Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Encryption Security

Zimmermann Suggests Freeing PGP Source 211

Posted by timothy from the like-the-wind dept.
broody writes "NewsForge has an interesting article detailing Phillip R Zimmermann's lament at selling PGP. Since he cannot afford to buy it back outright, he is pushing for Network Associates to 'open source' it. Well, the GUI and SDK anyway. I'll say this, he's an interesting little capitalist."
This discussion has been archived. No new comments can be posted.

Zimmermann Suggests Freeing PGP Source More

Zimmermann Suggests Freeing PGP Source

Comments Filter:

  • Free PGP? How about GnuPGP (Score:4, Insightful)

    by (H)elix1 ( 231155 ) <slashdot.helix@nOSPaM.gmail.com> on Tuesday July 02, 2002 @04:46PM (#3810265) Homepage Journal
    Why bother? Its gone, sold, IP traded for cash. He knew what hw was doing when it was traded for money. If he really wants to do something, GnuPGP would probably welcome him with open arms...

    • Re:Free PGP? How about GnuPGP (Score:4, Insightful)

      by Neon Spiral Injector ( 21234 ) on Tuesday July 02, 2002 @04:51PM (#3810311)
      No, they probally wouldn't. The IP belongs to NA, and I think he has probally seen the source code, so Gnu couldn't claim their code was a clean room implimentation.
      • he has probally seen the source code, so Gnu couldn't claim their code was a clean room implimentation.

        Nothing of the sort is neccisary. BSD unix was a non-cleanroom reimplimentation of AT&T unix. BSD won when it went to court. It is easier to be cleanroom though.

        • BSD unix was a non-cleanroom reimplimentation of AT&T unix. BSD won when it went to court.

          But only an organization like BSD, backed by the University of California and their lawyers, had the resources to stand up to AT&T in court. I wouldn't suggest being cavalier about clean-room issues to any random Open Source project.
      • I'd beg to differ. read the (currently highest moderated) post by Bruce Perens begging Phil to Join the GPG team
      • they ont HAVE to claim their code is clean room... as long as no code is copy-pasted over then its ok... if there is some type of bug or other problem in the code and he knows HOW to fix it but not the exact code he CAN tell them how to do that... he can give them ideas about what to do as ong as he doesn't drop in some code...
      • He could probably join the project as an advisor, as long as he didn't write any code, and not break the "clean-roomliness" of the code.
    • PGP is very good in Outlook for email and within Windows for it's other features. Not making it available for Windows leaves people stuck in Windows with only proprietary options bundled in with Outlook/Windows, or those supplied by other vendors. GnuPG (not GnuPGP) dont work in Windows (well, it might via cygwin, but I'm not counting on it).

    • Re:Free PGP? How about GnuPGP (Score:5, Insightful)

      by Zeinfeld ( 263942 ) on Tuesday July 02, 2002 @08:14PM (#3811615) Homepage
      If he really wants to do something, GnuPGP would probably welcome him with open arms...

      Have you tried to work with Phil Z.? Oh... thought not.

      People who end up in the mess Phil did are not always the folk with the best social interfaces...

      The problem with PGP is that overall it is tending to hinder the use of crypto than help at this point. There is perfectly good crypto built into Outlook, Outlook Express, Notes, Netscape etc. Only thing is people don't know its there because they are being told that only crypto persecuted by the NSA should be used.

      PGP has a somewhat different PKI design, but not all that much different. Anyone can be a CA with X.509, the only technical difference being that certificate signing certs have the key signing bit set.

      Rather than attempt to resurect the PGP message formats it would be better to spend time building S/MIME key signing code.

      • Zeinfeld writes:

        PGP has a somewhat different PKI design, but not all that much different. Anyone can be a CA with X.509, the only technical difference being that certificate signing certs have the key signing bit set.

        Sure, anyone can be an X.509 CA, but that doesn't help much. In order to issue meaningful X.509 certificates, you need to be a widely trusted CA, and that means commercial certificate distribution deals with Verisign, AOL and Microsoft, and that pretty much rules out all but big businesses.

