Slashdot Mirror


GPG Programmer Werner Koch Is Running Out of Money

New submitter jasonridesabike writes "ProPublica reports that Werner Koch, the man behind GPG, is in financial straits: "The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive. Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded." (You can donate to the project here..)

48 of 222 comments (clear)

  1. Latest update by Anonymous Coward · · Score: 5, Informative

    From the linked article:

    Update, Feb. 5, 2015, 5:55 p.m.: After this article appeared, Werner Koch informed us that last week he was awarded a one-time grant of $60,000 from Linux Foundation's Core Infrastructure Initiative. Werner told us he only received permission to disclose it after our article published. Meanwhile, since our story was posted, donations have also poured into Werner Koch's website donation page to the tune of nearly $50,000 so far.

    1. Re:Latest update by CronoCloud · · Score: 4, Funny

      -----BEGIN PGP SIGNED MESSAGE-----
      Hash: SHA1

      Well that's good to hear.
      -----BEGIN PGP SIGNATURE-----
      Version: GnuPG v1

      iEYEARECAAYFAlTUChMACgkQnludVzJNqF2p2ACdFew+WZRFx3tgIWLSizrfZuc/
      k1EAoK35K6UURyN3CXW5eUEP4bVas9BP
      =UQA4
      -----END PGP SIGNATURE-----

    2. Re:Latest update by gwolf · · Score: 4, Informative

      You should really update your key. A 1024D key with a SHA1 primary signing algorithm is no longer considered safe.

      (Data point: We did quite a work in Debian to migrate to 2048R with SHA256)

    3. Re:Latest update by chihowa · · Score: 4, Interesting

      It's funny that you should mention that. Werner Koch still uses a 1024D key for email. In fact, nearly everyone at g10code.com either has no key listed or uses 1024D. Most of the people involved in the development of GnuPG use ancient 1042D keys.

      It's not just GnuPG, though. Phil Zimmermann only uses 1024D.

      Perhaps there's something we're missing?

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
    4. Re:Latest update by gwolf · · Score: 4, Insightful

      Interesting thing you mention. Well, our migration was prompted by some theoretical advances; if you look at our slides at DebConf14 you will see some references to papers presented at the EuroCrypt 2012 conference talking about the relative strengths of different keys.

      I don't contest that Zimmerman and Koch know how to communicate securely and what it takes, but maybe we are talking about a different threat model. One thing is identity assurance just for the sake of identity assurance, but in Debian we use it as a core infrastructural part: Get hold of my GPG key, and you have potential root access to thousands of computers. Of course, there are human checks in place, and it's quite unlikely you'd get away with yours... But it's possible.

    5. Re:Latest update by Frobnicator · · Score: 2, Insightful

      I don't contest that Zimmerman and Koch know how to communicate securely and what it takes, but maybe we are talking about a different threat model. One thing is identity assurance just for the sake of identity assurance, but in Debian we use it as a core infrastructural part: Get hold of my GPG key, and you have potential root access to thousands of computers.

      Holy Hell, I hope you mistyped something!

      It is 2015. If you've got a single password (your private key) with root access to that many machines, something is terribly wrong over at Debian.

      For THOUSANDS OF MACHINES let me introduce you to the concept of a key vault. You start with your two-factor credentials to the vault, check out temporary credentials for the individual machine's keys or services you need, and use them for the day.

      Do not allow your single private key -- no matter how many bits long it is -- to have root access to thousands of machines.

      --
      //TODO: Think of witty sig statement
    6. Re:Latest update by swillden · · Score: 4, Informative

      Holy Hell, I hope you mistyped something!

      He didn't, and he's right, and there's nothing wrong with what he's doing.

      The key in question isn't a login authentication credential used to access large numbers of machines. It's the key used by Debian systems to verify that they trust software packages from Debian. Note that all Debian software packages are installed as root, and run scripts as root during the installation process. Many Debian software packages include binary code that is run as root during normal usage.

      This means that an attacker with the signing key and access to the download servers can create packages that run whatever code he likes on every machine that installs them, as root. If he picks packages that every running Debian system has to have, he can control all well-maintained machines within a few days. That would be hundreds of thousands, maybe millions, of machines, not thousands.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    7. Re:Latest update by gwolf · · Score: 2

      Holy Hell, I hope you mistyped something!

      It is 2015. If you've got a single password (your private key) with root access to that many machines, something is terribly wrong over at Debian.

