Zimmermann Suggests Freeing PGP Source

broody writes "NewsForge has an interesting article detailing Phillip R Zimmermann's lament at selling PGP. Since he cannot afford to buy it back outright, he is pushing for Network Associates to 'open source' it. Well, the GUI and SDK anyway. I'll say this, he's an interesting little capitalist."

Comments

Free PGP? How about GnuPGP

[(H)elix1]

Why bother? Its gone, sold, IP traded for cash. He knew what hw was doing when it was traded for money. If he really wants to do something, GnuPGP would probably welcome him with open arms...

Why listen to him?

[BFD_Jon]

If this guy sold PGP five years ago, what authority does he have now to suggest the change?

Re:Why listen to him?

[Cally]

> If this guy sold PGP five years ago, what authority
> does he have now to suggest the change?

"This guy" developed the PGP protocol, and it's first implementation, then released it freely on the Internet when it seemed likely the US Govt. was about to criminalise *all* personal encryption.

So, only moral authority... which doesn't seem to be worth much on the free market, these days.

Re:Why listen to him?

[GodInHell]

If it were sold in Europe and treated as Art, which code can be, than Zimmerman would have full authority to audit and suggest changes in course on any future revisions on his 'art'.

Is Code a product, or a design, design's are art, objects are property.

-Gih
Didn't you read the sign? Accepting this lawnmower at discount enables us to come install this here billboard on your yard! Damn illiterate lawn users.

Re:Why listen to him?

[Anonymous Coward]

Not only that, but he was involved in a legal quagmire for quite some time, thanks to the U.S. government classifying encryption as a munition. It is hard to blame the man for selling PGP when his legal expenditures probably placed him in quite a bit of debt.

We should all be thankful that Phil was willing to stand up for something like this.

Re:Why listen to him?

[nomadic]

what authority does he have now to suggest the change?

Over here we call it the "First Amendment".

Re:Why listen to him?

[klykken]

Fact is, we need him with us more than ever. If not as GnuPG contributor, then as a speaker of technology/crypto and the freedom of the people. In both the U.S. and Europe, the 1984 ghost is materializing.

Commercial VPN client.....

[jsimon12]

What sucks is they dropped the commercial VPN client totally, the freeware version is still around (or was a couple weeks ago) but it only supports machine to machine, no machine to network connectivity, that was only in the commercial version.

Re:Commercial VPN client.....

[tzanger]

What sucks is they dropped the commercial VPN client totally, the freeware version is still around (or was a couple weeks ago) but it only supports machine to machine, no machine to network connectivity, that was only in the commercial version.

That doesn't suck at all, unless you're using Win95/98. Win2k has built in IPSec and it works quite well with FreeS/WAN (I am using it every day). vpn.ebootis.de (funny name, great documentation) shows you how to patch FreeS/WAN to use X/509 certs, and how to generate the certs, and how to make win2k and FreeS/WAN play nice together. PGPNet for Win2k was a little bit of a goofy thing.

Re:Commercial VPN client.....

[benjamindees]

Yeah, that does suck. I was just looking for this yesterday, to use with Gibraltar Firewall. Many home users still use 95/98/Me and upgrading a gaming PC to Windows 2000 is like pulling teeth compared to installing a third-party VPN client.

It should be practice

[www.sorehands.com]

If a company is going to dump a product, they should open source it.

If they can't make money with it, and they don't plan on it, it could be used to build will and advertising. Part of the requirement would be to leave in the advertsing banners. Or require some form of license for inclusion into other commercial software.

Note that they have not conceeded that PGP cannot be sold off, yet.

Re:It should be practice

[MisterBlister]

While that sounds good in practice, there's a ton of issues that stand in the way of this becoming common practice.

The primary issue is that open sourcing previously closed source applications is not something the company can do for free. There's a ton of legal issues that must be considered (use of third party code, etc, etc) before a release can be made, that costs time and it costs a lot of money in most cases.

Then you hit secondary issues like shareholder reaction to the company not only giving its products away for free to whoever wants them, but also giving source code and thus some perceived competitive help (even if its not true) to the company's competitors.

All in all, there are a lot of headaches involved. Its not something most companies will do unless there's some direct market benefit for them, ala commoditizing a compliment (see here).

Re:It should be practice

[dberger]

If a company is going to dump a product, they should open source it.

Great theory - it'll never work in the large. Large projects are often encumbered with 3rd party licenses (like for crypto libs, or O-R mapping tools, or the ever despised^?popular RogueWave components) which can't be extracted to produce a usable body of code and clearly can't be opensourced...

Re:It should be practice

[MisterBlister]

id is a private company (no pressure or threat of legal action from shareholders), and small enough by far that they can reasonably know exactly what third party depenencies might exist in their code without assigning a committee to investigate it.

The vast majority of software companies are nothing like id on both of those accounts.

Re:It should be practice

[schon]

If a company is going to dump a product, they should open source it.

If you have a lot of cash in the bank you should give it all to me.

Actually, if you're trying to draw an analogy, you should have said "If you have a lot of cash in the bank and you're going to throw it in the trash, you should give it to charity instead"

Of course, this completely screws your point of view, right?

Re:It should be practice

[www.sorehands.com]

If there are commercial libraries, then release the source, with the caveat that to build it you need that/those library. They could also release the binaries.

good newssource?

[gol64738]

not to bash slashdot, but why is it that Linux Today always posts the latest linux stories at least half a day before slashdot does?

anyways, on a side note, i think zimmerman is in the wrong here. if he is so concerned about the concept of pgp, then why isn't he focusing his efforts on GnuPG, which is a completely open version of the PGP concept?

Re:good newssource?

[_Sprocket_]

He's concerned about having a decent product out there that everyone can use. GnuPG is great, but not everyone is willing/able to use it without a pretty GUI attached to it.

Then use one of the many GUI's or email clients / plugins that support GnuPG.

Re:Free PGP? How about GnuPGP

[Neon Spiral Injector]

No, they probally wouldn't. The IP belongs to NA, and I think he has probally seen the source code, so Gnu couldn't claim their code was a clean room implimentation.

Umm.

[MisterBlister]

Maybe he should have thought about that before selling it?

Considering Network Associates isn't developing it further, I somewhat see his point, but I don't see how he really has a say in the matter.

Re:Free PGP? How about GnuPGP

[jeffy124]

PGP is very good in Outlook for email and within Windows for it's other features. Not making it available for Windows leaves people stuck in Windows with only proprietary options bundled in with Outlook/Windows, or those supplied by other vendors. GnuPG (not GnuPGP) dont work in Windows (well, it might via cygwin, but I'm not counting on it).

Re:Why bother?

[Cally]

>Why should we care what Network Assosciates's
>proprietary privacy software does? There's no good
>reason one can't write their own Public Key >Encryption software

Because another Free implementation - of anything - will always be useful.

What about....