        PGP's web of trust has a much lower barrier of entry.
        • Sure, anyone can be an X.509 CA, but that doesn't help much. In order to issue meaningful X.509 certificates, you need to be a widely trusted CA,

          That has nothing to do with the format of the certificate. It is simply basic math.

          All the major email programs allow you to install your own trust roots, always have. The problem is getting a trust root widely recognized.

          The diameter of a graph is the length of the longest path between two nodes. If the diameter of the graph is small then either the graph cannot be large or there must be at least soe nodes of very high degree. [The Moore bound on the diameter of a graph is k * (k-1)^d where k is the degree of the nodes and d the diameter.

          Applied to PGP it means that if you have a Web of trust with a trust chain length of 5 and each person signs ten other keys you can have no more than 90,000 members if the members align themselves perfectly. In practice the size of the graph would be much smaller since the connections would be either random or highly locally connected which gets you down to about 10,000 users.

          PGP works largely because people take untrusted keys of key servers and because there are folk like Jeff Schiller who have signed hundreds of keys.

          If you want a global PKI then you need intermediaries. PGP is not designed to scale to be a global system. But if you are prepared to put up with the size limitations of the PGP model you can do the same in S/MIME.

          Microsoft even ship a mini CA tool with Office and Visual studio - makecert.exe. It is a bit idiosyncratic and you need to get another tool fro the Microsoft site to convert the private key formats to PKCS12 format but it certainly works. The SSLeay code also has a cert signer.

  • If this guy sold PGP five years ago, what authority does he have now to suggest the change?

    • Re:Why listen to him? (Score:5, Insightful)

      by Cally ( 10873 ) on Tuesday July 02, 2002 @04:57PM (#3810366) Homepage
      > If this guy sold PGP five years ago, what authority
      > does he have now to suggest the change?

      "This guy" [philzimmermann.com] developed the PGP protocol, and it's first implementation, then released it freely on the Internet when it seemed likely the US Govt. was about to criminalise *all* personal encryption.

      So, only moral authority... which doesn't seem to be worth much on the free market, these days.

      • Re:Why listen to him? (Score:3, Insightful)

        by Anonymous Coward
        Not only that, but he was involved in a legal quagmire for quite some time, thanks to the U.S. government classifying encryption as a munition. It is hard to blame the man for selling PGP when his legal expenditures probably placed him in quite a bit of debt.

        We should all be thankful that Phil was willing to stand up for something like this.

        • Re:Why listen to him? (Score:2, Insightful)

          by klykken ( 310263 )
          Fact is, we need him with us more than ever. If not as GnuPG contributor, then as a speaker of technology/crypto and the freedom of the people. In both the U.S. and Europe, the 1984 ghost is materializing.
      • No he didn't. Phil developed the first version of PGP and guided it's development afterwards. A lot of the formats (key rings, etc) were developed by others. Phil continued to guide development though. He released it on the Internet after a row with RSA (the Feds only came in later) over the use of their patented algorithms.

        I know, I worked on it for a while back in the early days.

    • If it were sold in Europe and treated as Art, which code can be, than Zimmerman would have full authority to audit and suggest changes in course on any future revisions on his 'art'.

      Is Code a product, or a design, design's are art, objects are property.

      -Gih
      Didn't you read the sign? Accepting this lawnmower at discount enables us to come install this here billboard on your yard! Damn illiterate lawn users.
    • what authority does he have now to suggest the change?

      Over here we call it the "First Amendment".
  • What sucks is they dropped the commercial VPN client totally, the freeware version is still around (or was a couple weeks ago) but it only supports machine to machine, no machine to network connectivity, that was only in the commercial version.

    • What sucks is they dropped the commercial VPN client totally, the freeware version is still around (or was a couple weeks ago) but it only supports machine to machine, no machine to network connectivity, that was only in the commercial version.

      That doesn't suck at all, unless you're using Win95/98. Win2k has built in IPSec and it works quite well with FreeS/WAN (I am using it every day). vpn.ebootis.de [ebootis.de] (funny name, great documentation) shows you how to patch FreeS/WAN to use X/509 certs, and how to generate the certs, and how to make win2k and FreeS/WAN play nice together. PGPNet for Win2k was a little bit of a goofy thing.

  • If a company is going to dump a product, they should open source it.

