a freeware version of a popular commercial program, using their proprietary algorithm, and spread it all over the internet. He did this because believed that people should be able to avoid government surveillance on the internet. Whether or not you agree with him (I do), "encryption for the masses" is now a reality.

      I would be willing to guess that Phil was more afraid of government agencies like the CIA, KGB, and FBI, than of Microsoft and Cisco. It is only slashdot readers who can't understand the difference between a corporation, which can take away your money or your job, and a government, which can take away your life or your freedom. Having to pay $1 extra on a DVD is not oppression. It may be unfair. It may be something you should write to your congressman about. But it is not opression. Oppresssion is being shot because you supported the wrong political candidate, like in the U.S.S.R. under Stalin.

      --
      "Any connection between your reality and mine is purely coincidental." -Slashdot
    3. Re:Sorta Phil's fault by jazman_777 · · Score: 2, Funny
      Oppresssion is being shot because you supported the wrong political candidate, like in the U.S.S.R. under Stalin.

      My friend, there were no wrong political canditates in Stalin's day. Because they were all dead.

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    4. Re:Sorta Phil's fault by gmhowell · · Score: 1

      If the government is acting at the behest of the corporations, what's the difference?

      Let's not forget the police who helped break up strikes. Would they have thought of that on their own without the help of the friendly local business man?

      Today it's $1 for a DVD, tomorrow it is being arrested for writing a software program. Oops. Scratch that. That was yesterday.

      Only a matter of time...

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    5. Re:Sorta Phil's fault by Zeinfeld · · Score: 3, Informative
      The PGP algorithm was not Phil Zimmerman's to sell. He basically made a freeware version of a popular commercial program, using their proprietary algorithm, and spread it all over the internet.

      No he did not. Phil did not have rights to use the RSA algorithm. But the code, the message formats, everything that was all Phil and Phil alone.

      Drove the rest of us working on secure email up the wall. Phil had a point about the PEM certification hierarchy nonsense. But he could have reused the PEM message formats instead of rolling his own.

      The version of PGP in use today is largely the MIT version set up by Jeff Schiller and Hal Abelson and coded by Derek Atkinson arround RSAREF. That version has always been GPL as far as I know, with the major proviso that it linked to RSAREF which was encumbered big time but had no choice 'cos of the patent.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    6. Re:Sorta Phil's fault by Anonymous Coward · · Score: 0
      It is only slashdot readers who can't understand the difference between a corporation, which can take away your money or your job, and a government, which can take away your life or your freedom.
      1. You're assuming the government is impartial. It seems that whatever regime you live under, the government is on the side of the rich and/or powerful. This is clear in America. (although America is farrr from the worst case)
      2. Corporations can kill directly. They can hire hitmen. They have the money to pay for the best hitmen to not get caught, and the best lawyers to acquit them.
      3. Corporations can kill indirectly, through fraud. If the afore mentioned company defrauds me, and I don't have the money to mount a legal case, and I go into huge debt, I have no money. If I then get ill, who pays my medical bills?
      4. Capitalism in general encourages inequality of wealth. Clearly, some have less opportunity than others in life -- whether by inheritance (see Bill), by natural intelligence, or by sheer luck. A corporation helps those who can help the corporation. It's not helping others. Who remain less rich. Giving them less security (police protection is not equal, compare crime trends in exclusive suburbs to inner cities), less opportunity for medical care, etc. Making them more likely to die.
      So, corporations can easily "take away your life". Indeed, they have as much power to as the government acting on its own behalf.

      Of course, it's not that simple. The corporation usually uses the government to initiate force. Meaning the government gets blamed. The corporation can then claim that government is evil, and lobby for powers of government to be reduced. That is to say, powers *which do not conflict with the interests of corporation*. Rinse and repeat.

    7. Re:Sorta Phil's fault by argoff · · Score: 2


      You've put the cart before the horse. Corporations needed encryption - and that led to the adoption of technologies like PGP in the industry, the GPL would have encouraged it's use even more, and perhaps have forever thwarted the patent abuses that came with PGP. It's not like corporations decided from upon high that they would suddenly give their blessing to PGP which would then in turn become entrenched.

    8. Re:Sorta Phil's fault by argoff · · Score: 2

      ...The PGP algorithm was not Phil Zimmerman's to sell....

      It shouldn't have been anybdy's to sell..

      Whether or not you agree with him (I do), "encryption for the masses" is now a reality.

      And the GPL would have made it more of a reality instead now PGP is heading toward the scrap heap.

      The USA, the USSR, corporations or what not - taking away freedoms is taking away freedoms and the best way to loose a lot of freedoms is to accept the nickle and diming of a little freedom.

    9. Re:Sorta Phil's fault by FrostedChaos · · Score: 1

      Wash the foam out of your mouth, and get something done about that bad case of rabies. The vast majority of businesses are decent and law-abiding. There's simply no incentive for them to hurt you. Most of them are staffed with people very like yourself... well, at least physically, if not mentally.

      The worst crimes of this century have all been committed by governments. And the worst crimes of all were committed by leaders who seized absolute power, in the name of the people. The world of business may seem petty and cheap to a would-be intellectual like you, but it should be run by businessmen, not by insane politicos. When government takes over businesses "in the name of the people," that distinction breaks down. When the distinction between business and government breaks down, that is corruption.

      You can complain all you want about inequality of wealth, but it's not the fault of capitalism. It's inherent in the human species. Didn't we go over all this in the 20th century? Experience is a harsh teacher, but fools will have no other.

      --
      "Any connection between your reality and mine is purely coincidental." -Slashdot
  16. Sorry, I don't believe in paying for software. by $beirdo · · Score: 0, Troll

    Sorry, I don't believe in paying for software. Or charging for it. Ever.

    1. Re:Sorry, I don't believe in paying for software. by Anonymous Coward · · Score: 0

      Geez Stallman, how many troll accounts do you have??

    2. Re:Sorry, I don't believe in paying for software. by pete-classic · · Score: 3, Informative
      Your reply might be funny if it weren't 180 degrees out of phase with the real universe.

      To see what RMS actually thinks about this subject see http://www.gnu.org/philosophy/selling.html .

      From that page:

      Many people believe that the spirit of the GNU project is that you should not charge money for distributing copies of software, or that you should charge as little as possible -- just enough to cover the cost.

      Actually we encourage people who redistribute free software to charge as much as they wish or can. If this seems surprising to you, please read on.


      Then again, when has an AC let reality interfere with the contents of his posts?

      -Peter
    3. Re:Sorry, I don't believe in paying for software. by God!+Awful · · Score: 1

      Many people believe that the spirit of the GNU project is that you should not charge money for distributing copies of software, or that you should charge as little as possible -- just enough to cover the cost.

      Actually we encourage people who redistribute free software to charge as much as they wish or can. If this seems surprising to you, please read on.

      RMS can encourage people to charge as much as they want for redistributing software, but under his system all software has the same value, which is directly proportional to the cost of a CD-R and a stamp.

      -a
    4. Re:Sorry, I don't believe in paying for software. by pete-classic · · Score: 2

      I disagree. Redhat charges a premium for priority FTP access to software which can be freely distributed. The FSF itself was formed with money made by selling GNU on tape.

      It is true that Free Software does not have the "advantage" of artificial scarcity that proprietary software has. In spite of this, both Cheap Bytes and KRUD both operate in the black AFAIK.

      If we expand beyond simple distribution there are additional ways to actually make money by distributing Free Software that have been demonstrated in the real world. Redhat turns a profit, largely by bundling service with distribution. Several of the PHPGroupWare guys support themselves by supporting PHPGroupWare when they aren't hacking on it. Other value-adds exist, such as IBM bundling Free Software with hardware.

      But, I suppose it is true that you aren't going to make yourself rich by downloading Free Software on your cablemodem and mailing out burned CDs.

      -Peter

    5. Re:Sorry, I don't believe in paying for software. by nehril · · Score: 2

      the problem with this apparent sell-friendly position is that it is not workable. lets see...

