Zimmermann Suggests Freeing PGP Source

broody writes "NewsForge has an interesting article detailing Phillip R Zimmermann's lament at selling PGP. Since he cannot afford to buy it back outright, he is pushing for Network Associates to 'open source' it. Well, the GUI and SDK anyway. I'll say this, he's an interesting little capitalist."

Comments

Re:Free PGP? How about GnuPGP

[cygnusx]

GnuPG (not GnuPGP) dont work in Windows

GnuPG _does_ work on Windows: http://ftp.gnupg.org/gcrypt/binary/gnupg-w32-1.0.6 -2.zip

But it's not graphical. For that, I've been using WinPT for some time. It's a pretty good replacement for PGPtray, not as pretty though. And it imported all my PGP 6.x/Win Keys fine too. Download with all dependencies here

close

[martissimo]

but the article states that you can modify it and run the modified version on your machine, you just can't redistribute the modified code.

With the source code able to be modified, it might be easy for some people to think of PGP as Open Source. "You could modify it if you wanted to, and run it on your own computer, but you could not distribute a modified version," Zimmermann explains

Anyways, i dont think NA has any obligation to do as Zimm asks, he sold it to em, and it's now their's to do with as they please, even if that means that they let it just die basically. It's a shame but it is their right to do so.

Re:Commercial VPN client.....

[tzanger]

What sucks is they dropped the commercial VPN client totally, the freeware version is still around (or was a couple weeks ago) but it only supports machine to machine, no machine to network connectivity, that was only in the commercial version.

That doesn't suck at all, unless you're using Win95/98. Win2k has built in IPSec and it works quite well with FreeS/WAN (I am using it every day). vpn.ebootis.de (funny name, great documentation) shows you how to patch FreeS/WAN to use X/509 certs, and how to generate the certs, and how to make win2k and FreeS/WAN play nice together. PGPNet for Win2k was a little bit of a goofy thing.

Re:Dead Man's Switch

[Bruce Perens]

This is sort of like source-code escrow, but not customer-specific.

In source-code escrow, the vendor promises to provide the source-code to the customer if the vendor goes out of business.

The problem is that bankruptcy courts often overturn source-code escrow clauses, because the source code turns out to be the firm's only salable asset.

The best solution is to free the code first, and for the customer to be careful not to become dependent on closed-source.

Bruce

Re:Free PGP? How about GnuPGP

[cygnusx]

> Or from Outlook, FWIW

Ah, actually there a plugin for Outlook _Express_ available now. GPGOE. Outlook will take some time -- and hacking on the office dev kit -- I guess. But yes, I get what you mean about "dont work well", but I can tell you it's getting better fast! And if you can, do give WinPT a try. You may be surprised.

Re:Free PGP? How about GnuPGP

[1010011010]

It does work in OutLook. I'm using it right now.

Go get it here:
http://www3.gdata.de/gpg/

GPGDisk?

[sysrequest]

The only piece I really use is the PGPdisk feature. Creating a totally encrypted virtual harddrive is very cool.

I create 649 / 699 MB PGPdisks, fill them with my 'backups', "unmount" them, and then burn them onto CD. Voila, encrypted CD contents. Works beautifully.

It would be the coolest thing in the world if GPG was able to mount the same PGPdisks. Heck, even using other filesystems should be possible.

It's great for keeping data private (as long as the encryption will hold, a couple of years longer maybe).

Once GPG can at least mount and hopefully also create "GPGdisks", I'll ditch PGP.

Re:Dead Man's Switch

[Bruce Perens]

I lost the original case but found the following on google - there's more there. The first two citations here directly address the bankruptcy issue:

• http://my.ais.net/~lawmsf/articl15.htm
• http://www.wernick.com/Articles/1986Jun01%20Sour ce %20Code%20Escrow.pdf
• http://www.softescrow.com/faq.html

Thanks

Bruce

Enigmail

[Anonymous Coward]

Try out Enigmail [http://enigmail.mozdev.org/].

Enigmail is a "plugin" for Mozilla/Netscape7 Mail which allows users to access the authentication and encryption features provided by the popular GPG and PGP software (see screenshots). Enigmail is open source and dually-licensed under the GNU General Public License and the Mozilla Public License .

Windows users: try GPGshell with Nullify GnuPG

[Jim Efaw]

I was using WinPT for a while, until I stumbled on GPGshell. It calls GnuPG to do the work, so you never have to worry about entering your passphrase into a GUI. IMHO, it's a lot nicer than WinPT. When you install it, you get 3 programs, which don't need each other to work:

• GPGkeys, a program to do manage all the keys.
• GPGtray, which has a lot of the options on the system tray, and magically knows the "right" thing to do with the clipboard if you double-click it. Highlighting a PGP key in a terminal window then double-clicking on an icon makes importing keys really slick.
• GPGtools, which lets you drag-and-drop files onto it.

So anyway, here's what you do:

1. Get GnuPG (1.0.7 or later) from Nullify. It comes with an installer, plus contains those sinful patented algorithms (like IDEA) that PGP was fond of using in various versions.
2. Get GPGshell, install, and tell it where you put GnuPG.

So far this setup has had no problem dealing with any PGP messages I've encountered, from 2.6.2 to 7.x, but I haven't tested it extensively.