      Others have replied, but I think I should do so as well: Yes, we don't use a PGP key to log in to thousands of machines, but we use it to validate package uploads that enter the archive. If I sign+upload a malicious binary package, it's just a matter of time until it reaches users.

      Of course, there are some caveats: First, I must convince users to use my package. This is, my malicious code should not go in a very uninteresting package, it would go to one that I know that has many users. But, second, it should not attract too much attention, as others would likely find my backdoor. Say, if I wanted to reach maximum number of machines, I could update an "Essential" package, such as base-files. But first, the package is not mine (so my friend Santiago, the package maintainer, would jump at the unexpected upload). And it does not get updates often, so others would probably debdiff it and uncover my betrayal. And third, that would make my malicious package enter the unstable distribution. Were I looking for a real foothold on a large amount of computers, I'd have to wait probably around two years until it reaches a stable release.

      That's why I said "thousands" and not "millions" :-)

    8. Re:Latest update by polymeris · · Score: 2

      Pardon the ignorance, but how complex is a library like GPG? How come he still needs to dedicate himself fulltime to it, after almost 20 years? I would have thought, by now, you wouldn't need more than the occasional bug-fix or maybe port to new language standards.

  2. Re:Wrong Koch by Anonymous Coward · · Score: 5, Funny

    That guy sucks. I will give him money when he gives me that back door I've been asking for.

  3. No, he's not by Ydna · · Score: 4, Interesting

    Looking at the list of donors page, it has this curious summary:

    In 2015 we received 2535 donations of 87299 € .
    In this year we received 2826 donations of 97255 € .

    I'm not sure how to read that as this year is 2015. But if this is all for one person, they don't seem to be hurting for funds now.

    --

    "The great thing about multitasking is that several things can go wrong at once." -me

    1. Re:No, he's not by Rinikusu · · Score: 3, Insightful

      Sub taxes, sub equipment, for a one man operation he could certainly be doing better in the private industry pushing dick pills and dick pics.

      --
      If you were me, you'd be good lookin'. - six string samurai
    2. Re:No, he's not by geantvert · · Score: 2

      I suspect that the first line is for the donations they were effectively received and the second shows all pledges.

    3. Re:No, he's not by Negatif · · Score: 2

      The article was published earlier today - it looks like a lot of donations have come in after that.

    4. Re:No, he's not by pz · · Score: 4, Insightful

      And subtract retirement, and insurance payments, etc., after all that, no one is going to get rich on EUR 90K per year. Not going to starve, but not going to get rich, either.

      To present some perspective, as an employer in the US (yes, I realize things are probably different in Germany), if my personnel budget is USD 90K, that means my employee is getting only USD 61K in salary. The rest goes to various overheads that I pay to support the position.

      --

      Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
    5. Re:No, he's not by houghi · · Score: 2

      In Belgium, a company that has an FTE cost of 90K means that the emplyee will get also around 60K as salary, which means around 30K-40K in his pocket to spend.

      Salaries are mostly calculated per month and you normaly have to device by 13.78, (13th month and payed holiday) so that makes a pay of around 2500EUR per month. (what he sees on his paycheck). The average is 3100 EUR. I excluded Brussels as that is not representative.

      So in Belgium he would also not starve, but also easily get a job that pays more.

      And this is just the taxes, so no infra structure cost. It will include insurance and most likely100% public transport or mileage for 50% for car usage to and from work.

      --
      Don't fight for your country, if your country does not fight for you.
    6. Re:No, he's not by Enigma2175 · · Score: 3, Informative

      PGP has brought incredible value to people, and thus its inventor should be rewarded properly.

      However, this person is not the inventor of PGP, Phil Zimmermann is. Koch just wrote an open source program that complies with the OpenPGP RFC. This is certainly valuable and I do think that the community receives sufficient benefit from this program to support it financially, but Koch isn't an inventor, he is a programmer that implemented a public standard.

      --

      Enigma

  4. Re:Hal Finney by cheesybagel · · Score: 4, Informative

    Wrong. PGP was created by Phil Zimmermann and Hal Finney was the second developer they hired. GnuGP is an open-source reimplementation of the PGP standard written by Werner Koch.

  5. Re:FOSS Funding by bill_mcgonigle · · Score: 4, Insightful

    Can't he just sell support or something? Isn't there supposed to be viable funding models for FOSS projects?

    He does sell support.

    However, I suspect he's been offered many contracts and never knew about them:

    Please do not send any attachments with ZIP files or any HTML in it. They are all silently discarded. Note, that this includes messages send as plain text plus HTML.