      1. Corporation creates and sells an App under GPL for $1,000 (all legal but you do have to provide source).

      2. one person buys your app. because it is gpl'd, Customer 1 puts it up on sourceforge for all to download free of charge. it's now GnuApp. all legal, all gpl.

      3. Corporation now has to compete with it's own software available free of charge. Corporation can't pay rent, electricity, or those pesky programmer salaries.

      4. therefore, whatever stallman SAYS about the ability to sell gpl software, the reality is that you are effectively giving it away for free. Ever wonder why you don't ever see pure play GPL software companies survive on their own for more than a few months?

      I think GPL is great for stuff that you INTEND to be free forever, just be careful if you want to make $$$ by selling code.

    6. Re:Sorry, I don't believe in paying for software. by pete-classic · · Score: 2

      It is abundantly clear that you didn't read the page I linked to.

      Most of what you said is based on the exact confusion arising from the phrase "selling software" (and variants you used like "selling App" or "selling gpl software" or "selling code") that is explained in the page I linked to.

      So, since you don't care to read that article, let me establish some vocabulary.

      If "selling software" is to have any consistent meaning it must be selling the copyrights to a piece of software. Such as when Corel bought WordPerfect. This clearly is not the topic of the discussion.

      Now we come to what you are really talking about, which is selling software licenses. When you "buy software" (really "buy a license") you never get anything but the use of the software IAW the license terms. If you actually "bought windows" why may you not sell it? I don't mean en masse, just the CD you bought? Because you didn't buy anything but a license.

      Finally we have distributing software. Which is what I was talking about. Wal-Mart makes money by distributing both proprietary and Free Software. It doesn't make a difference to them. Redhat sits on the shelf right next to XP. See my other reply in this thread for more examples of people making money by distributing free software.

      Finally, note that if we can agree to the terminology above then you were more correct than you know, since there is there is no license for use of Free Software distributed under the terms of the GPL to sell.

      To be totally clear about what I just said; the GPL isn't a "software license" in the sense that many people think it is. The GPL is a software distribution license. It makes no demands on the user (unlike a EULA) except that they may not sue if they don't like the way the program works, or fails to work.

      So again, there is no software license to sell. Thus, you are correct that selling licenses for unlicensed software is not a promising business model. That, however, has nothing to do with my original post.

      -Peter

    7. Re:Sorry, I don't believe in paying for software. by God!+Awful · · Score: 1

      I don't know about Cheap Bytes and KRUD. A few companies are making money distributing open source, but clearly not many and not very much. Bundling sounds great in principle, but in practice it drives down your margins, and that has a snowballing effect through the whole economy.

      As for Redhat, I dispute your claim that they are making a profit. Here's a link to their balance sheet for 2001. According to this page, they lost $17 million below the line last year. That's not a huge loss, but it's not a great result for a former $120 billion company.

      -a

    8. Re:Sorry, I don't believe in paying for software. by pete-classic · · Score: 2

      How does selling something along with something you get for free drive down your margins?

      Let's say that Red Hat and MS each sell an OS for $100. Each expects to spend $50 supporting it. RH has $15/copy (at expected distribution volume) invested in development, and MS has $30, since the write the whole thing from scratch.

      Who has the larger margin?

      Now, these are all made-up numbers, but I think that they are useful for illustration purposes. Can you make up a set of reasonable numbers to illustrate how bundling support and distribution of software that you largely get for free hurts your margin?

      The way I explain that RH isn't making money hand over fist, but MS is is simple. Volume. I think that the reality is that RH spends something on the order of 1/10 what MS does on development, and has something like 1/1000 the (full price paid) distribution. So the numbers are more like 100/50/150 vs. 100/50/30.

      Perhaps I was mistaken about Red Hat making a profit. I swear I read that somewhere. Ah, wait, here it is http://www.redhat.com/about/presscenter/2001/press _Q12002.html. Maybe "making" was too strong a word. Made a profit in Q1 of '01.

      OTOH, your $120 billion figure, if I'm not mistaken, is their peak market cap. Which is bullshit. Market cap is literally meaningless. It has nothing to do with actual money. Not money that they have, have spent, people have spent on them. Nothing.

      That statement, combined with your statement that adding value by packaging and selling something that you get for free hurts the economy makes me question your grasp of economics.

      Now, I know nothing about accounting, but my understanding of the English language leads me to believe that they had a quarterly loss of 17M in 2000 (and a somewhat higher loss in the same quarter of 2001). Which leads me to question your interpretation of any facts.

      Finally, who said anything about "open source?" I'm talking about Free Software.

      -Peter

    9. Re:Sorry, I don't believe in paying for software. by God!+Awful · · Score: 1

      Now, I know nothing about accounting, but my understanding of the English language leads me to believe that they had a quarterly loss of 17M in 2000 (and a somewhat higher loss in the same quarter of 2001). Which leads me to question your interpretation of any facts.

      Okay, so I only quickly skimmed the balance sheet and read the wrong number. No need to get snotty (especially since both mistakes I made caused me to *underestimate* their annual loss).

      OTOH, your $120 billion figure, if I'm not mistaken, is their peak market cap. Which is bullshit. Market cap is literally meaningless. It has nothing to do with actual money. Not money that they have, have spent, people have spent on them. Nothing.

      It was a humourous aside, nothing more.

      How does selling something along with something you get for free drive down your margins?

      Did you ever read the book "Voltaire's Bastards: the Dictatorship of Reason in the West" in which John Raulston Saul explains how ideas which seem logical, but counter-intuitive have led to such global problems as nuclear prolifiration and the 3rd world debt crisis? (That may seem like a bit of a non-sequitor, but I was reminded of this book by the recent slahsdot story on US nuclear research.)

      You'd have to read the book to really understand the concept, but the crux of the argument is that it is wrong to allow logic to overrule common sense, especially when there are human factors involved. There are too many factors involved and simplistic comparisons tend to overlook some of them. For example, you ignore the fact that Red Hat's entry into the market changes the market. You can't simply extrapolate based on market share because the curve is not linear and its shape will be further altered by feedback.

      As an illustration of how the feedback effect works in economics, take the example of a company that rakes in a huge profit in 2002. Chances are, the employees will go on strike in 2003 to demand a larger cut. The next year, the profit margins will be much smaller. In the software industry, we don't see a lot of strikes because the employees are not unionized. However, large profits attract increased competition, which tends to lower prices.

      There is a reason why adding a $1 part to a computer may add $10 to the price. Along the way, each party operates on margins. The manufacturer will increase the price of the raw goods by a fixed margin. So will the distributor and the reseller. They make the margin a percentage of the price because that's the way people buy things. Whether you're buying a house or a car or a computer game, the amount you are willing to pay is probably a base price X plus some additional amount Y to get the specific one you want. Y can typically be modelled as a percentage of X. So if you *need* a car, but you *want* a Honda, you may be willing to pay a margin of 10% above the price of a similar Ford. Since you have to pay X regardless of what you buy, you might as well pay X+Y to get what you want.

      Let's say that the price of vacuums drops from $200 to $10. Would you still buy an extended warranty for $100? I don't know about you, but I don't buy warrantees today. Warranties are too much like insurance. I figure if the product breaks, I'll just replace it (probably with a different brand). If Red Hat gives away its OS for free and sells a support package then suddenly support, rather than software, will be the biggest cost to consumers. People are going to start looking for ways to save money. Why pay Red Hat $100 for support when you can get discount support for $20. Maybe the discount support isn't as good, but maybe it is. Red Hat will probably have to resort to IBM-style FUD to convince people that nobody ever got fired for buying Red Hat support.

      Note that this applies in other instances as well. Right now, the software industry is having its margins eroded by the falling price of hardware. People don't mind spending a few hundred buck on software if it improves the functionality of their $2000 computer. If hardware prices continue to fall, then the software industry is going to get hurt even more.