[eyegor]

What about doing what Microplanet did with their Gravity news reader and making it freely available in binary format for all to use?

That way they don't have to give up the rights to it, but still have a loyal base of users. When they're able to make a buck off PGP again they can add some "must-have" features and the customer base will slowly come back to the commercial fold. As it is, the freeware versions will dominate and eventually PGP will be forgotten by most people.

Re:What about....

[CaptainZapp]

What about doing what Microplanet did with their Gravity news reader and making it freely available in binary format for all to use?

Because that reduces the credibility of the product to basically zero.

It doesn't matter if you understand the source, or are a crypto expert. If you can't analyze the source and compile it yourself, the product is essentially worthless from a crypto perspective.

Dead Man's Switch

[peterdaly]

His idea for a Dead Man's Switch license would be very interesting to see implemented. It would be nice to see something like that used in a lot of commercial software.

Think of all the software that might still be available if they had such a clause in their license. Hell, just the games!

-Pete

Re:Dead Man's Switch

[Bruce Perens]

This is sort of like source-code escrow, but not customer-specific.

In source-code escrow, the vendor promises to provide the source-code to the customer if the vendor goes out of business.

The problem is that bankruptcy courts often overturn source-code escrow clauses, because the source code turns out to be the firm's only salable asset.

The best solution is to free the code first, and for the customer to be careful not to become dependent on closed-source.

Bruce

Re:Dead Man's Switch

[kalidasa]

His idea for a Dead Man's Switch license would be very interesting to see implemented. It would be nice to see something like that used in a lot of commercial software.

They used to have that. It was called copyright. One got a fixed term of copyright, could renew it for a small fee after that term to extend it to 75 years (net, not additional), and then it would go public domain after the 75 years were up. Then someone thought of the Berne Convention, and someone else thought of the Bono Bill, and someone else thought of the DMCA . . .

Re:Dead Man's Switch

[eli173]

I think BitKeeper had a "dead man's switch" clause that would place BitKeeper under the GPL, but I can't find it on the web site...
I found some info here, but it doesn't address the "dead man's switch".

Re:Dead Man's Switch

[gwernol]

In source-code escrow, the vendor promises to provide the source-code to the customer if the vendor goes out of business.

The problem is that bankruptcy courts often overturn source-code escrow clauses, because the source code turns out to be the firm's only salable asset.

Sorry to follow this a little off-topic, but this is interesting as I'm currently working with a commercial third party and we have a source-code escrow clause exactly of the sort you mention. Can you cite any specific cases where these have been overturned? I ask not because I disbelieve you but because it would be good to have case law to show my management so we can evaluate the risk of this happening to us (we're not confident of the future stability of the third party).

Re:Dead Man's Switch

[Bruce Perens]

I lost the original case but found the following on google - there's more there. The first two citations here directly address the bankruptcy issue:

• http://my.ais.net/~lawmsf/articl15.htm
• http://www.wernick.com/Articles/1986Jun01%20Sour ce %20Code%20Escrow.pdf
• http://www.softescrow.com/faq.html

Thanks

Bruce

Re:Dead Man's Switch

[FunkyChild]

I agree with the sentiment, but there's nothing in copyright law that commits people to releasing source code once the copyright term has finished. All it means is that you can re-distribute the copyrighted material (most usually the binaries) at will, legally. If the source code was never released to the public, there's no law that forces you to suddenly make it available.

Re:Dead Man's Switch

[DavidTC]

Yes, and no.

The problem is that software is a combination of trade secret and copyright, in a sense.

If the publisher of, say, a book, stops producing copies of that book, and doesn't renew it, it goes public domain. (And it's supposed to be about 20 years, not 75. Damned Mouse.) With a copy of the book, you can make more copies of the book, or modify it.

Software is unique because you don't get all of it. Sure, you don't get the script of a TV show when it falls into the public domain, but you can recreate the product by transcription. Anything besides software, you can take the 'tangible form' and recreate 'the source' from it, and build it again. (Note things have to be in a 'tangible form' to be copyrighted, you can't copyright, for example, a non-taped performance of a play, but that's okay because no one can copy one of those. You just copyright the script first.)

I think that software companies should have to submit all source to the copyright office for exactly this reason. The concept of things falling into the public domain includes them being in a useful state when they do, and software won't be.

Re:Dead Man's Switch

[Deven]

I think that software companies should have to submit all source to the copyright office for exactly this reason. The concept of things falling into the public domain includes them being in a useful state when they do, and software won't be.

I agree, and there's a good public-policy argument to be made here. Too bad the "content industry" has convinced Congress that the purpose of copyright is to enrich them, and the "copyright bargain" has been completely forgotten. Of course, for this to work, you'd have to reverse the Berne convention and go back to requiring copyrights to be registered. (Which probably would be a good thing for the public interest as well, but that's another point.)

Re:Dead Man's Switch

[kalidasa]

I think that software companies should have to submit all source to the copyright office for exactly this reason. The concept of things falling into the public domain includes them being in a useful state when they do, and software won't be.

Of course, for this to work, you'd have to reverse the Berne convention and go back to requiring copyrights to be registered. (Which probably would be a good thing for the public interest as well, but that's another point.)

The copyright office's Circular 61 requires that much of the source code be submitted with a copyright registration request, about 50 pages, with trade secrets blacked out. One could imagine a copyright reform requiring that registrations, to be accepted, must be accompanied by the entire uncensored source code of the work to be copyrighted, and that trade secrets which are patentable would be required to be patented before copyright is registered, obviating the need for blocking out trade secrets in the source code. Unregistered works would not get the more onerous protections of the DMCA, but just the standard Berne Convention protections. Of course, the producers would be up in arms. Can you imagine how MS would feel having to register an entire hard copy of the Windows source code to get protection under the DMCA?

BTW, in case it ain't obvious, IANAL.

Re:PGP Source already open

[autocracy]

Uh, that's great, but they still own it. Yes, you can look at the code, but you can't use or modify it without their consent - which I don't think that they intend to give. Open source means that you get those benefits.

GPG is just fine but GUI needs work

[saphena]

PGP being sold out was the inspiration for the OpenPGP project which generated GPG, a perfectly good alternative to PGP.

The only real problem with GPG is the comparative lack of high quality "mere end user" facilities such as a good GUI.

Let's all dump PGP, it's served its purpose and its time is done. Put your effort into making GPG (real open source!) widely accepted and used.

Re:GPG is just fine but GUI needs work

[Anonymous Coward]

Why not check out WinPT?

They have a nice little frontend for GPG that can sit in your system tray, and related projects bring GPG in to the Mozilla and Eudora mail clients as well. Plus, it's GPL'ed.

That's only for Windows, but I'm sure there are plenty of good GPG front ends for Linux and other Operating Systems as well.

I've switched, and I'm not looking back.