    If they can't make money with it, and they don't plan on it, it could be used to build will and advertising. Part of the requirement would be to leave in the advertsing banners. Or require some form of license for inclusion into other commercial software.

    Note that they have not conceeded that PGP cannot be sold off, yet.

    • While that sounds good in practice, there's a ton of issues that stand in the way of this becoming common practice.

      The primary issue is that open sourcing previously closed source applications is not something the company can do for free. There's a ton of legal issues that must be considered (use of third party code, etc, etc) before a release can be made, that costs time and it costs a lot of money in most cases.

      Then you hit secondary issues like shareholder reaction to the company not only giving its products away for free to whoever wants them, but also giving source code and thus some perceived competitive help (even if its not true) to the company's competitors.

      All in all, there are a lot of headaches involved. Its not something most companies will do unless there's some direct market benefit for them, ala commoditizing a compliment (see here [joelonsoftware.com]).

    • Used to work for a big company that started Open Sourcing some of their products. Set up a special comittee to supervise the process. Which started getting all kinds of OS requests, many from ex-employees who wanted to regain access to the source code for their pet projects.

      The generic response was "Open Source does not mean taking a product we don't want any more and throwing it over the wall. It means taking a product we continue to maintain and donating rights to it to the open source community. We can't just give away software without assessing the legal and PI risks. That's an expensive process, and we just won't do it unless it helps us start an OS project with some real potential."

      I might be misquoting (that's why I don't name the company), but you can see the issues.

  • good newssource? (Score:1, Interesting)

    by gol64738 ( 225528 )
    not to bash slashdot, but why is it that Linux Today [linuxtoday.com] always posts the latest linux stories at least half a day before slashdot does?

    anyways, on a side note, i think zimmerman is in the wrong here. if he is so concerned about the concept of pgp, then why isn't he focusing his efforts on GnuPG [gnupg.org], which is a completely open version of the PGP concept?

  • Umm. (Score:1, Redundant)

    by MisterBlister ( 539957 )
    Maybe he should have thought about that before selling it?

    Considering Network Associates isn't developing it further, I somewhat see his point, but I don't see how he really has a say in the matter.

  • What about doing what Microplanet did with their Gravity news reader and making it freely available in binary format for all to use?

    That way they don't have to give up the rights to it, but still have a loyal base of users. When they're able to make a buck off PGP again they can add some "must-have" features and the customer base will slowly come back to the commercial fold. As it is, the freeware versions will dominate and eventually PGP will be forgotten by most people.

  • Dead Man's Switch (Score:4, Interesting)

    by peterdaly ( 123554 ) <{petedaly} {at} {ix.netcom.com}> on Tuesday July 02, 2002 @04:57PM (#3810364)
    His idea for a Dead Man's Switch license would be very interesting to see implemented. It would be nice to see something like that used in a lot of commercial software.

    Think of all the software that might still be available if they had such a clause in their license. Hell, just the games!

    -Pete

    • Re:Dead Man's Switch (Score:5, Informative)

      by Bruce Perens ( 3872 ) <bruce@perens.com> on Tuesday July 02, 2002 @05:20PM (#3810546) Homepage Journal
      This is sort of like source-code escrow, but not customer-specific.

      In source-code escrow, the vendor promises to provide the source-code to the customer if the vendor goes out of business.

      The problem is that bankruptcy courts often overturn source-code escrow clauses, because the source code turns out to be the firm's only salable asset.

      The best solution is to free the code first, and for the customer to be careful not to become dependent on closed-source.

      Bruce

      • In source-code escrow, the vendor promises to provide the source-code to the customer if the vendor goes out of business.

        The problem is that bankruptcy courts often overturn source-code escrow clauses, because the source code turns out to be the firm's only salable asset.

        Sorry to follow this a little off-topic, but this is interesting as I'm currently working with a commercial third party and we have a source-code escrow clause exactly of the sort you mention. Can you cite any specific cases where these have been overturned? I ask not because I disbelieve you but because it would be good to have case law to show my management so we can evaluate the risk of this happening to us (we're not confident of the future stability of the third party).