      Finally, who said anything about "open source?" I'm talking about Free Software.

      I take the Nancy Reagan approach: "Just say no to jargon."

      -a
  17. GUI Interface by TheMatt · · Score: 3, Informative

    One app that is going a along way to making PGP slightly easier is Evolution. It has the best PGP solution I've seen yet for email. Easy and simple to use, even Joe Barr agrees.

    But, the problem is you still must maintain your GnuPG bits manually on the command line. That was the beauty of NA's program. It had a slick GUI. Of course, in the end it didn't take me very long to pick up how to use gpg via the command line, but for the general populace it's still a barrier.

    --

    Fortran programmer...oh yeah. Array math for life!

    1. Re:GUI Interface by Anonymous Coward · · Score: 0

      There is gpgp.

    2. Re:GUI Interface by TheMatt · · Score: 1

      Aye, there is GPGP, but I like my programs to have active development. Looking at their website, they stopped about 2 years ago. Maybe the product was bug-free enough to stop development, but that often isn't the case.

      --

      Fortran programmer...oh yeah. Array math for life!

    3. Re:GUI Interface by Anonymous Coward · · Score: 0

      sorry but Chronos-II email has pgp-esque integration abilities and is at least 700% faster than evolution ever will be.

      evolution is a neat idea, and a grand example on how to bake a really big,slow email app.

  18. how is this flamebait i dont know by Edmund+Blackadder · · Score: 1

    nt

  19. On the server side by SirSlud · · Score: 4, Interesting

    What about the possibility of PGP technology being a part of the next major upgrade of open internet protocals (ie, POP, SMTP, etc .. )

    It seems to be that possibly losing out on the client-side 'niceness' that a commercial PGP implementation provides could be a non issue if the next round of standards include support for providing PGP mechanisms as part of their protocols (not that you'd HAVE to use PGP, but that PGP would somewhere in the protocol if you wanted to use it.)

    That would reduce the need to depend on the never-surefire client market penetration in order to see widespead and longterm usage of PGP as a means of protecting ones privacy.

    I've always felt open protocols make the best vehicles for propogating public-interest technology. That way, you dont need [Mailclient] + [PGP intergrated client] but [Mailclient that supports Next Gen Protocol X] where one of X's functionality sets uses a private/public key encryption scheme. Not sure what the likelihood of that happening is, tho, both from the perspective of when we'll outgrow the current crop of protocols, whether the new crop will be open enough to get public interests into the design phase, and whether the creators of said protocol would even think it would be a good idea to include a PGP layer in the protocol. :)

    --
    "Old man yells at systemd"
    1. Re:On the server side by John+Hasler · · Score: 1

      Take a look at Herbivore.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    2. Re:On the server side by John+Hasler · · Score: 1

      Slashdot seems to have eaten the Herbivore URL for some reason. I'll try again:

      http://www.vision25.demon.co.uk/oss/herbivore/in tr o.html

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
  20. GPGME - GPG Made Easy by Cadre · · Score: 4, Informative
    How 'bout putting the algorithm into a library?

    GPGME is a project to do this. From the website: "It provides a High-Level Crypto API for encryption, decryption, signing, signature verification and key management."

    It's a work in progress. It's useable, but of course, there is the standard disclaimer. Compiles fine on most Linux distributions. It needed a small amount of help to compile on Mac OS X. Not sure about any other OSes.

    --
    All editorial writers ever do is come down from the hill after the battle is over and shoot the wounded.
    1. Re:GPGME - GPG Made Easy by aridhol · · Score: 4, Insightful

      Compiles fine on most Linux distributions. It needed a small amount of help to compile on Mac OS X

      Yes, but in the Real World we still need to support Windows.

      Note that GPGME isn't really a GPG library. It uses the GPG command-line behind the scenes, so it is inherently unportable - you can't get IO from another running process in ISO C.

      When I suggested creating a PGP library, I meant a true library. Make the code ISO9899 compliant, then the only issue is linking it to the front end.

      --
      I can't say that I don't give a fuck. I've just run out of fuck to give.
    2. Re:GPGME - GPG Made Easy by PureFiction · · Score: 3, Informative

      you can't get IO from another running process in ISO C

      No, but you can use ISO C to make system calls (ported like everything else in the dual *nix/win/mac universes) that can communicate with the GPG process.

      Really, this isnt that big of a deal. It's a slight inconvienance, but you still end up with a very portable library that can be used to interface with GPG in a programmable manner.

    3. Re:GPGME - GPG Made Easy by bornholtz · · Score: 1

      Here is a wrapper DLL that some friends of mine wrote. Take a look and see if it fits your needs.

      cryptotw.sourceforge.net

      --
      -- Freedom means letting other people do things you don't like.
  21. grammar check by Anonymous Coward · · Score: 0

    "got some"? Christ, READ the fucking article before hitting SUBMIT.

  22. Scandelous by SirSlud · · Score: 5, Interesting

    > And what's scandalous is that NAI has OS X and XP-ready versions, but won't ship them.

    We need some laws that force work into the public domain if it wont be exploited for the private domain. I'm sick of companies keeping what will go into the dustbin. This is another example of how too much private interest can /create/ inefficiency in a market rather than reduce it.

    Of course, I respect that the work in question would probably have to pass some criterium whereby its release into the public domain would not cause significant damage to the company in question (if the company is to live on), but surely we can't believe that scenarios like this outweigh the benifits of laws forcing companies to push work they lose interest/money in back into the public domain?

    --
    "Old man yells at systemd"
    1. Re:Scandelous by DeadPrez · · Score: 2

      We need some laws that force work into the public domain if it wont be exploited for the private domain.

      Let me be the first to say: No, no we don't.

      If you want software they wrote and they won't give it to you, find an alternative, write it yourself, anything else.. But for the love of god, don't pass silly laws like this. How tragic that would be...

    2. Re:Scandelous by jazman_777 · · Score: 1
      We need some laws that force work into the public domain if it wont be exploited for the private domain.

      I like the word "force". I get all mushy-eyed thinking of Our State using more force. Of course, under threat of force, companies will just stop developing stuff. Or should we force them to?

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    3. Re:Scandelous by crimoid · · Score: 2

      Is it really the right of the people to say what private citizens must give and give up? From a governmental perspective corporations are not that much different from a private citizen. Having laws that "force" companies to essentially "give up" hard-earned intellectual property is akin to walking into your neighbor's garage and taking some tools he hasn't used in awhile. Sure you may use the tools that your neighbor is "wasting", possibly putting them to better use, but it just seems plain wrong.

    4. Re:Scandelous by Anonynnous+Coward · · Score: 1
      Is it really the right of the people to say what private citizens must give and give up?

      In this case, yes, it is, because "intellectual" "property" is really neither. It's a temporary monopoly generously granted by the state (i.e. the people, theoretically) in return for creating new stuff.

      It's no more unreasonable to condition that temporary monopoly on a requirement to offer a product in a reasonable and non-discriminatory manner or lose that monopoly than it is for Congress to go on extending it for those who bought legislators like Disney.

      But the state's and NAI's interests probably dovetail here--I wouldn't be surprised to hear someday that NAI got some more nice fat government contracts for "security software," likely in return for keeping crypto looking like a fringe technology that for other than banks and the military, is only of use to terrorists and paedophiles.

    5. Re:Scandelous by Anonymous Coward · · Score: 0

      That's a bad idea. It would cause them to be competing with themself. And who's to say that a product isn't being used "for the private domain?" Sure, they aren't selling it, but maybe they're using parts of it elsewhere?

    6. Re:Scandelous by Arandir · · Score: 2

      So in the name of freedom you would pass the slavery act requiring all developers to disclose their private unpublished code under penalty of imprisonment if they don't.

      Sorry dude, but their code is their code. Period. It does not belong to you. It doesn't matter what the morality of copyright is or is not. This is private, undisclosed and published code. To force it into the public domain would violate every tenet of liberty.