Re:GPG is just fine but GUI needs work

[_Sprocket_]

It might be worth noting that WinPT isn't the usual front-end / GUI shell like the old PGP days. WinPT actually uses GnuPG's new API called GPGME.

A thought

[Real World Stuff]

Since he developed PGP, why not develop a RGP, or Really Good Privacy. He can keep this one open, and it can compete with the closed source version.

It offers the liberty of being Free and Free.

Just my .0199999999

Sad for Zimmerman but irrelevant

[mikehunt]

When Zimmerman sold PGP, what did he expect? That people would start paying
Network Associates money to use something that most people still don't
see the need for?

Forget it Phil. You killed PGP when you sold it. GPG is there take over from
PGP and make sure that those who understand the need for good encryption still
have some reviewable source to trust.

Re:Sad for Zimmerman but irrelevant

[eyegor]

Perhaps he should buy it from them for what he paid. Then he can do with it what he wants.

Re:Sad for Zimmerman but irrelevant

[Anonymous Coward]

Actually, there is lots of companies that would pay lots of money for a product like that, NAI charged way to little.

There are quite a number of IT-related companies run by people who are just clueless when it comes to business.

Re:Sad for Zimmerman but irrelevant

[_Sprocket_]

When Zimmerman sold PGP, what did he expect? That people would start paying
Network Associates money to use something that most people still don't
see the need for?

Maybe he expected a large company like Network Associates might know how to properly market and maintain the product. Its seems that if that assumption was made, it was incorrect.

Re:Free PGP? How about GnuPGP

[caca_phony]

he has probally seen the source code, so Gnu couldn't claim their code was a clean room implimentation.

Nothing of the sort is neccisary. BSD unix was a non-cleanroom reimplimentation of AT&T unix. BSD won when it went to court. It is easier to be cleanroom though.

Re:Free PGP? How about GnuPGP

[cygnusx]

GnuPG (not GnuPGP) dont work in Windows

GnuPG _does_ work on Windows: http://ftp.gnupg.org/gcrypt/binary/gnupg-w32-1.0.6 -2.zip

But it's not graphical. For that, I've been using WinPT for some time. It's a pretty good replacement for PGPtray, not as pretty though. And it imported all my PGP 6.x/Win Keys fine too. Download with all dependencies here

I doubt it will happen

[Aknaton]

Didn't I read where they were "asking" people to remove copies of PGP for download, even though they didn't offer or support PGP anymore?

Doesn't bode well, if you ask me.

Unreleased Updates

[MacDork]

I've read on numerous occasions that NA has versions of PGP updated to run on OS X and XP, but aren't releasing them. Something to do with 9/11 maybe? It seems stupid to simply throw away a defacto standard.

Let's hope the geeks here make that problem irrelevant. So far the Mac side is doing *OK* with tools like GPG Tools, GPGMail, and Apple's own AES encrypted volumes using Disk Copy. However, syncing with key servers, file wiping and other functionality available in PGPFreeware is sorely missed. Maybe Phil Z should start a company focused on GPG rather than wasting his energy trying to get PGP open sourced...

Re:Unreleased Updates

[zulux]

To stroke the black helicopter theories...

Several friends of mine work at Microsoft, and apparently, according to one of them - important government types have been at the Microsoft campus. This gist is that has somthing to do with the whole DRM/encryption thingy.

It makes sense in a odd sort of way - if the govenment could get a back door into the worlds most popular operating system, they would have a goldmine. I'd be disapointed in the NSA if they diden't try.

Re:Unreleased Updates

[fferreres]

Some people just can't realize that if Microsoft can access you computer (DRM enforcing, Windows Update, Whatever), then the Goverment does as well. I cannot think of any reason why Microsoft would fight against goverment access. After all, they are their BEST allies.

What do they have to lose? If it ever gets public they'd say "How, they forced us, to prevent terrorism. There's nothing we can do. It's the price for our societies safety. We are glad we are helping our people win against terror".

We could do a poll about this topic, and see what the crow thinks.

Re:Unreleased Updates

[God! Awful]

I've read on numerous occasions that NA has versions of PGP updated to run on OS X and XP, but aren't releasing them. Something to do with 9/11 maybe? It seems stupid to simply throw away a defacto standard.

Why is the immediate reaction to news like this on Slashdot always a conspiracy theory? Have you considered the possibility that companies like NAI (which are in business to make money) simply don't see any reason why they should give a product away for free? They paid good money for PGP and it turned out to be a real turkey.

Apparently they still sell the command line version. In an odd-case of open source business cases reversing themselves, Phil wants them to open source the GUI. If they do that, how long will it be before someone writes an open source set of command line tools? I guess they could release it with a special license that prohibits you from developing command line tools. Of course, someone would do it anyway and lawsuits would ensue.

The whole dead man's switch thing is pretty funny. Basically what Zimmerman is saying is "here's a product that I know is going to drive you into bankruptcy, so I'm taking advance precautions." If you really want the program then go buy it. Get together a consortium of interested parties and start a fund to buy back the rights. Of course, it would never work, but that's never stopped people before.

-a
The advantage of the GPL is that your customers can maintain and upgrade your software, even after you go bankrupt.

Re:Unreleased Updates

[linzeal]

that would be the death knell of microsoft or any company.

Re:Unreleased Updates

[fferreres]

Not sure. The goverment will have a nice incentive to keep the monopoly alive and kicking. Maybe even force other verdors to license code from Microsoft, so that they can access everything.

It's just a posibility. If you can imagine the FBI saying "Oh, we could gather inteligence directly for Microsoft but, oh wait. The privacy thing! We'll have to find another solution."

Come on, have you switched ISP because of the gov. sniffing?

Phil, Please Join Us!

[Bruce Perens]

Phil,

We'd really like you to join the work on GnuPG, and on GUI projects like GNOME. I think it would be most productive to write off the PGP code base and continue your work on the existing Free Software projects. We've gotten most of the hard work done already.

Thanks

Bruce

Re:Phil, Please Join Us!

[MAXOMENOS]

Let me second this. (Yes, I'm seconding Bruce Perens. How's that for chutzpah?.)

Most of the Gnu Privacy Guard code base is in place, but we still need a ton of help with GUIs, APIs, Web-based encrypted email, etc. And there is no GnuPGFone as far as I know.

I know PGP is your baby .. I can appreciate that, and I know what it's like to lose control of your baby. I'm not going to pretend that GnuPG is the same thing. Nonetheless, GnuPG is working toward (mostly) the same goals, and that's something worth considering. They could also use your help, as you have years and years of hard-won experience in this field. Yeah, they're young punks, but they mean well and they do good.

Just my two cents.

Re:Phil, Please Join Us!

[PatientZero]

"wasn't it just a few days ago someone posted here on slashdot about their company refusing to use OpenSSH since it is open source?"

No, the company refused to use any non-commercial product. Basically, they wanted someone to sue if something went wrong. Open source wasn't the issue.

Re:Phil, Please Join Us!

