Slashdot Mirror
GPG Programmer Werner Koch Is Running Out of Money
New submitter jasonridesabike writes "ProPublica reports that Werner Koch, the man behind GPG, is in financial straits: "The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive. Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded."
(You can donate to the project here..)
Too bad, I know of two of his relatives who have more money then they know what is morally correct to do with.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
from GPG founder Werner Koch
Hal Finney is the guy who built GPG; Hal Finney is also the first person to receive a Bitcoin transaction, which was sent by Satoshi Nakamoto.
From the linked article:
Update, Feb. 5, 2015, 5:55 p.m.: After this article appeared, Werner Koch informed us that last week he was awarded a one-time grant of $60,000 from Linux Foundation's Core Infrastructure Initiative. Werner told us he only received permission to disclose it after our article published. Meanwhile, since our story was posted, donations have also poured into Werner Koch's website donation page to the tune of nearly $50,000 so far.
Can't he just sell support or something? Isn't there supposed to be viable funding models for FOSS projects?
Something everyone claims to want, but too cheap to pay for. Thanks, Stallman!
If you were me, you'd be good lookin'. - six string samurai
Open source software is generally accompanied with the idea that it should be given away, although the two aspects are technical unrelated.
Often the people behind it end up underfunded with only the occasional VC passing by raking it in.
Such is life in the give-away world!
Looking at the list of donors page, it has this curious summary:
I'm not sure how to read that as this year is 2015. But if this is all for one person, they don't seem to be hurting for funds now.
"The great thing about multitasking is that several things can go wrong at once." -me
He is more likely to get money from the ducks I think.
Michelangelo finished the pieta in 2 years. You've had 18!! Look, it's good stuff, and you could probably milk this till retirement. Even Michelangelo realized finally that if he took one more swing at his sculpture, he'd have detracted from it.
You keep this up, you're gonna turn out just like that Torvalds kid.
If more people used it, he would get more money. I am pretty good at writing user documentation. I thought about writing some for gpg4win, so non-techies could use it. But then I took a look at it more closely, and it seemed hopeless.
like...really, really watch very closely.
Like so many encryption schemes it is still too difficult for the man in the street.
Take another look, knowing that Koch now has funds to pay a decent writer.
You realize even taking taxes in to account, most people make a lot less than that and do just fine, right? When you see income reported, it is normally pretax. If you think most people are making more than 90,000 Euro a year, you are really out of touch. That's a lot of damn money, in any country, enough to live well. You aren't rich, but you are doing just fine.
Then like that Indiana girl scout, he'll be raking in the dough. Bonus points if he had it happen while walking seven miles uphill in the snow to get to his computer.
Then none of us have to worry about anything else in the world except the next episode of Downtown Abbey.
He could actually go out an get a job if he wants.
Is that known as "scratching the Koch"? How do we know Koch won't blow the wad on hookers?
20 euro for you
I am very small, utmostly microscopic.
How soon we forget someone who stood up. Someone who should be honored for his contributions to free speech, expression and privacy,
Besides, isn't PGP Snowden used?
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Kinda makes you wonder if his last name runs donors off.
To a lot of the people who would like to support a lot of this stuff but without any full knowledge of the subject, the Koch name now is pretty toxic alone due to the the brothers and all their misdeeds.
It's not that hard to use, there are GUI tools for gpg use on all platforms. Heck, I created my old key using GPA (gnu privacy assistant) a GUI interface to gnupg, since I couldn't get enough entropy on the command line. (As an aside, I created that key on a Playstation 2 Linux kit) I was/am no genius either. GPG4Win uses Kleopatra to interface with gpg, which is nice. Take a look at the PDF documentation on the gpg4win website
http://www.gpg4win.org/documen...
rawr! i'm metadata monster!
Why shouldn't there be a standard system API available for all application to use to verify and sign themselves and their parts? This could follow the chain up from UEFI secure boot to ensure the correct daemons are run, the daemons could verify that the correct system started them. It's really unreasonable to expect every application and utility and package to come up with their own way of doing this!
that can happen with free, open source software.
nothing to see here.