      --
      A Government Is a Body of People, Usually Notably Ungoverned
    7. Re:Scandelous by Arandir · · Score: 2

      In this case, yes, it is, because "intellectual" "property" is really neither. It's a temporary monopoly generously granted by the state

      Actually in this case the code is still private property no matter what philosophical fence you decide to sit on. This code has not been published, disclosed or distributed. You do not have the right to redistribute it for the elementary fact that you do not have a copy of the code.

      --
      A Government Is a Body of People, Usually Notably Ungoverned
    8. Re:Scandelous by davmoo · · Score: 2

      What we need are more people in the world who don't have knee-jerk reactions that start with "we need some laws...". While you're sick of companies that keep what is going in to the dustbin, I am sick of people telling others what to do with product that THEY don't own and didn't create.

      If you write some code and want to give it away, please do. If you write some code, sell a package, decide you don't want to screw with it any more and then give it away, that's great of you too.

      At the same time, if I write code and make some neato package, you are perfectly welcome to politely suggest how I distribute it. But in the end, its the owner's choice, not yours, and if you don't like it, tough shit.

      I wish NAI would release the code under [insert free (speach and beer) license of choice here] so that development can continue. I wish PZ hadn't sold it to them in the first place, but as I state above, his code - his choice. But the first legislative attempt to FORCE them to release the code will plant me firmly on the side of NAI.

      And that's my opinion for any other piece of orphanware, abandonware, garbageware, nolongerwantedware etc etc. I too wish that companies would find it in the goodness of their hearts to release code they are no longer going to support or use. But its THEIR code, and NO ONE should have the right to FORCE them to do ANYTHING with it.

      The thing that depresses me the most these days when I read /. and postings on /. is how quick people here are to totally ignore the licenses and rights of others, but are equally quick to pounce on anyone who violates the GPL. And that just makes the fight for Free Software that much harder. Its getting to the point where everyone assumes we're just a bunch of loud mouthed hypocrits.

      --
      I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
    9. Re:Scandelous by Anonynnous+Coward · · Score: 1

      In return for the having been able to keep the source closed to market the product, they should be compelled to disclose the source when they cease doing so, then.

    10. Re:Scandelous by Simon+Garlick · · Score: 1

      Imad's 6.5.8ckt build 07, based on the 6.5.8 source, is in beta now and will be released shortly. The Win32 binaries have been fixed to be compatible with Windows XP. So NAI won't release an XP-compatible 7.x? Who cares?

    11. Re:Scandelous by puppet10 · · Score: 2

      However if it is in the best interests of the governed the government does have the right/duty to suspend the intellectual property rights of a company.

      For example the intellectual property rights on certain AIDS medications have been suspended in Brazil.

      Although the software question doesnt really rise to the same bar, since its not really/usually a life or death issue, it doesnt mean that there would never be a case where the needs of the public would outweigh the harm done to the individual even for software (although I couldn't come up with any at the moment).

      I respect the rights of an author to control their work, however I also feel that holding on to a piece of property effectively forever that you never intend on doing anything with just for the sake of controlling it (in particular IP) is miserly, anti-social and relegates it to be forgotten forever adding nothing to the human condition. (However these decisions are only sometimes made by the original developers, often instead being relegated to some company that owns the code the developers produced, or bought said company or the work is already completely forgotten by everyone and no one really knows who owns it anymore).

      --
      -------- This space intentionally left blank --------
    12. Re:Scandelous by GileadGreene · · Score: 0, Offtopic
      I don't know whether to call you a fascist or a communist. Either way, you may want to rethink your somewhat contradictory stance on privacy. You appear to want to force a private entity to release private information in order to allow other private entities to better protect their privacy. How's that again?

      I'm not even going to start on what a mockery your law would make of private property and personal freedom...

    13. Re:Scandelous by Hard_Code · · Score: 2

      "If you want software they wrote and they won't give it to you, find an alternative, write it yourself, anything else.."

      The whole *point* is the avoid this vast duplication of effort. If a company has created something which has value to the public which it refuses to sell, and in fact is just going to dissolve, *why* shouldn't the public have access to it? How is this a silly or tragic law?

      --

      It's 10 PM. Do you know if you're un-American?
    14. Re:Scandelous by swv3752 · · Score: 1

      Constitutionally, you are wrong. We, the people, have every right to force someone what they do with copyrighted material. I am so sick of how everyone is so willing to give up thier rights. This is why we are in the mess we are with the DMCA, SSSCA, and Mickey Mouse Copyright Acts.

      The Constitution grants the exclusive rights to an Author for a limited time. After that time, the material becomes Public Domain. We absolutely should be requiring that anyone that wants software to be copyrighted that source code gets placed in a vault. When various conditions are met (such as abandonware, length of copyright is up, or other reasons), the source code should be released as Public Domain.

      --
      Just a Tuna in the Sea of Life
    15. Re:Scandelous by tswinzig · · Score: 2

      We need some laws that force work into the public domain if it wont be exploited for the private domain.

      So you're saying if I create something really great, and decide not to sell it or let anyone use it, that there should be a law where you can come and take my creation and put it in the public domain?

      This is called socialism.

      Please move to China.

      --

      "And like that ... he's gone."
    16. Re:Scandelous by tswinzig · · Score: 2

      However if it is in the best interests of the governed the government does have the right/duty to suspend the intellectual property rights of a company.

      Says you. I personally don't trust any government to decide what is "in the best interests of the governed."

      For example the intellectual property rights on certain AIDS medications have been suspended in Brazil.

      Yes, Brazil, that great bastion of liberty...

      I respect the rights of an author to control their work

      No, you clearly don't.

      --

      "And like that ... he's gone."
    17. Re:Scandelous by Wumpus · · Score: 1

      Basic freedom. It's nobody's business what I do with my property and with my time.

    18. Re:Scandelous by Malcontent · · Score: 2

      That's becasue you are a human being. A corporation on the other hand is a legal entity. A corporation has different set of rights then you do. A corporation was given many many benefits that are ot available to human beings because it was in the public interest to do (theoretically anyways). For example a corporation pays taxes under a completely different structure then then you.

      Once a corporation is not acting in the public good, or if a corporation can be made to act in the public good without harming the corporation or the shareholders there is nothing wrong with compelling them to do something.

      In the case of this software the corporation decided not to sell it anymore. It would do no harm to the corporation or it's shareholders to release it to the public and it would do the public a lot good.

      --

      War is necrophilia.

    19. Re:Scandelous by Malcontent · · Score: 2

      Yet the fact remains. Corporations are not human beings and software is not gardening tools. It's possible to stretch analogies too far and in this case I think you have just that.

      Corporations are routinely held to different standards then human beings. Nothing new about that.

      --

      War is necrophilia.

    20. Re:Scandelous by Malcontent · · Score: 2

      "Yes, Brazil, that great bastion of liberty..."

      It was a tough choice. Respect the IP rights of a foreign company and let a few hundred thousand people die, strip the IP rights from that company and let your citizens live. In the US there would be no question we would let the people die. In brazil apparently the govt cares more about it's citizens then the IP rights of foreign corporations.

      Yes it seems like a weird concept but I guess that's the way those foreigners think.

      --

      War is necrophilia.

    21. Re:Scandelous by Malcontent · · Score: 2

      Why is red baiting popular again all of a sudden. Jesus I feel like I have been thrown back into the fourties.

      --

      War is necrophilia.

    22. Re:Scandelous by Anonymous Coward · · Score: 0

      I believe what you're talking about as the "inefficiency" in the market, is really the market showing what they value PGP at _under the current structure_.

      Remember all the problems Zimmerman ran into? You need a really strong business case to want to run into those sorts of problems, especially at a cost of a few million dollars. The market for encryption is more dangerous than previously, since the government may change the laws at any time. And even looks likely to. . .

    23. Re:Scandelous by Arandir · · Score: 2

      Huh? Are you saying they should disclose the source when they stop not disclosing the source? I don't get it.