[Slashamatic]

Bruce,

You don't need prz for the GUI. The only 'secret' when preparing a crypto-GUI is to make sure that anything containing key or secret material is cleaned after use. That is, you *never* deallocate memory or free up disk space without zeroing, and in the case of disk space, overwriting with patterns first. The crypto engine is the hard part.

Whilst Phil is a good cryptographer, GUIs making the whole thing understandable are another matter. I think the other guys are doing quite well there.

GnuPG misses some things like secret sharing (should be there soon) and there is no API for philosphical reasons, however that can be dealt with. The OS crypto community is currently surviving well and will continue to do so as long as various governments/interests don't succeed in tainting the whole idea by the association with terrorism and copyright violation. On these last points we need everyone we can get to keep cryptography free and there Phil can definitely help with the advocacy.

Re:Phil, Please Join Us!

[Slashamatic]

The answer is LGPL.

I wrote a bit of pgp back in version 2 days and it was a BSD license. I *know* my code ended up in some commercial products but I wasn't compensated. Later when the s/w was sold to (via another compy whose name I have forgotten) NA, I was approached a couple of time about another port, but never through the official NA commercial channels. As the use was commercial and the rights were a nightmare, I had to decline.

So Phil selling PGP effectively stuffed it for outside contributors. Phil has to eat, so I don't begrudge him that, but he could have sorted the licensing a lot better. Many of the rest of us tried to keep the older command line variants going but it proved more and more difficult and rights became very difficult.

Re:Phil, Please Join Us!

[gnugnugnu]

Anonymous Usability Nut Time (AUNT)

(speaking of losing control of your baby)
cool there seems to be GUIs for most platforms going, but are they consistant and easy to use?

Not invented Here, NIH and reinventing the wheel (or at least the fact the most projects waste time failing to invent a better wheel because they did not collaborate) seems like a curse of free software.
if free software developers can play friendly together and communicate it would be a lot better for all of us.

--
"This is not Troll"
Isn't that just what a troll would say

Re:Phil, Please Join Us!

[Airline_Sickness_Bag]

The best example I know of this is Microsoft. Billions of dollars have been lost due to their buggy and insecure products. And how much money has been collected from them?

-asb

Re:Phil, Please Join Us!

[MAXOMENOS]

cool there seems to be GUIs for most platforms going, but are they consistant and easy to use?

NO, and that's a huge honking problem as far as I am concerned. We've got at least three different UI projects for GnuPG, none of them ready for prime time, each one working differently from the other.

I'm horribly tempted just to take the best of the bunch and port it to wxWindows. It would run more slowly, but it would work, damnit, on Win, Gnome/Gtk, KDE and Mac.

Re:Free PGP? How about GnuPGP

[jeffy124]

ok, then it just plain dont work well from a user's viewpoint (which was really my point). Or from Outlook, FWIW.

I like PGP

[dannyrap]

I actually paid for a license for PGP Desktop for home and still use it heavily for pgpdisk (the encrypted virtual disk software). I like the thought that even if someone hacks into my computers with my login, they still have some work to do to get the important files.

While it sucked to see NAI drop PGP, I made sure I pulled down the latest build before my license expired. I can still get another couple of years use out of it.

I would like to think that someone will eventually pick it up. It's entirely too useful to let it die. It be nice if it turned free, but I would still pay a reasonable amount of money to get a new enhanced version.

Re:I like PGP

[Anonymous Coward]

I would like to think that someone will eventually pick it up. It's entirely too useful to let it die. It be nice if it turned free, but I would still pay a reasonable amount of money to get a new enhanced version.

You don't get it! There is good reason to believe that NAI has put backdoors in for No Such Agency and/or others, and with only binaries available, it's impossible to be certain. Closed source encryption software is utterly useless, regardless of how much it costs.

Even if you aren't worried about the NSA reading your email (and you should be!), backdoored encryption is a fucking joke, because all it takes is for someone else to figure out the back door and exploit it. Even if nowhere else, at least use open source for your encryption needs.

PGP is dead. Long live GPG!

Re:I like PGP

[Glytch]

Loop-AES. Assuming you don't have the loopback filesystem module built right into the kernel, but have it as a module or not at all (look for loop.o), no kernel recompile or patching or even a specific kernel version is required. Patching losetup and mount, on the other hand, is required, but it's painless. And Reiser FS is a perfect companion to Loop-AES.

One handy little thing about Loop-AES I love is how the encrypted loopback filesystems can be burned straight onto a CD. The upshot of this is secure backups, like if you've got nosy roommates.

close

[martissimo]

but the article states that you can modify it and run the modified version on your machine, you just can't redistribute the modified code.

With the source code able to be modified, it might be easy for some people to think of PGP as Open Source. "You could modify it if you wanted to, and run it on your own computer, but you could not distribute a modified version," Zimmermann explains

Anyways, i dont think NA has any obligation to do as Zimm asks, he sold it to em, and it's now their's to do with as they please, even if that means that they let it just die basically. It's a shame but it is their right to do so.

Re:close

[benjamindees]

Is it acceptable to distribute a patch?

Re:close

[ReadParse]

You said:

but the article states that you can modify it and run the modified version on your machine, you just can't redistribute the modified code.

Nice selective clipboard. The article does not say that, it says:

"You could modify it if you wanted to, and run it on your own computer, but you could not distribute a modified version" (emphasis added).

The "could" here refers to past tense... before he sold it.

Re:PGP Source already open

[sgtron]

"Yes, you can look at the code, but you can't use or modify it without their consent"

Actually you *can* modify it and use it as you like you just can't *distribute* it.

interesting?

[InsaneCreator]

he's an interesting little capitalist.

right now he seems to be a slashdoted little capitalist.

Re:interesting?

[Psiren]

Righty-dokey matey-bloke flap old salty sea-dog amigo skip-jack jockstrap piano-tuner, let's see you balls this one up!

righty dokey skip flip flap jack me old nick nack paddy wack slip de dip lipstick oh look mrs jones bomber harris tweed coat and hat it might be raining achtung baby psycho ward ten minutes please gentlemen its the lavatory express, I will!

The real reason this will never happen

[Monkelectric]

[you@someterminal you]# cd pgp-source
[you@someterminal you]# grep -c -r -i "nsa"
27

Re:Free PGP? How about GnuPGP

[cygnusx]

> Or from Outlook, FWIW

Ah, actually there a plugin for Outlook _Express_ available now. GPGOE. Outlook will take some time -- and hacking on the office dev kit -- I guess. But yes, I get what you mean about "dont work well", but I can tell you it's getting better fast! And if you can, do give WinPT a try. You may be surprised.

Re:Free PGP? How about GnuPGP

[1010011010]

It does work in OutLook. I'm using it right now.

Go get it here:
http://www3.gdata.de/gpg/

Re:Free PGP? How about GnuPGP

[GGardner]

BSD unix was a non-cleanroom reimplimentation of AT&T unix. BSD won when it went to court.