    • Re:Dead Man's Switch (Score:5, Insightful)

      by kalidasa ( 577403 ) on Tuesday July 02, 2002 @05:24PM (#3810578) Journal

      His idea for a Dead Man's Switch license would be very interesting to see implemented. It would be nice to see something like that used in a lot of commercial software.



      They used to have that. It was called copyright. One got a fixed term of copyright, could renew it for a small fee after that term to extend it to 75 years (net, not additional), and then it would go public domain after the 75 years were up. Then someone thought of the Berne Convention, and someone else thought of the Bono Bill, and someone else thought of the DMCA . . .


      • I agree with the sentiment, but there's nothing in copyright law that commits people to releasing source code once the copyright term has finished. All it means is that you can re-distribute the copyrighted material (most usually the binaries) at will, legally. If the source code was never released to the public, there's no law that forces you to suddenly make it available.
    • I think BitKeeper had a "dead man's switch" clause that would place BitKeeper under the GPL, but I can't find it on the web site...
      I found some info here [bitkeeper.com], but it doesn't address the "dead man's switch".
    • a Dead Man's Switch license would be very interesting to see implemented

      You mean something like the KDE Free Qt Foundation [trolltech.com]? Qt is triple licensed: GPL, QPL, proprietary. If TrollTech discontinues the free edition of Qt, then the last available version will be released under the BSD license. (I'm not sure whether that's with the advertising clause.)

  • PGP being sold out was the inspiration for the OpenPGP project which generated GPG, a perfectly good alternative to PGP.

    The only real problem with GPG is the comparative lack of high quality "mere end user" facilities such as a good GUI.

    Let's all dump PGP, it's served its purpose and its time is done. Put your effort into making GPG (real open source!) widely accepted and used.

    • Re:GPG is just fine but GUI needs work (Score:3, Interesting)

      by Anonymous Coward
      Why not check out WinPT [winpt.org]?

      They have a nice little frontend for GPG that can sit in your system tray, and related projects bring GPG in to the Mozilla and Eudora mail clients as well. Plus, it's GPL'ed.

      That's only for Windows, but I'm sure there are plenty of good GPG front ends for Linux and other Operating Systems as well.

      I've switched, and I'm not looking back.

  • A thought (Score:2, Interesting)

    by Real World Stuff ( 561780 )
    Since he developed PGP, why not develop a RGP, or Really Good Privacy. He can keep this one open, and it can compete with the closed source version.

    It offers the liberty of being Free and Free.

    Just my .0199999999

  • Sad for Zimmerman but irrelevant (Score:3, Insightful)

    by mikehunt ( 225807 ) on Tuesday July 02, 2002 @05:02PM (#3810415)
    When Zimmerman sold PGP, what did he expect? That people would start paying
    Network Associates money to use something that most people still don't
    see the need for?

    Forget it Phil. You killed PGP when you sold it. GPG is there take over from
    PGP and make sure that those who understand the need for good encryption still
    have some reviewable source to trust.
    • Perhaps he should buy it from them for what he paid. Then he can do with it what he wants.

    • Re:Sad for Zimmerman but irrelevant (Score:1, Interesting)

      by Anonymous Coward
      Actually, there is lots of companies that would pay lots of money for a product like that, NAI charged way to little.

      There are quite a number of IT-related companies run by people who are just clueless when it comes to business.


    • When Zimmerman sold PGP, what did he expect? That people would start paying
      Network Associates money to use something that most people still don't
      see the need for?

      Maybe he expected a large company like Network Associates might know how to properly market and maintain the product. Its seems that if that assumption was made, it was incorrect.
  • Didn't I read where they were "asking" people to remove copies of PGP for download, even though they didn't offer or support PGP anymore?

    Doesn't bode well, if you ask me.

  • Unreleased Updates (Score:3, Interesting)

    by MacDork ( 560499 ) on Tuesday July 02, 2002 @05:06PM (#3810448) Journal

    I've read on numerous occasions that NA has versions of PGP updated to run on OS X and XP, but aren't releasing them. Something to do with 9/11 maybe? It seems stupid to simply throw away a defacto standard.