    There is something I'd like to do with GPG that isn't a standard yet. I'll have to remember to scrutinize Thunderbird's settings before sending him a solicitation.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  6. dear werner, please finish the damn thing by Anonymous Coward · · Score: 5, Funny

    Michelangelo finished the pieta in 2 years. You've had 18!! Look, it's good stuff, and you could probably milk this till retirement. Even Michelangelo realized finally that if he took one more swing at his sculpture, he'd have detracted from it.
    You keep this up, you're gonna turn out just like that Torvalds kid.

  7. Re:Wrong Koch by bobbied · · Score: 5, Informative

    Too bad, I know of two of his relatives who have more money then they know what is morally correct to do with.

    You mean donating $100 million to help build up a hospital in New York isn't morally a good thing?

    http://freebeacon.com/blog/koch-brother-donates-money-to-hospital-liberals-protest-not-a-parody/

    Another $100 Million for Cancer Research at MIT.

    Another $25 Million for Cancer Research at MD Anderson in Huston TX.

    Then there are donations to the Arts, National Museums and believe it or not *environmental* projects which are on record...

    Yea, these Koch brother guys are the surge of the earth all right, spending all that money on such bad things...

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
  8. Re:Wrong Koch by riverat1 · · Score: 5, Insightful

    They also gave money to the Berkeley Earth project. That one didn't quite turn out like they wanted.

    They also tried to give money to the Florida State University Economics Department with some provisos:

    First, the curriculum it funded must align with the libertarian, deregulatory economic philosophy of Charles Koch. Second, the Charles Koch Foundation would at least partially control which faculty members Florida State University hired. And third, Bruce Benson, a prominent libertarian economic theorist and Florida State University economics department chairman, must stay on another three years as department chairman — even though he told his wife he’d step down in 2009 after one three-year term.

    So much for academic freedom.

  9. Uhhhh by Sycraft-fu · · Score: 5, Insightful

    You realize even taking taxes in to account, most people make a lot less than that and do just fine, right? When you see income reported, it is normally pretax. If you think most people are making more than 90,000 Euro a year, you are really out of touch. That's a lot of damn money, in any country, enough to live well. You aren't rich, but you are doing just fine.

    1. Re:Uhhhh by CRC'99 · · Score: 5, Interesting

      I hate to say it - but most people who do OSS work for the masses don't get paid for it.

      I do packaging for Xen used from hobby users through to Disney - yet I get about $400AUD per year in donations. I also have to go buy my own test hardware (I need UEFI kit atm!).

      I understand exactly what Werner means and the challenges faced - but I too don't see a solution for this. OSS has been linked for too long as a 'free solution' - which means nobody puts a currency value on the software and services that are made available to the world. I think its the mental relationship of OSS being 'free' causes it. Nobody blinks an eye to pay $100 for a Windows license - yet go for a $10 donation to an OSS project and people lose their minds...

      --
      Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
  10. Re:Wrong Koch by Anonymous Coward · · Score: 5, Insightful

    Correct, their donations have no moral basis; they are only doing this because one of them had cancer and they are hoping to ensure their own survival. Gates on the other hand is fighting malaria and other diseases that are of moral concern because people don't need to worry about them.

  11. Re:Wrong Koch by Anonymous Coward · · Score: 3, Insightful

    As someone who has spent a lot of time working around Ph.D. academics, let me clue you in. EVERY US university of any appreciable size whores itself out like this to some collection of rich benefactors/organizations. Mainly because half of the degrees it awards are outright worthless for a career (hard to get alumni donations from the Literature major that has spent the past 10 years since graduation working their way up to local Starbucks manager, or worse, gotten a humanities Ph.D.) and the other half are for jobs that congress and corporations can't outsource fast enough.

    Most American universities have long since ceased being about education, and are now primarily indoctrination camps spreading the propaganda and ideology of the highest bidder.

  12. Re:Wrong Koch by macsimcon · · Score: 5, Insightful

    Right, and all those donations don’t even add up to a fraction of the nearly $1B they plan on spending to influence the 2016 election.

    If a Nazi donated $100 to a soup kitchen, does that forgive Auschwitz? And don’t lecture me on Godwin!

  13. Re:Wrong Koch by Anonymous Coward · · Score: 5, Informative

    The goodness of their philanthropy does not excuse their usurpation of the 'Democratic Republic', the USA. They are part of the reason the US is now a Corporate Oligarchy!