But only an organization like BSD, backed by the University of California and their lawyers, had the resources to stand up to AT&T in court. I wouldn't suggest being cavalier about clean-room issues to any random Open Source project.

Re:Ethics please!

[mindstrm]

It's not immoral at all for him to request this, anymore than it's immoral for anyone else to request it.

He sold it to them, yes, but now they've effectively killed it, and don't plan to do anything with it.. so it's fair enough that the pgp using world want's to see it opened. Zimmerman is one of those.

PGP owns...

[ImaLamer]

That being said I tend to think that the push towards GnuPG isn't as great of an idea as some think.

While there is many "free" or open source projects out there that are great on multiple platforms, GnuPG hasn't yet been fully (if at all) accepted by the Windows users.

Before you flame me; encryption needs to be open, and it needs to be easy to use in some respects. If my grandma (or male lover) has to go to the command line to encrypt his/her e-mail - it isn't happening. Now I see one project to bring it to the Windows desktop but it's being developed by linux developers.

If people expect Phil to come over to the GnuPG camp then you have to be ready to develop as much time to the Windows product as *nix.

Maybe I'm just not making sense because I'm typing fast... but simply: Gui, Gui, Gui. Equal time on all systems. Then I'll put my support behind GnuPG.

Otherwise Network Ass. should release their control over a product they raped.

Re:PGP owns...

[ImaLamer]

Maybe I should say this:

Pub. Key Encryption should belong to the common man and it shouldn't take any _real_ computer knowledge to be private.

GnuPG lacks this... maybe Phil should just get it back and do it on his own again.

Paypal donations...? ...lol

Re:PGP owns...

[lightcycler]

"If people expect Phil to come over to the GnuPG camp then you have to be ready to develop as much time to the Windows product as *nix."

Why bother with platform-specifics at all? Use GTK+ for the frontend, it'll run fine on windows _and_ linux, especially with the rise of the linux desktop so everyone has/uses gnome now...

Re:PGP owns...

[_Sprocket_]

Now I see one project to bring it to the Windows desktop but it's being developed by linux developers.

I've found a whole series of GnuPG interfaces and email plugins for windows (WinPT being my favorite sofar). I don't know if the developers are "Linux developers" or not - but I fail to see how that matters.

If people expect Phil to come over to the GnuPG camp then you have to be ready to develop as much time to the Windows product as *nix.

Nobody is stopping any developers from running with GnuPG development on their favorite platform. In fact, as already pointed out, Windows development is definately picking up (probably due to NAI's dropping PGP - way to create an itch / need). And the GnuPG developers are definately thinking ahead with libraries such as their GPGME API. No more shell front-ends like the old PGP GUI days. GPGME provides direct hooks in to GnuPG (WinPT uses it).

In short, the door is wide open.

Re:PGP owns...

[ImaLamer]

This is what I wanted to hear... actually I feel better now.

The problem is that _right now_ it's just kinda weak.

GPL/OSI developers _usually_ put their win32 work on hold that is what scares/bothers me.

I hope though that GnuPG becomes the de facto standard, because free as in speech is a Good Thing.

Re:PGP owns...

[_Sprocket_]

The problem is that _right now_ it's just kinda weak.

I agree that the GnuPG GUI/Windows clients do not yet meet the level already found in later versions of PGP. But once again - I would point out that until NAI started to esentially kill PGP as a product line, there was little incentive to drive that development. Now, in a relatively short period of time, we are seeing some real progress.

GPL/OSI developers _usually_ put their win32 work on hold that is what scares/bothers me.

I would suggest its less a matter of puting win32 work on hold and more a matter of a lack of win32 developers. Open Source development seems to be far more common within Unix and (not suprisingly) Linux environments. I suspect its a cultural issue; the whole Open Source concept seems very foreign in a Windows world. That's not to say there aren't some really nice OS projects for Windows (or excellent work to extend OS projects to Windows).

But there is now more of a demand for GnuPG solutions for Windows. And OS development has been showing up more and more often in Windows environments. So the future is good, I think.

Re:PGP owns...

[ImaLamer]

I really hope you're right.

I would like to maybe see a sourceforge section entirely devoted to win32 Open Source projects.

Like I said, the problem I see with GnuPG is only that the Windows clients will be always a step behind and that won't help.

Yes, we need more developers, but I'm not the person to talk to. I've got a better chance of getting "Hello World" out of C++ than Holyfield has getting his ear out of Tyson's mouth.

I think you've changed my outlook on the situation, and now I DO with that Phil goes with the team. Maybe he can bring the Win32 developers with him.

[[the situation of win32 GPL development as I can see it is that most people who will develop on the platform realize they can charge any amount for any application. When I first tried Linux years ago I realized that you don't have to pay for simple tools that should be free(like i ever did!). Have a problem in Windows, the software to fix it will cost a pretty penny. Quality over Cash...ah, the beauty of linux]]

Re:PGP owns...

[_Sprocket_]

I would like to maybe see a sourceforge section entirely devoted to win32 Open Source projects.

I understand what you're getting at. But I don't think the distinction is needed. You can already find projects on Sourceforge that have a very heavy Windows focus to them (Quakeforge, for example). Windows projects can live on Sourceforge just as easy as Linux projects... or PalmOS projects... or cross-platform projects (like OpenRPG).

[[the situation of win32 GPL development as I can see it is that most people who will develop on the platform realize they can charge any amount for any application.

My own theory (completely unsubstantiated, you understand) is that of currency. Linux works on a gift culture - if you work with, use, or develop for Linux (and other OS-centric environments) you've already taken advantage of OS software. So developing more OS projects is simply enriching the environment and returning the favor.

In a Windows environment, you've paid hard cash for your OS, cash for your development tools, small amounts of cash for the various little shareware apps that make life nice... and can expect to spend MORE cash in the future if you ever wish to upgrade and/or expand your current holdings. Its no suprise developers wish to replenish that pool of available cash.

And that's the difference in currency - code vs cash; a gift culture vs a monetary system.

That's not to say one can't mix cash and gift cultures. But it would go towards explaining the vastly different software landscapes between Windows and (for example) Linux.

Re:Free PGP? How about GnuPGP

[(startx)]

I'd beg to differ. read the (currently highest moderated) post by Bruce Perens begging Phil to Join the GPG team

Re:Free PGP? How about GnuPGP

[packeteer]

they ont HAVE to claim their code is clean room... as long as no code is copy-pasted over then its ok... if there is some type of bug or other problem in the code and he knows HOW to fix it but not the exact code he CAN tell them how to do that... he can give them ideas about what to do as ong as he doesn't drop in some code...

GPGDisk?

[sysrequest]

The only piece I really use is the PGPdisk feature. Creating a totally encrypted virtual harddrive is very cool.