      --
      A Government Is a Body of People, Usually Notably Ungoverned
    24. Re:Scandelous by Anonynnous+Coward · · Score: 1
      That's right--if they want to sell the product, and be entitled to copyright, then they should be compelled to disclose the source after they stop selling the product or when the copyright expires. (Of course, copyright shouldn't be an effective eternity, either.)

      This way, the only legal way to close the source would be to either never offer it as a commercial product or to put the closed source version in the public domain without ever having sold it.

    25. Re:Scandelous by Bob+Uhl · · Score: 2
      And now corporations are discouraged from doing the necessary research and development to create new medicines. If they make it, it'll just be freed by some penny-ante nation and the drug company can never recoup its investment and make a profit.

      And so we end up without medicines which would have been possible. Yeah, that's really smart.

    26. Re:Scandelous by Anonymous Coward · · Score: 0
      And now corporations are discouraged from doing the necessary research and development to create new medicines. If they make it, it'll just be freed by some penny-ante nation and the drug company can never recoup its investment and make a profit.

      However this is only half of the story. In the other half of the story, your very kind drug companies have used third world people as guinea pigs for all possible medications, under conditions that are not possible in the US (not legally possible, or not financially interesting - in the US you could be sued for slight negligeance, in some other countries, you can get away with almost everything less than direct murder, ignoring fundemental security rules to cut slightly your expenses...). Corporations needed badly those guinea pigs to win the race to the very profitable patent of the first effective medication against AIDS. After they found effective medecines, they could sell them with a profit to Western Countries (the only interesting market to them, mind you, they can calculate), they shut down the working experiments ... the most odious consequence is that the third world human guinea pigs who proved some treatment was working, were no longer be given medication and most of them are dead now. After all, why waste more shareholders money on them? Only the patent counts, right? I guess they should be grateful for Western Countries drug companies for still having so generously made their life slightly longer ; and their death is nothing to the infinite joy they got knowing that their life served the goal of providing to the Superior Human Beings (the American and Europeans Human Beings), an effective medication against AIDS.

      And so we end up without medicines which would have been possible. Yeah, that's really smart.

      We already end up without medicines which would have been possible. Ever wondered why there is no vaccine, no good treatement of the #1 disease of the world (malaria), another virus, but which has existed for 1000 years, while the more difficult problem to solve, the AIDS was partly solved in what, 15 years, when it started bothering US and Europe?

      Also note, that for another case, anthrax, that killed a handful of people, the US governement was extremely fast to get away with the rule "you must always pay for the research and development of those supremely kind drug companies", and overrided the CIPRO patent. But it's not a real surprise, we already all know by now that the life of a dozen Americans is worth more than millions of African or Brazilian.

      Your lack of information shed light on the fact that some Americans don't understand why some people somewhere don't like them.

    27. Re:Scandelous by Anonymous Coward · · Score: 0
      This is called socialism.

      Not directly, socialism is usually about ownership of companies, and redistributions.

      Please move to China.

      China is as much socialist as the average African country's republic is democratic (i.e. in theory totally, in practice absolutly not).

    28. Re:Scandelous by Malcontent · · Score: 2

      That remains to be seen. Let's check back here next year and see if any new drugs have been developed at all. If there were new drugs developed then you are wrong. Your assertion is easy to test. We'll see next year.

      --

      War is necrophilia.

  23. Mod this crap down. by Anonymous Coward · · Score: 0

    Hello??? DO you have a brain with which to think? The parent comment was about how software being closed source does not necessarily make it secure. Microsoft is an example of someone making software closed source and yet very *insecure*. Damn morons...

  24. Re:MK-Ultra experiments on children by ajs · · Score: 1, Offtopic

    CIA

    A bad start.

    Experiments with Mind Control

    It gets worse

    on Children

    Yep, gotta save 'dem chilluns! Where's the bastard! We'll lynch 'im!

    by Jon Rappoport

    Ok, if you didn't stop before this, you can now. This is the man who claims that AIDS is not a virus, but a secret weapon of the drug companies!

    He's a real tin-foil-hat kinda guy (or just found a market among that crowd).

    The CIA mind-control apparatus has been well known since 1975

    Obviously, I failed to stop. Pardon me, but what is your definition of well known?

    when 10 large boxes of documents were released pursuant to Freedom of Information Act requests.

    Oh, well that's certainly an interesting metric for well known! (later he claims that J.R. is a highly respected journalist, but fails to indicate who respects him....)

    Several good books were then written on the subject of the CIA program known as MK-ULTRA.

    They were good books of course. Not like those powdery, tasteless books you serve your relatives!

    LSD and more powerful compounds

    I live that line. I'm going to have it framed.

    In case you're wondering, as with most nutters, J.R. has hit on a thread of truth, and then run with it to the mythalogical end-zone of his own creation.

    There really were CIA experiments on CIA agents and civilians alike with LSD in the 60s. The CIA thought that it might work out as a truth serum of sorts, but it was not very effective, and had very dangerous long-term consenquences.

    However, much of the rest of this theory is based on these axioms: 1) If you testify about something to a government panel, it must be true 2) the CIA has nothing better to do with its time than recruit children to perform missions that there are scads of willing volunteers in the military for 3) events which have common themes are obviously linked.

    I recommend that you do your own research here. Books like this one are aimed to scare and shock (that's how they sell). If the facts don't fit, they are often... re-shaped.

    If you want to play "spot the loonies" just look for key phrases like "in [document/testemony/etc] the name [government or corporate figure] came up" cited as "proof" that linkage exists between an event and a group that the author wishes to accuse of wrong-doing.

  25. Does anyone have any doubts as to WHY? by andrewski · · Score: 0, Flamebait

    I have this uneasy suspicion that this is directly related to the Dubya-ment's new crackdown on freedo^H^H^H^H^H^H terrorism. Sure I'm paranoid, but the new McCarthyism may be farther-reaching than anyoine thinks.

    1. Re:Does anyone have any doubts as to WHY? by Anonymous Coward · · Score: 0

      Let's see. They announced the PGP sale on October 11... exactly 1 month after September 11. They announced all sorts of layoffs and plans on that same day which would take at least 2-3 weeks to have put together. That means the decision to kill PGP must have been made around September 18. Are you getting more suspicious yet? Start.

    2. Re:Does anyone have any doubts as to WHY? by andrewski · · Score: 1

      Go rub hot oil on your turgid nipples, you gimp.

  26. Re:Scandalous by gartogg · · Score: 1

    Basically, you believe that people should be forced by big brother to share what they developed. This is on par with very few bad ideas that I have seen on /.. If I am an inventor, and I am eccentric enough to want to keep my inventions to myself, it's my business.

    An economic system can NEVER be more intelligent that the people who control it, whether it's the combined brains of a million entrepreneurs, or a communist dictator. The best we can hope for is inccentifying intelligence, which laise-fair capitalism seems to do best.

    (Don't mod me down because you dislike my opinions, but feel free to mod me up if you agree )

    --
    I'm a concientious .sig objector.
  27. Fine then... by sterno · · Score: 2

    So sounds like Amnesty International should pick up the tab for developing PGP. I mean, I grant you, I think that PGP is a wonderful product and I'd like for network associates to keep it, but they are a business and if it's not making money for them, there's no reason for them to keep it around.

    Personally I use GPG and think it works wonderfully, and Network Associates has nothing to do with that. May not have some of the bells and whistles of the full commercial PGP but it still does what PGP has always done, encrypt e-mail. Organizations like AI should be able to function fine with just that.

    --
    This sig has been temporarily disconnected or is no longer in service
    1. Re:Fine then... by Minupla · · Score: 1

      Agreed. I'd point out though that the message I originally replied to seemed to take a more general "Why bother with PGP at all" sort of tone. The orig message has since gotten moderated into the ground, but that's beside the point :).