  14. Re:Wrong Koch by WarSpiteX · · Score: 3, Insightful

    Dude, you're posting on Slasbergers with people who read The Fountainhead as teenagers and it totally blew their minds, and been assburgers types they can't grow out of the mindset.

    --


    I'm a little segfault, short and stout.
  15. Phil Zimmerman by fred911 · · Score: 2

    How soon we forget someone who stood up. Someone who should be honored for his contributions to free speech, expression and privacy,

      Besides, isn't PGP Snowden used?

    --
    09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
  16. Re:Wrong Koch by epine · · Score: 5, Funny

    Dude, you're posting on Slasbergers with people who read The Fountainhead as teenagers and it totally blew their minds, and been assburgers types they can't grow out of the mindset.

    Funny, in my experience it's the people who aren't blessed with Asperger's syndrome who are particularly prone to pontificate on the basis of choir-pleasing ass-pluck.

    Perhaps we should really rename it obsessive factual reality disorder.

    Furthermore, a great many people who read The Fountainhead at a young age and found it mind blowing went into politics. How I wish more of these people had enough Asperchlorians in their bloodstream to balance their own chequebooks.

  17. Re:Wrong Koch by Anonymous Coward · · Score: 2

    Got a source on that? I'd like to cite it to a few people.

  18. Re:usability by CronoCloud · · Score: 2

    Remember that Werner's native language isn't English. I think the PDF version of the Documentation is fairly good. The HTML version...could use a bit more work on the navigation interface.

    http://www.gpg4win.org/documen...

  19. Re: Wrong Koch by macsimcon · · Score: 5, Insightful

    Another right-wing canard to debunk. Oh well here goes...

    For every Soros who is spending money to promote "collectivism" (code used by Ayn Rand-loving sociopathic troglodytes who haven't had a date this century) , there are ten or more Adelsons and Kochs promoting their fascism. It isn't even close dude.

    I think it's great that the Koch brothers give to charity, but at those levels, it's like someone who earns $40K per year giving $100 in total to charity each year. Not exactly a sacrifice.

    It's even worse because that worker earning $40K per year can't pay for all of their necessities for life on that salary, where the Kochs have already paid for everything they'll ever need.

  20. Re:Hal Finney by anagama · · Score: 5, Insightful

    I know it is against the rules to RTFA, but sometimes it is worth it:

    Email encryption first became available to the public in 1991, when Phil Zimmermann released a free program called Pretty Good Privacy, or PGP, on the Internet. ... The U.S. government subsequently investigated Zimmermann for violating arms trafficking laws because high-powered encryption was subject to export restrictions.

    In 1997, Koch attended a talk by free software evangelist Richard Stallman, who was visiting Germany. Stallman urged the crowd to write their own version of PGP. "We can't export it, but if you write it, we can import it," he said.

    Inspired, Koch decided to try. "I figured I can do it," he recalled. He had some time between consulting projects. Within a few months, he released an initial version of the software he called Gnu Privacy Guard, a play on PGP and an homage to Stallman's free Gnu operating system.

    As a side point, Stallman is endlessly criticized around here, laughed at, etc. But he inspired Koch to do something really important and that should be recognized a little bit. Obviously Koch deserves massive praise (and funding) because he did all the work, but it also struck me how important philosophical and moral principles can be in making the world a better place because they can inspire people to do the work.

    --
    What changed under Obama? Nothing Good
  21. Re: Wrong Koch by Anonymous Coward · · Score: 2, Insightful

    http://www.washingtonpost.com/blogs/right-turn/wp/2014/03/27/democrats-funded-by-billionaires-complain-about-republicans-funded-by-billionaires/

    "But if it’s all that terrible to take billionaires’ money then the Democratic candidates and the Senate Majority PAC should give back their billionaires’ cash"

    http://www.realclearpolitics.com/articles/2014/04/08/the_lefts_billionaire_outsider_hypocrisy_122196.html

    "Who are the Senate Majority PAC’s biggest donors? They include out-of-state billionaires like Hollywood bigwig Steven Spielberg, music mogul David Geffen and former New York City Mayor Michael Bloomberg. “Mayor Mike” donated $2.5 million to the group earlier this year. According to the Center for Responsive Politics, the group’s donor list isn’t short on moneymen funding races in states they don’t live in."

    Pot... meet kettle.

  22. Re:Wrong Koch by Anonymous Coward · · Score: 2, Funny

    No, sorry. I promise it's true though. I read it on a Slashdot comment.