Except if you put it in systemd, then it becomes confined to Linux. Side note, GPG gets used across quite a few platforms (I see OS X, Windows, and VMS listed on the binaries page, and seems to be good on other Unix systems too), so it makes for a great utility for others to be able to use to verify whatever.
I'm starting to think GNU is the problem with "GNU/Linux" these days.
I'm running out of money too, if anyone wants to send some to me that would be great!
- Bill Gates
I switched to S/MIME because of the easy ability to have a third party sign your key, and the recipients recognize it; utilizing a similar web of trust that we use for SSL. Sure it isn't perfect, but it's a good platform. All the major mail clients support it as well. Unless you're really worried about privacy, it's good enough.
However, I feel it's the duty of large corporations that profit from the efforts of men like Werner Koch to hire, retain, and support these people, and allow them to freely continue their research. If not through employment, then through grants.
<joke>I guess he shouldn't have sold all his Radio Shack stock</joke>
Sig: I stole this sig.
A new high for Slashdot
... political retards foam at the mere mention of someone named Koch. Never mind the guy is a big name in computer security and has nothing what so ever to do with it. This is supposed to be slashdot. Not the huffington post or whereever your fucktards came from.
On topic, I definitely think someone should partner with him. If he wants to go it alone and stay solo then... there is a price for that. Being alone means you're alone. However, his name and experience would lend some value to one of the larger encryption pushes. I'm sure one of the bigger tech companies that feels they need to boost their credibility in security could fund him for a song.
We'll see what happens. I wish the fellow well and more importantly hope that strong encryption becomes a bigger part of the way everything is done going forward.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Interested users could even set up regular donations.
I feel sorry for him. However, donating money to him would probably mean dire consequences. I have a family, I can't take those risks.
Note this part of TFA:
For almost two years, Koch continued to pay his programmer in the hope that he could find more funding.
So he is also a business owner making bad decisions and pays employees doing programming for him. Are FOSS projects not usually run by not financially dependent-on-each-other volunteers and on code submissions? It seems to me GPG has failed to establish something other projects have successfully done: a tightly knit community in which the whole project does not rest on the shoulders of one man alone. It seems Mr. Koch was trucking along on government funding alone and had no other source of income, this feels like another bad decision to me. This whole project feels like a very strange mixture of FOSS and running a business based on it while expecting to be paid as if it was a closed source, shareware program.
By all means, he deserves all the donations he can get but maybe it is high time to take a step back and look at how some things might have been run badly and how to improve on that.
"Only one thing is impossible for God: To find any sense in any copyright law on the planet." - Mark Twain
Cry me a river. This guy has been working for free while corporations have been making billions by exploiting "open source" (remember, it's not free software, it's open source!). That's the one flaw in the "open source" - why would anyone give away their labor while corporations exploit what they do to make billions?
"The Koch brothers are not literal fascists;"
Yes they are.
You may be thinking they aren't literal *NAZI*s, which may be (probably is) true, but go look up the definition of facist, and Kochs are facists, literally. Or do you not know what literally means?
I gave the guy $10. I doubt the NSA gives a shit who donates money.
Fact is people use his software to help blow the whistle on tyranny and oppression all around the world. Regardless of what you think of him, his business practices, or even if you're retarded enough to think he has something to do with the Brothers Koch, the fact remains that keeping these tools alive to further the cause is more important than your petty political or armchair-MBA opinions.
This story should be marked as SOLVED! http://news.softpedia.com/news...
Meanwhile, since our story was posted, donations have also poured into Werner Koch's website donation page to the tune of nearly $50,000 so far.
Enough to make Monty Python's merchant banker puke a little. Won't somebody think of the threat to impoverish those poor bankers?
So when can we log into Slashdot, among other sites, using our GPG key (GPGAuth etc.)?
S/MIME is a standard. GPG is software which supports PGP/MIME, S/MIME, and other standards. I think you may be confused.
You mean donating $100 million to help build up a hospital in New York isn't morally a good thing? Another $100 Million for Cancer Research at MIT. Another $25 Million for Cancer Research at MD Anderson in Huston TX.