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
  28. Re:OT by Anonymous Coward · · Score: 0

    SLASHDOT USER 3: open up your asshole as i stick this dildo into your cock

    YHBT, YHL, IMHO, RTFM, ROTFLMAO, IANAL, HAND

  29. "Realistic" solution to save PGP? by Anonymous Coward · · Score: 0

    PGP has always suffered from "realities." It suffered for a while from the US export "laws." It suffered for a while from RSA wanting to be able to cash-in on it's patent used in PGP v1. Now the reality is that the most mature GUI is abandon-ware but there is a "solution" of Apple or HP stepping in. Come on!! Apple and HP are themselves committing to the act of promoting a strong but small following and then abanding them. There was talk of IBM or Sun saving HP OpenMail. How is the "saving solution" for PGP any more practicle than the saving solution which never came to be for HP OpenMail? Because there is a PGP alliance? Hey! Come on! Even the alliance suffers from realities. They claim to be unbias in promoting OpenPGP implimentations but only the "true blue" implimentations of PGP get to make it on the OpenPGP Resources->Downloads page. Why isn't OpenPGP unbias enough to consider GPG as an OpenPGP Resources->Download? Could it be that OpenPGP is not unbias? The reality is this, NAI is does not care about it's past customers just it's future ones. The reality is that OpenPGP is not unbias group looking to help other OpenPGP implimentations but a puppet group of Zimmerman to try to keep his specific pet project implimentation alive. I think NAI PGP should die out as the sell-out close project that it was and "Open"PGP alliance can go with it, only then when these hidden agenda groups are done with can we get enough signal to noise for improving/maturing GPG.

  30. GPG is available, and the Germans are improving it by dwheeler · · Score: 5, Informative
    So, PGP is may not be available in the future. This is no big deal, really, since GPG is already available and can be used as a replacement.

    It's true that currently GPG's user interface is terrible for beginning users if they have to use it directly. So, clearly, you want to use programs that embed GPG (like Evolution). Also, note that the German government is funding further development of GPG. They specifically say that their funding will be used to make GPG more usable by less experienced users, including porting the software to other operating systems, developing graphical user interfaces (GUI) and writing a handbook.

    Thus, this sounds like a short-term problem at worst.

    --
    - David A. Wheeler (see my Secure Programming HOWTO)
  31. Re:I don't get it... (a bit of nitpickery) by HiThere · · Score: 1, Troll

    It's like saying if Microsoft or Netscape decided to stop relasing browsers, then the entire WWW is doomed, when there's still Konquerer, Opera, Mozilla, and the whole W3C standards body, etc...

    This was a lot better before you included the W3C. Many of their recent activities have been ... at best of dubious value. They set the standards on which the web was built, but in the last year they seem to have shifted their purpose. The acceptance of patented "standards", e.g., is totally unacceptable. A patent is a grant of control over an expression of an idea, and increasingly over the idea itself. So the recent W3C activity is a total denial of publically accessible standards, to the extent that I won't use the word to describe their proposals. It is as if PGP (well, Network Associates) had first ensured that nobody else could create any implementation of a secure protocol, and THEN withdrew their package.

    If you delete the reference to the W3C, then your point is quite valid.

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
  32. Re:MK-Ultra experiments on children by Anonymous Coward · · Score: 0

    but it was not very effective, and had very dangerous long-term

    Sorry dude, try again. LSD doesn't cause any long term problems. What can cause long term problems is any tramautic situation, such as being force-administered drugs, or being unknowingly given mind-altering substances like LSD. It is also possible that LSD can cause latent mental disorders to have a quicker onset, but this is mostly speculation, and there have been few documented cases of people who had any permanant changes triggered by an experience with LSD.

    You were correct in that LSD was abandoned as a weapon or a truth serum, but mostly because there were more effective things to use for both uses.

  33. The Windows Version by Greyfox · · Score: 3, Interesting

    The Windows version of PGP was pretty nice and actually hooked in with MS Exchange and other software. No I never actually used it, I specified that communications between my group and a shop we were contracting out to be encrypted with PGP. I used GPG with Linux and they went with the happy windows user interface. Most managers and probably the majority of developers will want to use the Windows version if forced to use the encryption software (By some asshole like me pointing out that transmitting the source code in the clear is a violation of corporate security policies ;-)

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    1. Re:The Windows Version by crush · · Score: 2

      Ah, thanks for the repsonse and an answer to my question as opposed to the weird moderation of my question as a "Troll". I'd never used the Windows version and had only ever used PGP and GPG on linux. I had several problems using later versions of keys generated by PGP with GPG and wondered if there were something like "better" or other encryption algorithms included with PGP. What is it that needs to be interfaced with exchange? I was doing everything through Emacs and it was very nice and easy.
      Cheers,
      Crush

    2. Re:The Windows Version by Greyfox · · Score: 2

      Yeah, but your manager isn't going to want to run Linux or Emacs. And you're lucky if he doesn't try to make YOU run Microsoft project too! PGP and GPG interface well with Emacs and other E-Mail clients but there's always some setup involved by you. Having to do anything other than click "setup" and run install shield makes managers irritable. Which is about all it takes with the Windows version of PGP. Fortunately you can explain how to use it in terms of things they can grasp, so they will actually use those extra menu entries on Exchange once you get a key generated for them and stuff.

      --

      I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  34. eh... by sterno · · Score: 1

    Context is so overrated :)

    --
    This sig has been temporarily disconnected or is no longer in service
    1. Re:eh... by Minupla · · Score: 1

      *grins* isn't it though? ;)

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
  35. If you can't sell it . . . by Anonymous Coward · · Score: 1, Insightful

    then a)it has no value, and you have nothing to lose by giving it away, say, to the FSF, OR b) you can't find the value in it, and so maybe you should let someone else have a crack at it. (Add suggestions for 'someone else' as you see fit, but, of course, my vote goes to Phil.

  36. IMC is already considering along with S/MIME by teambpsi · · Score: 2
    Check out this link S/MIME and OpenPGP


    part of the problem is that the IDEA algorithm is licensed technology from the Swiss company that owns the patent.


    What PGP needs is a pluggable-encryption component, so that it could leverage something like AES

    --

    Old age and treachery almost always overcome youth and skill.
  37. Yes but... by Greyfox · · Score: 2
    I am the only user on my system. If my system has been compromised, they'll install a trojaned binary anyway. Or they'll break in and install a keyboard sniffer. Or extract the data with a pair of needle nosed pliers. It's amazing how much data you can extract with a pair of needle nosed pliers...

    Really, if "they've" already compromised the system to the point where you have to worry about the libraries being secure, you've got bigger problems on your hands than the libraries being secure. The only thing the lack of a library is contributing to is a hampering of programmers incorporating GPG natively into everything from E-Mail clients to network protocols.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  38. Re:Scandalous by gmhowell · · Score: 2

    I think what he was saying (or should phrase it like) is that the government should not offer protections of 'intellectual property' to those who do not market/sell/use it.

    With a large enough gun, any piece of physical property can be defended. Governments exist to keep us from needing guns to do that.

    Intellectual property can ONLY be defended with the use of the government. By removing this government protection from IP that is not used, the market is MORE laise-fare(sp), not less.

    Now, if the government were to take an active roll, such as disseminating IP that is not used, that would be wrong.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  39. Re:A critique of Phil Zimmermann and PGP by Anonymous Coward · · Score: 0

    Great, well thought out troll. You even got me to reply to two of your points. 1)Who says Phil believes that only good guys will use strong cryptography. I have no idea what Phil's opinion really is, but I can't believe that he's stupid enough to believe this. Of course criminals will use strong crypto, as surely as they use telephones, automobiles, airplanes and computers (which I'll get to in a moment.) The important point here, which you carefully avoid, is that good people have crypto available. It really does save lives.
    As for "The use of computers by terrorist groups is well documented. One such example by al Qaeda is in planning a bombing: "A computer used by top al-Qaeda chiefs contains a report of a scouting mission" [3]." Are you now going to suggest that, as well as not encouraging strong encryption, we should discourage the use of computers because the bad guys use them?