  23. S/MIME called .. it wants it's something something by ModernGeek · · Score: 3, Informative

    I switched to S/MIME because of the easy ability to have a third party sign your key, and the recipients recognize it; utilizing a similar web of trust that we use for SSL. Sure it isn't perfect, but it's a good platform. All the major mail clients support it as well. Unless you're really worried about privacy, it's good enough.

    However, I feel it's the duty of large corporations that profit from the efforts of men like Werner Koch to hire, retain, and support these people, and allow them to freely continue their research. If not through employment, then through grants.

    <joke>I guess he shouldn't have sold all his Radio Shack stock</joke>

    --
    Sig: I stole this sig.
  24. Re:Wrong Koch by I'm+New+Around+Here · · Score: 5, Funny

    Asperchlorians

    My new favorite fake word.

    Not to unseat my favorite real word: quintessential.

    --
    If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
  25. Re:Wrong Koch by Andtalath · · Score: 2

    Assburgers is often used as a means of indicating that someone does not in fact have Aspergers Syndrome, but is merely acting like an ass.

  26. Re:Hal Finney by Andtalath · · Score: 3, Insightful

    He is a smelly hippy.
    However, he is very intelligent and has a solid foundation for what he's saying.

    So while he is somewhat ridicolous, he is also highly fascinating.

  27. Re:Wrong Koch by johanw · · Score: 2

    If you want to see what a healthy combination of as free as possible market and government protection for the underclass does, go visit northern Europe. Both fundamentalists views on the economy (pure communism and libertarianism) lead to disaster.

  28. Re:Wrong Koch by Sique · · Score: 2
    Greece is actually an example of the "low taxes for rich people" approach, not for collectivism. In Greece, allowing rich people and property owners to avoid taxes brought the whole state in financial disarray while at the same time "trickle down" economics just didn't work.

    From a taxation point of view, Greece is a libertarian heaven. Your point being?

    --
    .sig: Sique *sigh*
  29. Do not mix up FOSS and running a business so fast! by HnT · · Score: 3, Interesting

    Note this part of TFA:

    For almost two years, Koch continued to pay his programmer in the hope that he could find more funding.

    So he is also a business owner making bad decisions and pays employees doing programming for him. Are FOSS projects not usually run by not financially dependent-on-each-other volunteers and on code submissions? It seems to me GPG has failed to establish something other projects have successfully done: a tightly knit community in which the whole project does not rest on the shoulders of one man alone. It seems Mr. Koch was trucking along on government funding alone and had no other source of income, this feels like another bad decision to me. This whole project feels like a very strange mixture of FOSS and running a business based on it while expecting to be paid as if it was a closed source, shareware program.

    By all means, he deserves all the donations he can get but maybe it is high time to take a step back and look at how some things might have been run badly and how to improve on that.

    --
    "Only one thing is impossible for God: To find any sense in any copyright law on the planet." - Mark Twain
  30. Re:Wrong Koch by gordo3000 · · Score: 2

    really? considering almost all their money goes to support folks who push for exactly all those things, I think I'll be using revealed preferences to figure out what they really believe, rather than listening to the PR spin.

  31. Math says "No" by T.E.D. · · Score: 3, Insightful

    You mean donating $100 million to help build up a hospital in New York isn't morally a good thing? Another $100 Million for Cancer Research at MIT. Another $25 Million for Cancer Research at MD Anderson in Huston TX.

    Those gifts were spread out over the last 8 years. The Average American gives about 3% of their income to charity yearly. The Koch's made about $10 Billion last year, so reach that standard, they would have had to give $300 Million last year alone. It only looks like they are giving a lot in absolute terms because they are so ridiculously wealthy.

    The Koch's are hardly alone in being relative skinflints. The percentage of income given to charity actually rises as income drops. For example, the most destitute zip in my town averages about 7.5%, while the richest gives less than 4% (yes, we are a generous state. Also a poor state). So if it is really charitable giving you care about (as your post seems to imply) then the best way to increase it is to find a way to move money away from the top end of our income distribution, and towards the bottom end.

    Math.

  32. Re:Wrong Koch by Whorhay · · Score: 2

    I'm not a fan of the Koch brothers but no one is all evil or all goodness and light. I disagree with the Koch's political spending, but we can still acknowledge the good some of their charitable giving does. As a parent of small children I've noticed that focusing solely on the negative behaviours does nothing to prevent it, while a more balanced approach seems to get better results.

  33. Re:Wrong Koch by oldmac31310 · · Score: 2

    Gates is only doing this in case he contracts malaria!

    --
    http://www.acetonestudio.com