    Let's hope the geeks here make that problem irrelevant. So far the Mac side is doing *OK* with tools like GPG Tools [tomsci.com], GPGMail [sente.ch], and Apple's own AES encrypted volumes using Disk Copy. However, syncing with key servers, file wiping and other functionality available in PGPFreeware is sorely missed. Maybe Phil Z should start a company focused on GPG rather than wasting his energy trying to get PGP open sourced...

    • Re:Unreleased Updates (Score:4, Interesting)

      by zulux ( 112259 ) on Tuesday July 02, 2002 @05:44PM (#3810704) Homepage Journal
      To stroke the black helicopter theories...

      Several friends of mine work at Microsoft, and apparently, according to one of them - important government types have been at the Microsoft campus. This gist is that has somthing to do with the whole DRM/encryption thingy.

      It makes sense in a odd sort of way - if the govenment could get a back door into the worlds most popular operating system, they would have a goldmine. I'd be disapointed in the NSA if they diden't try.

      • Some people just can't realize that if Microsoft can access you computer (DRM enforcing, Windows Update, Whatever), then the Goverment does as well. I cannot think of any reason why Microsoft would fight against goverment access. After all, they are their BEST allies.

        What do they have to lose? If it ever gets public they'd say "How, they forced us, to prevent terrorism. There's nothing we can do. It's the price for our societies safety. We are glad we are helping our people win against terror".

        We could do a poll about this topic, and see what the crow thinks.

    • I've read on numerous occasions that NA has versions of PGP updated to run on OS X and XP, but aren't releasing them. Something to do with 9/11 maybe? It seems stupid to simply throw away a defacto standard.
      Why is the immediate reaction to news like this on Slashdot always a conspiracy theory? Have you considered the possibility that companies like NAI (which are in business to make money) simply don't see any reason why they should give a product away for free? They paid good money for PGP and it turned out to be a real turkey.

      Apparently they still sell the command line version. In an odd-case of open source business cases reversing themselves, Phil wants them to open source the GUI. If they do that, how long will it be before someone writes an open source set of command line tools? I guess they could release it with a special license that prohibits you from developing command line tools. Of course, someone would do it anyway and lawsuits would ensue.

      The whole dead man's switch thing is pretty funny. Basically what Zimmerman is saying is "here's a product that I know is going to drive you into bankruptcy, so I'm taking advance precautions." If you really want the program then go buy it. Get together a consortium of interested parties and start a fund to buy back the rights. Of course, it would never work, but that's never stopped people before.

      -a
      The advantage of the GPL is that your customers can maintain and upgrade your software, even after you go bankrupt.

  • Phil, Please Join Us! (Score:5, Interesting)

    by Bruce Perens ( 3872 ) <bruce@perens.com> on Tuesday July 02, 2002 @05:07PM (#3810453) Homepage Journal
    Phil,

    We'd really like you to join the work on GnuPG, and on GUI projects like GNOME. I think it would be most productive to write off the PGP code base and continue your work on the existing Free Software projects. We've gotten most of the hard work done already.

    Thanks

    Bruce

    • Re:Phil, Please Join Us! (Score:4, Insightful)

      by MAXOMENOS ( 9802 ) <mike&mikesmithfororegon,com> on Tuesday July 02, 2002 @05:47PM (#3810723) Homepage

      Let me second this. (Yes, I'm seconding Bruce Perens. How's that for chutzpah?.)

      Most of the Gnu Privacy Guard code base is in place, but we still need a ton of help with GUIs [gnupg.org], APIs [gnupg.org], Web-based encrypted email [winpt.org], etc. And there is no GnuPGFone as far as I know.

      I know PGP is your baby .. I can appreciate that, and I know what it's like to lose control of your baby. I'm not going to pretend that GnuPG is the same thing. Nonetheless, GnuPG is working toward (mostly) the same goals, and that's something worth considering. They could also use your help, as you have years and years of hard-won experience in this field. Yeah, they're young punks, but they mean well and they do good.

      Just my two cents.

    • Bruce,

      You don't need prz for the GUI. The only 'secret' when preparing a crypto-GUI is to make sure that anything containing key or secret material is cleaned after use. That is, you *never* deallocate memory or free up disk space without zeroing, and in the case of disk space, overwriting with patterns first. The crypto engine is the hard part.