  40. One word... by bruns · · Score: 1

    GPG.

    Thats how you save PGP.

    --
    Brielle
    1. Re:One word... by Graymalkin · · Score: 2

      Excellent, a notably confusing and shitty interface. That will definitely propogate the use of cryptography!

      --
      I'm a loner Dottie, a Rebel.
    2. Re:One word... by bruns · · Score: 1

      No more confusing then the pgp command line interface.

      --
      Brielle
    3. Re:One word... by Graymalkin · · Score: 2

      The point of PGP was nobody used the command line interface. If I can't drag my keyring onto a window and have the program import it then I'm not fucking using it.

      --
      I'm a loner Dottie, a Rebel.
  41. Why PGP instead of S/MIME? by Ian+Bicking · · Score: 2
    What is the advantage of PGP over S/MIME? They seem to be answering largely the same problem.

    PGP is a product of its own, which is probably good and bad -- good, because you can use it with non-email, and (awkwardly) with most mail clients. S/MIME would have to be built in, I imagine -- but a couple of easy implementations would bring encryption (and decryption) to many more people than the current situation with PGP/GPG/whatever.

    So why aren't people making S/MIME capable clients?

    1. Re:Why PGP instead of S/MIME? by pablos · · Score: 1

      S/MIME has security flaws built into the specification, such as the requirement to support 40 bit keys. It is based on X.509, and thus inherits a hierarchical trust model. As practiced, this is more troublesome than the ad-hoc web of trust that PGP facilitates. X.509 also uses ASN.1 encoding, which is a bitch for developers. Finally, if you've ever tried to get two S/MIME implementations to talk to each other, you'd know why nobody is behind it.

      All that said, I think there are a few important things to learn from the S/MIME implementations we've seen from Netscape & Microsoft. They are very user friendly and opportunistic about encrypting email. PGP implementations could be done this way in the future as well.

  42. another dead project because........ by Anonymous Coward · · Score: 0

    They actually need to make (gasp!) MONEY from it. too bad slashdot nerds won't pay .....cuz their allowance has been cut off.

  43. Re:MK-Ultra experiments on children by Anonymous Coward · · Score: 0

    "So I totally know that the CIA are a binch of wackos. But when yokels say that a nine year-old has been part of the exps. then I laff and laff and laff."

    This is funny... So you believe MK-Ultra but you refuse to believe that they would experiment on children. Because the CIA has too much integrity for that, right?

  44. Easy to use GPG front end for Mail.app on OS X by SideshowBob · · Score: 2

    http://www.sente.ch/software/GPGMail/index.html

  45. Re:Check this box to BSDL abandonware by Arandir · · Score: 1

    Instead of the GPL, think about the BSD license. Why? First of all, it's not your software. You aren't the developer or the contributor. The BSD license gives you exactly the same rights as a user under the GPL, plus a few more. On the flip side, the BSD license would allow easier incorporation of PGP technology into existing email clients. Remember, it doesn't matter how leet you are for using PGP if no one in the Windows world is using it. The GPL will relegate PGP to the tool-only status, but it should be much more than that. It should be a standard expected in all applications capable of communication regardless of their licensing.

    --
    A Government Is a Body of People, Usually Notably Ungoverned
  46. capitalism at its best by g0hare · · Score: 1

    It sucked or else it would have made money.

    --
    Vote Quimby!
  47. KMail by |_uke · · Score: 1

    I have used both and it seems both Evolution and KMail have about equal GPG integration... Unfortunatly neither seem to do much in the way of generating new keys or specificially associating keys with contacts... Both look in your db for a key that matches the contacts email... Evolution just errors when it can not find anything... Luckly KMail will actually let you choose a public key out of a list if you really need to.

    --
    Luke
  48. RE: Maybe we should think before we POST! by vertical_98 · · Score: 2, Interesting


    In short, 80% of the people who read Slashdot are freeloaders who won't even pay to read their favorite web site.

    What makes Slashdot such a great webpage? Is the ability to (most of the time) read about geek news? Or is the ability to read and discuss a certain post with thousands of technical savvy people?

    I believe it is the second one. If you remove those 80% (the freeloaders) would you have the diversity? You'd probably have a lot less trolls, but I think you would lose a lot of good with the bad.

    I belong to a great LUG which does not charge for membership. If they did, I wouldn't put as much effort into my time there. I try to give just as much as I get. Do I feel that I do? No, not really. I love going and hearing about aspects of Linux that I know nothing about and learning something new.

    To tie that to your post, I feel the same way about Slashdot. I could pay for a news website, and get spoonfeed mass media trash, or exert my brain here on Slashdot. These freeloaders might be the very ones who give great info in AskSlashdot, or mirror slashdotted webpages. Pay to read their favorite webpage? They do! They try to give back to the Slashdot community as best as they can.

    This is not meant to be a flamebait, you will notice I am logged in even. You seem to think cash is the ONLY method of paying for something. You have a lot to learn about life.

    Vertical

    --
    72 CD D7 52 D0 7E D8 47 44 91 D5 84 D1 59 F1 A9-This is my 128bit integer. There are many like it, but this one is mine.
  49. w3c and patents by sab39 · · Score: 2

    You're out of date. The latest w3c patent policy does *not* allow patented standards unless a Royalty Free license is available. There is a loophole in the policy that says effectively "if we hit a brick wall with this policy and can't implement a standard within it, we'll form an advisory group to decide what to do" (with the implicit suggestion that one of the things they might theoretically do is go with a patented standard) but there are a whole lot of hoops that must be jumped through before that point can even be reached.

    Besides, as you would know if you'd done a little research rather than just skimming headlines, the w3c has never *had* a patent policy before, and therefore could easily have created a standard that relied on patented technology. The fact that they haven't is an indication of their general goodwill towards patent-free standards - when they got half-way through SVG and found that apple had a patent on alpha-blending, they stopped what they were doing for ages to try to ensure that the standard would remain patent-free. That was when they started looking into having a patent policy.

    Of course, as a closed organization they first asked their members, who are primarily corporations, and those corporations said "we should have patented standards". Hence their first draft. Then they submitted the draft for public review, and NOBODY NOTICED. After a long comment period with no comments, someone suddenly posted it to slashdot with 2 days to go, and all hell broke loose - and the w3c essentially backtracked and now have a sane policy.

    If anyone is to blame for the poor original policy, it's the fact that the community wasn't alert - it's mindboggling that the "many eyes" that are supposed to make bugs shallow didn't catch a major announcement like that from the w3c.

    Stuart.

    1. Re:W3C and patents by HiThere · · Score: 2

      Umn ... possibly you are correct about the policy revision. I'm not quite sure. But I am not convinced. Yes, they did tone down the acceptance of patents a lot, but I find that remaining trap door unacceptable. Basically it operates on trust. I don't think that any patented mechanism that doesn't have a guaranteed free use policy (a percentage of the profits MIGHT be acceptable) deserver ANY place as a standard.

      Also, the membership policy is such that nearly all of the members of the committee are sponsored by large corporations. So the representatives make choices in what they see as the best interests of their employers. It's true that the open source community now has two representatives there, which is a tremendous improvement, but they aren't in a majority on even a single sub-committee.

      Now it is quite reasonable for an association of manufacturers in an industry, which is what the W3C effectively is, to further the goals of the manufacturers. What I don't find acceptable is for them to make standards with such a goal. That said, up until the last year their actions seemed to be for the general public good, and they had acquired a rather enormous amount of trust from the community. To say that the community should always be watching over their shoulder is in the first place an admission that they are not to be trusted, and in the second place a bit unfeasible. Sub-committee meeting aren't exactly open to the public (and I'm not saying that they should be). But if the members of the committee cannot be trusted to represent the good of the public, then the public cannot trust them. It's more basic than a syllogism.
      .

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
  50. Re:Save it WHY? by e5z8652 · · Score: 0, Offtopic

    Properly used, a one time pad system is unbreakable. And you can send it in plain text.