I create 649 / 699 MB PGPdisks, fill them with my 'backups', "unmount" them, and then burn them onto CD. Voila, encrypted CD contents. Works beautifully.

It would be the coolest thing in the world if GPG was able to mount the same PGPdisks. Heck, even using other filesystems should be possible.

It's great for keeping data private (as long as the encryption will hold, a couple of years longer maybe).

Once GPG can at least mount and hopefully also create "GPGdisks", I'll ditch PGP.

Re:GPGDisk?

[Meefan]

Use Scramdisk. It's free, and works on Win9x. (Or better yet, use Linux and any of the numerous encrypted file solutions there.) -Meefan

KDE Free Qt Foundation

[_|()|\|]

a Dead Man's Switch license would be very interesting to see implemented

You mean something like the KDE Free Qt Foundation? Qt is triple licensed: GPL, QPL, proprietary. If TrollTech discontinues the free edition of Qt, then the last available version will be released under the BSD license. (I'm not sure whether that's with the advertising clause.)

Re:Free PGP? How about GnuPGP

[flonker]

He could probably join the project as an advisor, as long as he didn't write any code, and not break the "clean-roomliness" of the code.

What would you expect from CA?

[Anonymous Coward]

Ask any (ex) Informix employee about how well the hostile takeover and fire everyone "software company" strategy works. Computer Associates: milking support contracts for all their worth for years now.

Re:Ethics please!

[fmaxwell]

Some ethics would be in place, this guy SOLD it to network associates, it's quite immoral for him to request them to open source it now!

How is it immoral for him to make that request? Suppose that you sold a car to your neighbor. Two years later, you find it rusting on blocks in their front lawn. Would it be immoral of you to politely suggest that they donate it to a worthy charity? I think not.

Re:PGP Source already open

[God! Awful]

Admittedly, it's not the latest and greatest - but this is open source folks, surely some talented hackers out there can expand on what is already open?

Try reading the article before you post. The article tells you why this couldn't happen.

-a

One reason for PGP over GPL

[DrXym]

Assuming PGP was open sourced and was covered by a sensible licence, it could easily steal a march over GPG.

The principle issue that faces any developer wishing to integrate GPG is that it is covered by GPL. That means that even if it had an SDK (which the isn't) you couldn't link with it without infecting your own code. Even LGPL libs can't link with it. At present if you wish to use GPG, you must mess around constructing command line arguments, opening pipes etc., invoking it and then parse the results. It is a major pain. There are libraries such as GPGME that hide some of this from you but it is still slower than running in-process and has significant issues running on platforms like Windows or Mac where piping etc. might be done differently.

If PGP were opened up with either a LGPL or BSD style licence I can see it being used in preference to GPG. GPG has the better command-line interface and might be ok for scripts but PGP has an SDK (as well as a great UI on Win32) and would be ultimately faster if software can link directly to it.

Re:One reason for PGP over GPL

[Nicopa]

In fact, this is a good thing. Accessing to the gpg process through pipes gives you the greatest security. If you link GPG with your favorite GUI program, any hole or fault in GTK+ or your program could compromise your keys.

Other programs do the same (have a separate security dedicated process). Check ssh and its privilege separation, and postfix and its multitude of little processes.

Re:One reason for PGP over GPL

[DrXym]

I don't see it makes much difference. You still have to feed the password and data to GPG and it has to return it. Seperating GPG doesn't prevent a GTK app from leaving a copy of the password in memory for example.

Phil should work on Mozilla

[PingXao]

PZ should get involved with Mozilla. For literally years I've been waiting for someone to build in some sort of public-key email (and newsgroup) crypto. It's still not there yet, and THAT has prevented several people I know - including myself - from adopting Mozilla as my sole internet access tool. I'd love to be able to dump some of the crap I run for email and usenet.

First it was the export restrictions that were deterring Mozilla crypto. Now it's something else. I guess these projects qualify for some of what's being done today, but I needed Mozilla to do built-in crypto years ago. The standard Mozilla comeback is "do it yourself". Well, I have neither the time nor the skill to do that. But Phil does!

Re:Phil should work on Mozilla

[Chandon Seldon]

http://enigmail.mozdev.org/ should be a good start...

NSA

[zootread]

Maybe the NSA will buy it and then open source it, then include it with their SE Linux.

Re:Ethics please!

[fmaxwell]

I didn't say it would be a good idea. I just said it would be an ethical one.

Mainstream email encryption

[jessohyes]

I don't believe email encryption will become mainstream unless these things happen.

1) Major email client providers agree on a standard
2) The ability to encyrpt/decrypt is provided with the default install of their product.

Re:Mainstream email encryption

[mlk]

3) Keys are easy to create, authenticate and well use (for NORMAL people)

nobody gets it.

[Anonymous Coward]

Network Associates is sitting on the code to squash it. They don't want to sell it. They don't want to make money off it. They want to keep it unavailable. Texaco owned the patent for fuel injection systems in cars. Until that patent expired (patents used to expire), no cars had fuel injection. If you don't remember, they might want to look back at the date on the press release that Network Associates (a.k.a. McAffee) released, stating that they planned to discontinue PGP. It's pretty close to September 12, 2001.

Re:nobody gets it.

[dbrower]

"Texaco owned the patent for fuel injection systems in cars. Until that patent expired (patents used to expire), no cars had fuel injection."

And as soon as that patent expired, the black helicopters flew off with the formula that turned water into gasoline.

This is a specious claim by Mr. AC. Diesel engines have been fuel injection since their creation; Mechanical fuel injection was used in cars in the 30s, but was generally too complicated for mass production-- but see the 1957 Corvette for an example. It was used in aircraft, see the DB601 that powered the Bf109 from the 30s through the end of the Reich. Alfa Romeo used MFI in the 60's just to make life especially hard for rare US Giulia owners for whom Weber carbs would be even more fiddly.

Electonic injection was invented in the UK in 1966, according to this; on the other hand, Ford says Bendix patented it in the early 60's (maybe the same?). Porsche started using FI in 1968.

EFI wasn't widely popular until there were cheap computers to do the thinking. This wave started in the 80's and was basically over by 1990. It had nothing to do with patents, and everything to do with regulations that made it effectively impossible to meet cold-start emission limits with carbs anymore. (The same thing that killed air-cooled VW engines in the 70s, and Porsche boxers more recently.)

-dB

Re:Free PGP? How about GnuPGP

[jarnot]

I'd say that the fact that no one seems to know conclusively where you can run GnuPG is a sign that it's not ready for prime time!

Over the wall

[fm6]

Used to work for a big company that started Open Sourcing some of their products. Set up a special comittee to supervise the process. Which started getting all kinds of OS requests, many from ex-employees who wanted to regain access to the source code for their pet projects.

The generic response was "Open Source does not mean taking a product we don't want any more and throwing it over the wall. It means taking a product we continue to maintain and donating rights to it to the open source community. We can't just give away software without assessing the legal and PI risks. That's an expensive process, and we just won't do it unless it helps us start an OS project with some real potential."