      Whilst Phil is a good cryptographer, GUIs making the whole thing understandable are another matter. I think the other guys are doing quite well there.

      GnuPG misses some things like secret sharing (should be there soon) and there is no API for philosphical reasons, however that can be dealt with. The OS crypto community is currently surviving well and will continue to do so as long as various governments/interests don't succeed in tainting the whole idea by the association with terrorism and copyright violation. On these last points we need everyone we can get to keep cryptography free and there Phil can definitely help with the advocacy.

  • I actually paid for a license for PGP Desktop for home and still use it heavily for pgpdisk (the encrypted virtual disk software). I like the thought that even if someone hacks into my computers with my login, they still have some work to do to get the important files.

    While it sucked to see NAI drop PGP, I made sure I pulled down the latest build before my license expired. I can still get another couple of years use out of it.

    I would like to think that someone will eventually pick it up. It's entirely too useful to let it die. It be nice if it turned free, but I would still pay a reasonable amount of money to get a new enhanced version.

    • Re:I like PGP (Score:1, Interesting)

      by Anonymous Coward
      I would like to think that someone will eventually pick it up. It's entirely too useful to let it die. It be nice if it turned free, but I would still pay a reasonable amount of money to get a new enhanced version.

      You don't get it! There is good reason to believe that NAI has put backdoors in for No Such Agency and/or others, and with only binaries available, it's impossible to be certain. Closed source encryption software is utterly useless, regardless of how much it costs.

      Even if you aren't worried about the NSA reading your email (and you should be!), backdoored encryption is a fucking joke, because all it takes is for someone else to figure out the back door and exploit it. Even if nowhere else, at least use open source for your encryption needs.

      PGP is dead. Long live GPG!
    • If you're a heavy PGPDisk user, then you might like BestCrypt [jetico.com]. Does pretty much the same things, except it has both Linux and Win32 "clients". So you can tote encrypted loopback files around, just like with PGPDisk, except you can tote them between a good and a marginal-at-best OS. Works with Win2K and XP, too. And it has some pretty good crpyto algorithm support (even GOST). On the Linux side of things, you can even do funny stuff like have encrypted home directories, encrypted samba shares, etc. The Linux GUI leaves a little to be desired, but the Windows one is pretty good. It's free-as-in-beer for personal use.

      Anyway, I highly recommend it.

      -B

  • he's an interesting little capitalist.

    right now he seems to be a slashdoted little capitalist.

    • Re:interesting? (Score:2, Funny)

      by Psiren ( 6145 )
      Righty-dokey matey-bloke flap old salty sea-dog amigo skip-jack jockstrap piano-tuner, let's see you balls this one up!

      righty dokey skip flip flap jack me old nick nack paddy wack slip de dip lipstick oh look mrs jones bomber harris tweed coat and hat it might be raining achtung baby psycho ward ten minutes please gentlemen its the lavatory express, I will!
  • [you@someterminal you]# cd pgp-source
    [you@someterminal you]# grep -c -r -i "nsa"
    27
  • That being said I tend to think that the push towards GnuPG isn't as great of an idea as some think.

    While there is many "free" or open source projects out there that are great on multiple platforms, GnuPG hasn't yet been fully (if at all) accepted by the Windows users.

    Before you flame me; encryption needs to be open, and it needs to be easy to use in some respects. If my grandma (or male lover) has to go to the command line to encrypt his/her e-mail - it isn't happening. Now I see one project to bring it to the Windows desktop but it's being developed by linux developers.

    If people expect Phil to come over to the GnuPG camp then you have to be ready to develop as much time to the Windows product as *nix.

    Maybe I'm just not making sense because I'm typing fast... but simply: Gui, Gui, Gui. Equal time on all systems. Then I'll put my support behind GnuPG.

    Otherwise Network Ass. should release their control over a product they raped.
    • Maybe I should say this:

      Pub. Key Encryption should belong to the common man and it shouldn't take any _real_ computer knowledge to be private.

      GnuPG lacks this... maybe Phil should just get it back and do it on his own again.

      Paypal donations...? ...lol

    • Re:PGP owns... (Score:3, Insightful)

      by _Sprocket_ ( 42527 )


      Now I see one project to bring it to the Windows desktop but it's being developed by linux developers.