Those gifts were spread out over the last 8 years. The Average American gives about 3% of their income to charity yearly. The Koch's made about $10 Billion last year, so reach that standard, they would have had to give $300 Million last year alone. It only looks like they are giving a lot in absolute terms because they are so ridiculously wealthy.
The Koch's are hardly alone in being relative skinflints. The percentage of income given to charity actually rises as income drops. For example, the most destitute zip in my town averages about 7.5%, while the richest gives less than 4% (yes, we are a generous state. Also a poor state). So if it is really charitable giving you care about (as your post seems to imply) then the best way to increase it is to find a way to move money away from the top end of our income distribution, and towards the bottom end.
Math.
Quote: "If there is one nightmare that we fear, then it's the fact that Werner Koch is no longer available," said Enigmail developer Nicolai Josuttis. "It's a shame that he is alone and that he has such a bad financial situation." If it's so open-source then why does it rely on a single person? This reminds me of the Heartbleed bug with underfunded developers. Open-source doesn't mean more security.
lol, you created it on a PS2 and you'd like to think of yourself as an average user?
Maybe not an average user, but I had zero experience with Linux or GnuPG before that, and I figured out how to do it.
It's available on FreeBSD (as both a package and part of ports (what the package is based on)), but due to its reliance on GNUTLS, its dependency count skyrockets. The software ends up depending on 30 other applications. Honest. Here you go:
ports/security/gnutls pulls in the following (and this tree is not accurate, i.e. security/nettle could be what pulls in security/libtasn1, etc. -- you get the idea). Official one-liner descriptions of the packages are listed:
* ports-mgmt/pkg -- acceptable (universally needed at this point anyway on FreeBSD)
* devel/gmake -- acceptable
* devel/pkgconf -- acceptable
* security/nettle -- what the fuck? -- Low-level cryptographic library
* security/libtasn1 -- what the fuck? -- ASN.1 structure parser library
* dns/libidn -- okay, so international domain name support; what if I don't want this? (I disable it everywhere else)
* security/p11-kit -- what the fuck? -- Library for loading and enumerating of PKCS#11 modules
* security/trousers -- what the fuck? -- The open-source TCG Software Stack
* print/indexinfo -- acceptable
* math/gmp -- what the fuck? -- Free library for arbitrary precision arithmetic
* perl -- acceptable to me, but not acceptable to others
* security/ca_root_nss -- acceptable
* devel/libffi -- why?! This is usually only something a PL (ex. Ruby, Python) needs. Perl doesn't depend on this -- Foreign Function Interface
* devel/automake -- acceptable (grudgingly)
* devel/autoconf -- acceptable (grudgingly)
* devel/libtool -- acceptable (grudgingly)
* devel/automake-wrapper -- acceptable (given reliance on devel/automake)
* devel/m4 -- acceptable
* misc/help2man -- acceptable
* devel/autoconf-wrapper -- acceptable (given reliance on devel/autoconf)
* devel/gmake-lite -- acceptable, but hilarious considering it just pulled in devel/gmake, but this is a universal FreeBSD ports problem right now (nobody has added proper Mk framework support for gmake, so port X requires gmake-lite while port Y requires gmake, and both will get installed, rather than just saying "okay if something needs gmake then there's no need for gmake-lite" -- been this way for months now...)
And now security/gnupg itself (which as I said depends on GNUTLS which I just covered):
* security/libgpg-error -- acceptable, but I don't understand why this is a separate library in itself
* security/libassuan -- what the fuck? -- IPC library used by GnuPG and gpgme
* security/libgcrypt -- acceptable
* security/libksba -- what the fuck? -- KSBA is an X.509 Library
* devel/npth -- what the fuck? -- New GNU Portable Threads
* converters/libiconv -- acceptable, but only if you want NLS; some of us don't (and the number is surprisingly large)
* security/pinentry -- what the fuck? -- Collection of simple PIN or passphrase entry dialogs
* security/pinentry-tty -- what the fuck? -- Console version of the GnuPG password dialog
Translation: if someone took GPG and made it use OpenSSL or LibreSSL, a substantial amount of this clusterfuck would disappear. But that would violate the Stallman Way(tm), so what folks end up with is the above. I still have no clue what "trousers" is -- oh sorry, it's apparently spelled TrouSerS. Yes really.