I might be misquoting (that's why I don't name the company), but you can see the issues.

NA PGP client only for win32?

[motorsabbath]

Out of curiosity, I went to NAs site looking for a client. They only make one for windows? I didn't see one for any other opsys's.

Guess we do need to save PGP.

JB

Re:Free PGP? How about GnuPGP

[Zeinfeld]

If he really wants to do something, GnuPGP would probably welcome him with open arms...

Have you tried to work with Phil Z.? Oh... thought not.

People who end up in the mess Phil did are not always the folk with the best social interfaces...

The problem with PGP is that overall it is tending to hinder the use of crypto than help at this point. There is perfectly good crypto built into Outlook, Outlook Express, Notes, Netscape etc. Only thing is people don't know its there because they are being told that only crypto persecuted by the NSA should be used.

PGP has a somewhat different PKI design, but not all that much different. Anyone can be a CA with X.509, the only technical difference being that certificate signing certs have the key signing bit set.

Rather than attempt to resurect the PGP message formats it would be better to spend time building S/MIME key signing code.

So why didn't he free the source to it himself?

[discogravy]

Zimmerman has a lot of balls asking someone to do what he wouldn't when he had the chance. It's a shame, but it's shameless the way he's going about this.

For a good read w/r/t Crypto in general (including Zimmerman and some of his past,) check out Stephen Levy's book Crypto. It is excellent.

Enigmail

[Anonymous Coward]

Try out Enigmail [http://enigmail.mozdev.org/].

Enigmail is a "plugin" for Mozilla/Netscape7 Mail which allows users to access the authentication and encryption features provided by the popular GPG and PGP software (see screenshots). Enigmail is open source and dually-licensed under the GNU General Public License and the Mozilla Public License .

Windows users: try GPGshell with Nullify GnuPG

[Jim Efaw]

I was using WinPT for a while, until I stumbled on GPGshell. It calls GnuPG to do the work, so you never have to worry about entering your passphrase into a GUI. IMHO, it's a lot nicer than WinPT. When you install it, you get 3 programs, which don't need each other to work:

• GPGkeys, a program to do manage all the keys.
• GPGtray, which has a lot of the options on the system tray, and magically knows the "right" thing to do with the clipboard if you double-click it. Highlighting a PGP key in a terminal window then double-clicking on an icon makes importing keys really slick.
• GPGtools, which lets you drag-and-drop files onto it.

So anyway, here's what you do:

1. Get GnuPG (1.0.7 or later) from Nullify. It comes with an installer, plus contains those sinful patented algorithms (like IDEA) that PGP was fond of using in various versions.
2. Get GPGshell, install, and tell it where you put GnuPG.

So far this setup has had no problem dealing with any PGP messages I've encountered, from 2.6.2 to 7.x, but I haven't tested it extensively.

Mozilla and Enigmail

[flashk]

This won't solve the Outlook problem, but in Windows you could use Mozilla Mail and the Enigmail plugin for Mozilla.

Right now GUI wise, it's the easiest and nicest way to use gnupg for emails in Windows.

Could the community buy it?

[CNeb96]

Could the Open source community buy it? I know I'd donate. If every one who thinks its important keep donates something, would it be enough? We could put it under a decent license (BSD, MIT, GPL, etc) and donate it to GNU, MIT, or the EFF.

Are there any sites out there which take donations to buy closed source products and open source them?

Re:Free PGP? How about GnuPGP

[Gleef]

Zeinfeld writes:

PGP has a somewhat different PKI design, but not all that much different. Anyone can be a CA with X.509, the only technical difference being that certificate signing certs have the key signing bit set.

Sure, anyone can be an X.509 CA, but that doesn't help much. In order to issue meaningful X.509 certificates, you need to be a widely trusted CA, and that means commercial certificate distribution deals with Verisign, AOL and Microsoft, and that pretty much rules out all but big businesses.

PGP's web of trust has a much lower barrier of entry.

Re:Free PGP? How about GnuPGP

[stealthyburrito]

This is one of the problems of GnuPG vs. Commercial PGP.

With GnuPG, you expect "normal" end-users go download GnuPG that has been ported to Win32 from somewhere... then go download a GUI from somewhere else, then go download an email plug-in from yet ANOTHER place.

Just getting people to understand the basics of asymmetric encryption is difficult enough without making a career out of finding a usable installation.

Complain all you want about "stupid users", but in the end, a simplified installation package is what gets people to use it. Encryption for the masses, not encryption for the techno-elite.

-SB

Like PGPDesk? You might like BestCrypt

[Wee]

If you're a heavy PGPDisk user, then you might like BestCrypt. Does pretty much the same things, except it has both Linux and Win32 "clients". So you can tote encrypted loopback files around, just like with PGPDisk, except you can tote them between a good and a marginal-at-best OS. Works with Win2K and XP, too. And it has some pretty good crpyto algorithm support (even GOST). On the Linux side of things, you can even do funny stuff like have encrypted home directories, encrypted samba shares, etc. The Linux GUI leaves a little to be desired, but the Windows one is pretty good. It's free-as-in-beer for personal use.

Anyway, I highly recommend it.

-B

GnuPGP Win Has Problems.....

[Slashamatic]

Actually it (GnuPG and WinPT) don't work at all well in a 2K/XP professional environment with non-privileged users. I have started work on it, but can't even get the toolchain to function properly for rebuilds under Win (it uses a non-cygwin compatible version of MINGW32).

In MS business environments you don't tend to Admin rights on the box where you are working. I don't even have at home on my Windows box.

No he didn't...

[Slashamatic]

No he didn't. Phil developed the first version of PGP and guided it's development afterwards. A lot of the formats (key rings, etc) were developed by others. Phil continued to guide development though. He released it on the Internet after a row with RSA (the Feds only came in later) over the use of their patented algorithms.

I know, I worked on it for a while back in the early days.

Why doesn't he ask for donations?

[LuYu]

It seems that under circumstances like these, the online community often coughs up quite a bit of cash. Why not ask for donations?

If the online community gave him this money, he would be obligated to act in good faith and open source the entire thing (including the commandline wrapper if Network Associates is truly selling PGP).

Sorry, I'm not actually living in the real world. My imagination tends to get the better of me...

"Normal" end-users ...

[vrai]

... don't use encrypt, period. They find it confusing, obscure, and not worth the effort as most 'normal' users don't email anything of any value. Even commercial implementations (like the excellent PGPTray) are far too complex for your average AOL monkey.

For encrypt to really take off amongst technical lay-people someone like AOL will have to seamlessly integrate it into their mailer: complete with automagic key-fetching and hiding all that nasty ASCII armoured 'garbage' (like KMail does). Unless the PGP or GNUPG creators can solve this problem then neither of them are any use to the average email user.