      I've found a whole series of GnuPG interfaces and email plugins for windows (WinPT being my favorite sofar). I don't know if the developers are "Linux developers" or not - but I fail to see how that matters.


      If people expect Phil to come over to the GnuPG camp then you have to be ready to develop as much time to the Windows product as *nix.

      Nobody is stopping any developers from running with GnuPG development on their favorite platform. In fact, as already pointed out, Windows development is definately picking up (probably due to NAI's dropping PGP - way to create an itch / need). And the GnuPG developers are definately thinking ahead with libraries such as their GPGME API. No more shell front-ends like the old PGP GUI days. GPGME provides direct hooks in to GnuPG (WinPT uses it).


      In short, the door is wide open.

      • This is what I wanted to hear... actually I feel better now.

        The problem is that _right now_ it's just kinda weak.

        GPL/OSI developers _usually_ put their win32 work on hold that is what scares/bothers me.

        I hope though that GnuPG becomes the de facto standard, because free as in speech is a Good Thing.

        • The problem is that _right now_ it's just kinda weak.
          I agree that the GnuPG GUI/Windows clients do not yet meet the level already found in later versions of PGP. But once again - I would point out that until NAI started to esentially kill PGP as a product line, there was little incentive to drive that development. Now, in a relatively short period of time, we are seeing some real progress.

          GPL/OSI developers _usually_ put their win32 work on hold that is what scares/bothers me.
          I would suggest its less a matter of puting win32 work on hold and more a matter of a lack of win32 developers. Open Source development seems to be far more common within Unix and (not suprisingly) Linux environments. I suspect its a cultural issue; the whole Open Source concept seems very foreign in a Windows world. That's not to say there aren't some really nice OS projects for Windows (or excellent work to extend OS projects to Windows).

          But there is now more of a demand for GnuPG solutions for Windows. And OS development has been showing up more and more often in Windows environments. So the future is good, I think.

          • I really hope you're right.

            I would like to maybe see a sourceforge section entirely devoted to win32 Open Source projects.

            Like I said, the problem I see with GnuPG is only that the Windows clients will be always a step behind and that won't help.

            Yes, we need more developers, but I'm not the person to talk to. I've got a better chance of getting "Hello World" out of C++ than Holyfield has getting his ear out of Tyson's mouth.

            I think you've changed my outlook on the situation, and now I DO with that Phil goes with the team. Maybe he can bring the Win32 developers with him.

            [[the situation of win32 GPL development as I can see it is that most people who will develop on the platform realize they can charge any amount for any application. When I first tried Linux years ago I realized that you don't have to pay for simple tools that should be free(like i ever did!). Have a problem in Windows, the software to fix it will cost a pretty penny. Quality over Cash...ah, the beauty of linux]]

            • I would like to maybe see a sourceforge section entirely devoted to win32 Open Source projects.
              I understand what you're getting at. But I don't think the distinction is needed. You can already find projects on Sourceforge that have a very heavy Windows focus to them (Quakeforge, for example). Windows projects can live on Sourceforge just as easy as Linux projects... or PalmOS projects... or cross-platform projects (like OpenRPG).

              [[the situation of win32 GPL development as I can see it is that most people who will develop on the platform realize they can charge any amount for any application.
              My own theory (completely unsubstantiated, you understand) is that of currency. Linux works on a gift culture - if you work with, use, or develop for Linux (and other OS-centric environments) you've already taken advantage of OS software. So developing more OS projects is simply enriching the environment and returning the favor.

              In a Windows environment, you've paid hard cash for your OS, cash for your development tools, small amounts of cash for the various little shareware apps that make life nice... and can expect to spend MORE cash in the future if you ever wish to upgrade and/or expand your current holdings. Its no suprise developers wish to replenish that pool of available cash.

              And that's the difference in currency - code vs cash; a gift culture vs a monetary system.

              That's not to say one can't mix cash and gift cultures. But it would go towards explaining the vastly different software landscapes between Windows and (for example) Linux.

  • GPGDisk? (Score:2, Informative)

    by sysrequest ( 325177 )
    The only piece I really use is the PGPdisk feature. Creating a totally encrypted virtual harddrive is very cool.