This mess is the main reason I avoid use of GPG.
"It makes a great utility for others to be able to use to verify whatever" I don't really agree with. For example, let's talk about SpamAssassin: for whatever reason, this program prefers (borderline requires, i.e. if you aren't using GPG you will get flack in support tickets) use of GPG in some way relating to downloading anti-spam rulesets. Why is this necessary for something like anti-spam rulesets? If it's to verify integrity of, say, rules/tarball/whatever, then MD5/SHA1/SHA256 works just fine for that. Exactly what about an anti-spam rulesets warrants extreme security through GPG? What problem is trying to be solved here?
The above dependency chaos is one of many reasons why BSD folks try and re
Interesting - I wonder why GNUTLS is a depedency (I'm building it from source on IRIX right now, no GNUTLS (currently built) on there). On the GPG website libksba is listed as optional, and npth is listed as 'you don't need it but probably want it'.
I'm all for replacing a lot of GNU software because of issues like that. Tying to build it manually ends up being a nightmare, because a lot of it depends on other GNU software they you may not want on there for various reasons.
I'm starting to think GNU is the problem with "GNU/Linux" these days.
Hmm, now I wonder why too! Part of me thought "maybe GNUTLS is included with GPG" (as in you can alternately have it link to a shared library version, or you can just include it right into GPG statically), but looking at the git repo for GPG I don't see any sign of it.
You can verify my claims of dependencies here:
http://www.freshports.org/security/gnupg/
http://www.freshports.org/security/gnutls/
All that said: it looks like the gnupg port has an option for GNUTLS dependency (it defaults to being enabled). For whatever reason I never noticed this before, probably because it's the first menu option (I often miss this). Before and after disabling GNUTLS, dependency counts:
Before: 30
After: 13
Much more manageable, although I'd still love to get that down smaller if at all possible. Getting rid of libksba would be nice, especially if it's optional. As you can see here, it's labelled a hard dependency (both for compiling and running):
https://svnweb.freebsd.org/ports/head/security/gnupg/Makefile?revision=376062&view=markup
If it's truly optional, I should be able to submit some patches that provide those knobs (for toggling both libksba and libnpth). I still have no idea what the pinentry stuff is about, but it looks to me like it should be optional: https://www.gnupg.org/related_software/pinentry/index.en.html
I think it may be that the FreeBSD port is just "bloated by default" (similar to what I find on a lot of Linux systems), and lacks knobs to slim it down. But hopefully that gives you some idea why I've avoided GPG for a while, and why it's important port/package maintainers not let things get too out of hand.
Looks like I'll have to do some experimenting. And thanks -- this good /. convo has gotten me considering fixing all that and getting a "slim" GPG going for FreeBSD.
Slight bummer, but not too bad: despite what the docs may say, both libksba and npth are hard requirements. If you're able to build this on IRIX without those libraries, then maybe you're using an older GPG version (I'm testing 2.1.1), not sure.
configure will bail out if it cannot find libksba or npth on your system. The autoconf script has no flag to tell it to ignore these; the code explicitly throws error messages and bails if they're missing. Reference for my statements:
libkbsa requirement: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=configure.ac;h=f07f345b470046af4414fd39c22cc149f112134a;hb=refs/heads/STABLE-BRANCH-2-0#l1530
npth requirement: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=configure.ac;h=f07f345b470046af4414fd39c22cc149f112134a;hb=refs/heads/STABLE-BRANCH-2-0#l1539
As for pinentry: apparently that's needed for gpg-agent to "work securely", but if a person doesn't plan on using gpg-agent, I don't see why this is a requirement. configure does support --disable-agent. However, GPG won't build with --disable-agent -- it appears there's a bug in tests/openpgp/Makefile* that "hard-depends" on gpg-agent existing for it to work, so the build process fails near the very end. :/