    An e-mail message would look like this:

    e4sd4 3dkw22 kwdi4 dlw23 jdclp s3dgx and so on and so on.

    Since the code is never used twice, you never get a good enough sample to break it unless you somehow get a copy of the code sheet.

    No PGP needed - just discipline in properly using the system, never re-using a sheet, and destroying old sheets as soon as they're used. And there's very little tech involved aside from the e-mail itself.

    PGP is more convenient, so we might as well save it for ourselves. The bad guys will always have a tool to use.

    --

    null sig

  51. Re:Check this box to BSDL abandonware by dattaway · · Score: 2

    BSD? Are you joking? If I'm going to pay for something to be free, why would I want to subsidize the proprietary products of someone else?

  52. Setting up the right financial infrastructure by WillWare · · Score: 2
    It would be good if there were some general mechanism for the public to purchase pieces of software, and place them either in the public domain or under an open source license of some sort. Since I'd be a beneficiary in many cases, I should (and sometimes would) be willing to cough up some cash to contribute to the purchase.

    But what I really want to do, at least initially, is to promise a payment, which becomes payable when enough other people have promised that the software's current owner agrees to the deal. Inevitably trust issues come up: I might welch on my promise. Or to make things more complicated, I might promise and pay only on the condition of anonymity.

    How to do all this? One way would be to place the money in escrow for a limited time, and if the deal doesn't come together by then, I get my money back. The people trying to organize the deal would give themselves a time limit and encourage donors to set their escrow timers for that time limit. A reputable bank or insurance company (or maybe a casino?) could act as the escrow agent.

    There's a guy named Ronnie Horesh with a very cool idea called social policy bonds, intended to bring market forces to bear on social issues. Government auctions off bonds, which mature when some measurable social goal occurs, and are then redeemable for larger amounts. He once commented that a social policy bond is like a bet. The government hedges its position (that, say, literacy is good) by begging that literacy won't go up. When literacy does go up, the government has to pay up.

    In the same way, if I believe that PGP should go into the public domain, I may hedge that belief by betting Network Associates that they won't do that. They can easily win that bet by releasing PGP, when they decide that winning all those bets is more important than retaining PGP as closed-source software.

    --
    WWJD for a Klondike Bar?
  53. Window gpg by Anonymous Coward · · Score: 0

    The article seems to suggest that windows users are left in limbo. Not so. Check out:

    http://www.winpt.org

  54. Re:Check this box to BSDL abandonware by Arandir · · Score: 1

    No one asking you to pay. Last time I checked you didn't have any code in PGP anyway.

    --
    A Government Is a Body of People, Usually Notably Ungoverned
  55. Am I paranoid? by farrellj · · Score: 2

    It just seems very strange that all of commerical products that provide good encrypted message transfer have suddenly become "unecconomical" for the companies that make them. Especially in this post Sept 11 world? I think there is something fishy here...And I don't like it.

    ttyl
    Farrell

    --
    CAN-CON 2019 - Ottawa's only book oriented Science Fiction Convention! October 18-20, Sheraton Hotel, Ottawa, Canada h
  56. Just use CORBA/Bonobo by cyba · · Score: 1

    Instead of putting GPG into a library you can write a CORBA interface and put Bonobo implementation into separate executable file. No more problems with corrupting GPG internals and it would be accessible from any programming language.

  57. The important parts of NAI's PGP by JKR · · Score: 2, Informative
    The important parts of PGP as shipped by NAI for Windows is NOT the encryption engine per se - this is available from other sources as the command line binary we all know and love.
    The important parts are the Windows infrastructure and the patented protocols that appeared in PGP5.
    The Windows infrastructure is more than just the GUI - the GUI is OK, but nothing special. The infrastructure includes
    • a low level secure storage driver at the OS level
    • integration with many mail clients
    • an Explorer shell extension to handle encrypt / decrypt, secure wipe, and verify functions
    • a secure viewer with anti-tempest fonts
    • the PGPNet VPN solution
    • the PGPDisk secure storage solution
    This is what NAI have paid to develop, and this is why it represents a major loss.

    Jon.

  58. September 11 by Ilgaz · · Score: 1

    N/T

  59. McCarthyism? by Anonymous Coward · · Score: 0

    Where's jamie the fuckwad?

  60. Re:Why? Good question... by fmaxwell · · Score: 2

    Who cares about PGP... if companies and investors are not opting in, there is a reason... ponder that.

    The reason is the complexity. Most people are not concerned with complex key ring schemes, expiring keys, and electronically signing e-mail. They just want a way to encrypt e-mail so that it's not easily sniffed.

  61. PGP in XP by dcviper · · Score: 1

    The Article said that freeware versions of PGP do no work with XP. That is simply not true. I am using PGP 6.5.8, and it runs fine in winXP Pro.

    Also, MIT's PGP Distro site is operating.

    -dcviper

    --
    Ummm, err, say what, now?
  62. Re:Check this box to BSDL abandonware by phaze3000 · · Score: 2
    No one asking you to pay. Last time I checked you didn't have any code in PGP anyway.

    Maybe you ought to look at the post this was a reply-to-a-reply to, or even the post that you replied to.

    You must smoke even more weed than me to have that much memory loss..

    --
    Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
  63. Re:Scandalous by Anonymous Coward · · Score: 0
    An economic system can NEVER be more intelligent that the people who control it, whether it's the combined brains of a million entrepreneurs, or a communist dictator. The best we can hope for is inccentifying intelligence, which laise-fair capitalism seems to do best.

    No. Instead of going for laissez-faire dear to US minds (but not to most other countries, something they don't seem to realize), governement can regulate to prevent non-sense and abuse. Losing Intellectual Property rights on unused material was the initial proposal. You can debate this, or the more dangerous related problem, companies buying a whole set of competitive technologies' patents just to bury them because they would kill their core business.

  64. Life or death software by kiwipeso · · Score: 0

    PGP is good enough to save the lives of political dissidents in africa, asia & south america from repressive governments reading their email.
    There are numerous examples of windows being used in life or death workplaces and failing the user.
    The US Navy once had to tow a Aircraft Carrier back to harbour just because Windows 95 died. What would happen if the Aircraft Carrier was in a warzone?

    --
    - Kaos games and encryption systems developer
  65. That was NT I believe by BLKMGK · · Score: 1

    Steering systems were apparently being run under NT in some way. I cannot imagine anyone feeling WIN9x was ever suitable for a mission critical application like that but possibly NT. That they apparently didn't have a suitable mechanical backup is telling - no chance of power being knocked out to that system during an actual fight? No chance of the computer hardware taking smoke damage and dying? Who builds these things?!

    --
    Build it, Drive it, Improve it! Hybridz.org
    1. Re:That was NT I believe by kiwipeso · · Score: 0

      I know it happened about 6 years ago, I have the clipping somewhere... The US military is stupid, who else would pay more than $10k for a hammer or a toilet seat?

      One things for sure, it gives the Blue Screen of Death a whole new meaning...

      --
      - Kaos games and encryption systems developer
  66. Re:MK-Ultra experiments on children by ajs · · Score: 2

    Sorry dude, try again. LSD doesn't cause any long term problems. What can cause long term problems is any tramautic situation

    That's like saying that cars don't cause injury, getting into accidents in cars causes injury. True, but LSD puts the user into a state where they can become very agitated by even the most mundane of circumstances. It essentially creates traumatic situations.

    LSD is not the demon drug that it has been labeled as, but having seen some friends take mental nose-dives on acid, that have lasted for months, I have to say that it's not exactly as safe as houses either. It's major saving grace is that it's not addictive. So, as long as you don't a) get locked into some "I need the drug to see the aliens" physchosis and b) don't use it as a gateway to other (addictive) drug use, it's easy enough to stop using it if there's a problem,and then seek help.

    I think we're both basically on the same track here. I just don't belive in sugar-coating the dangers of mind-altering drugs of any kind (and I include drugs that doctors give out like candy without really understanding, here).