Errrrm... x.509 certificates! See this link.

[SomethingOrOther]

x.509 certificates are supported as standard in shitloads of mail clients (inc. Netscape and the ever popular MS Outhouse). Many people regard those as an "industry standard"

However, x.509 is more suited to compannies, as each public key must be signed by a trusted certificate authority to be valid. (e.g. Signed by Thwate.... otherwise use openSSL and set yourself up as a certificate authority and generate your own x.509 certs). This is only really practacle for a large company.

Individuals are better suited to PGP because of its "web of trust" model eliminates the need for certificate authoritys, but will be impractacle for a large organisation. (Its no wonder NA failed to sell PGP to companies.... the existing x.509 standard is mutch more suited)

See this link

All Platforms Available! See pgpi.org

[SomethingOrOther]

You need one of the international versions of PGP available from www.pgpi.org you do

Available on a shitload of platforms
And pgpi is a very trusted site

(I could also mention the Cyber Knights Templar builds. Also very trusted + open source)

Opposite of Snort

[Eythian]

An interesting comment in the Newsforge article:

This would allow Network Associates to continue to sell and make money from the command-line version, more popular with corporate techies. "End-users don't pay money," Zimmermann says. "It's the businesses with their techies who pay money and they like to have a command-line product to run in a shell script, so that a big Web site, for example, can encrypt your credit card number. Their command-line product is for one of those raised-floor machine rooms with a bunch of servers and nobody around."

Compare this to the reference in the snort article, where the core code is free, because its the techies who use that, and the GUI addons that cost.

I'm not really going anywhere with this, but it is a little surprising to see two completely diametric viewpoints on the same idea.

Re:Free PGP? How about GnuPGP

[IXI]

Well, the GNU Project is not "any random Open Source project" either. Though the FSF might prefer the current situation, without PZ involved in GnuPG.

But I doubt that PZ would be interested in working on GnuPG anyway. Seems he's more interested in his project surviving.

Re:Free PGP? How about GnuPGP

[wossName]

GnuPG is partly backed by the german government:

gnupg.de
gnupp.de

Re:Free PGP? How about GnuPGP

[Conare]

Not really. If your only concern is encrypting/signing mail (and other stuff) within your organization, than the CA only needs to be trusted within your organization. Trust in the CA can be enforced as a condition of employment. This makes PKI practical for many mid size businesses as well, although small businesses should look elsewhere due to the large inital outlay required. If you wish to explicitly trust the PKI of another business than your CA's can issue each other Cross-Certificates.

Also, only one of the three businesses you mention is in the business of selling commercial certificates (Verisign). MS sells PKI products that allow you to generate your own self-signed certificates. MS has a PKI offering coming in .NET but my industry sources tell me that it is about 3 generations behind Entrust and 2 behind Verisign as far as capabilities, security, and (surprise) interoperability. This doesn't surprise me given the MS record with PKI and security in general. I'd better stop there or I won't get any work done today.

Re:Free PGP? How about GnuPGP

[Zeinfeld]

Sure, anyone can be an X.509 CA, but that doesn't help much. In order to issue meaningful X.509 certificates, you need to be a widely trusted CA,

That has nothing to do with the format of the certificate. It is simply basic math.

All the major email programs allow you to install your own trust roots, always have. The problem is getting a trust root widely recognized.

The diameter of a graph is the length of the longest path between two nodes. If the diameter of the graph is small then either the graph cannot be large or there must be at least soe nodes of very high degree. [The Moore bound on the diameter of a graph is k * (k-1)^d where k is the degree of the nodes and d the diameter.

Applied to PGP it means that if you have a Web of trust with a trust chain length of 5 and each person signs ten other keys you can have no more than 90,000 members if the members align themselves perfectly. In practice the size of the graph would be much smaller since the connections would be either random or highly locally connected which gets you down to about 10,000 users.

PGP works largely because people take untrusted keys of key servers and because there are folk like Jeff Schiller who have signed hundreds of keys.

If you want a global PKI then you need intermediaries. PGP is not designed to scale to be a global system. But if you are prepared to put up with the size limitations of the PGP model you can do the same in S/MIME.

Microsoft even ship a mini CA tool with Office and Visual studio - makecert.exe. It is a bit idiosyncratic and you need to get another tool fro the Microsoft site to convert the private key formats to PKCS12 format but it certainly works. The SSLeay code also has a cert signer.

Consistant user interface

[gnugnugnu]

I really love that expression "like trying to herd cats".

I would be right there ready to test binaries if you do something like this, but the idea of going off and starting yet another project worries me. You never know, diplomacy might actually work (especially if Phil Zimmerman was the diplomat).
You might try doing a cross platform but different native toolkit kinda thing like Abiword does.
The Mozilla plugin has potential, interesting.

My GUI design philosophy is if in doubt copy what everyone else is doing (in this case copy the official PGP). Do it differently only if you can demonstrate why your way is better (and even then it has to be substantial better to overcome the problem of inconsistancy+learnability).

Trying desperately to stay on topic and protect my meagre Karma ...

Re:PGP Source already open

[autocracy]

OK, let's put this one to rest for once and all. I can't even begin to use the code unless I've paid for the right to do so. PGP Freeware exempted yes, but if I'm trying to do something for, say, a company, then I can't do squat with the code. Sure, I could theoritically modify it, but I would be in trouble for using that code until I've bought the license.

Re:Free PGP? How about GnuPGP

[Gleef]

Conare writes:

Not really. If your only concern is encrypting/signing mail (and other stuff) within your organization, than the CA only needs to be trusted within your organization. Trust in the CA can be enforced as a condition of employment. This makes PKI practical for many mid size businesses as well, although small businesses should look elsewhere due to the large inital outlay required.

X.509 is a clumsy tool for internal encryption. Most programs using it are using it for communications, not storage. A good chunk of any businesses need for secure communications is with other businesses. You can't make your parts supplier trust your internal CA as a condition of employment, and you usually can't even require it as a term of your contract with them.

If you wish to explicitly trust the PKI of another business than your CA's can issue each other Cross-Certificates.

Again using my parts supplier example, that would basically be me going to my parts supplier, and asking them to trust that every certificate we issue is valid. That's a lot of trust. Most people are prone to say "no", particularly if they don't understand the full ramifications of that trust.

With the PGP/GPG "Web Of Trust" model, all I would have to ask them is to trust that my key is validly my key. Much easier to do, the guy at my parts supplier can do this over the phone in many cases. Then he can sign my key and put it on their keyserver. Anyone at my parts supplier who accepts his signature will automatically trust my key. They are only asked to trust themselves, and what they can readily verify; a much more palatable trust model.

only one of the three businesses you mention is in the business of selling commercial certificates (Verisign).

The other two are the leading distributors of X.509 capable products, and therefore the leading distributors of "Here are the trusted Certificate Authorties" lists. To get on those lists takes money.