    I create 649 / 699 MB PGPdisks, fill them with my 'backups', "unmount" them, and then burn them onto CD. Voila, encrypted CD contents. Works beautifully.

    It would be the coolest thing in the world if GPG was able to mount the same PGPdisks. Heck, even using other filesystems should be possible.

    It's great for keeping data private (as long as the encryption will hold, a couple of years longer maybe).

    Once GPG can at least mount and hopefully also create "GPGdisks", I'll ditch PGP.

  • What would you expect from CA? (Score:1, Interesting)

    by Anonymous Coward
    Ask any (ex) Informix employee about how well the hostile takeover and fire everyone "software company" strategy works. Computer Associates: milking support contracts for all their worth for years now.

  • One reason for PGP over GPL (Score:3, Interesting)

    by DrXym ( 126579 ) on Tuesday July 02, 2002 @06:32PM (#3811022)
    Assuming PGP was open sourced and was covered by a sensible licence, it could easily steal a march over GPG.


    The principle issue that faces any developer wishing to integrate GPG is that it is covered by GPL. That means that even if it had an SDK (which the isn't) you couldn't link with it without infecting your own code. Even LGPL libs can't link with it. At present if you wish to use GPG, you must mess around constructing command line arguments, opening pipes etc., invoking it and then parse the results. It is a major pain. There are libraries such as GPGME that hide some of this from you but it is still slower than running in-process and has significant issues running on platforms like Windows or Mac where piping etc. might be done differently.


    If PGP were opened up with either a LGPL or BSD style licence I can see it being used in preference to GPG. GPG has the better command-line interface and might be ok for scripts but PGP has an SDK (as well as a great UI on Win32) and would be ultimately faster if software can link directly to it.

  • Phil should work on Mozilla (Score:4, Interesting)

    by PingXao ( 153057 ) on Tuesday July 02, 2002 @06:32PM (#3811023)
    PZ should get involved with Mozilla. For literally years I've been waiting for someone to build in some sort of public-key email (and newsgroup) crypto. It's still not there yet, and THAT has prevented several people I know - including myself - from adopting Mozilla as my sole internet access tool. I'd love to be able to dump some of the crap I run for email and usenet.

    First it was the export restrictions that were deterring Mozilla crypto. Now it's something else. I guess these [mozilla.org] projects qualify for some of what's being done today, but I needed Mozilla to do built-in crypto years ago. The standard Mozilla comeback is "do it yourself". Well, I have neither the time nor the skill to do that. But Phil does!

  • NSA (Score:2, Interesting)

    by zootread ( 569199 )
    Maybe the NSA will buy it and then open source it, then include it with their SE Linux.
  • I don't believe email encryption will become mainstream unless these things happen.

    1) Major email client providers agree on a standard
    2) The ability to encyrpt/decrypt is provided with the default install of their product.

    • x.509 certificates are supported as standard in shitloads of mail clients (inc. Netscape and the ever popular MS Outhouse). Many people regard those as an "industry standard"

      However, x.509 is more suited to compannies, as each public key must be signed by a trusted certificate authority to be valid. (e.g. Signed by Thwate.... otherwise use openSSL [openssl.org] and set yourself up as a certificate authority and generate your own x.509 certs). This is only really practacle for a large company.

      Individuals are better suited to PGP because of its "web of trust" model eliminates the need for certificate authoritys, but will be impractacle for a large organisation. (Its no wonder NA failed to sell PGP to companies.... the existing x.509 standard is mutch more suited)

      See this link [mcg.org.br]

  • nobody gets it. (Score:2, Interesting)

    by Anonymous Coward
    Network Associates is sitting on the code to squash it. They don't want to sell it. They don't want to make money off it. They want to keep it unavailable. Texaco owned the patent for fuel injection systems in cars. Until that patent expired (patents used to expire), no cars had fuel injection. If you don't remember, they might want to look back at the date on the press release that Network Associates (a.k.a. McAffee) released, stating that they planned to discontinue PGP. It's pretty close to September 12, 2001.
  • Zimmerman has a lot of balls asking someone to do what he wouldn't when he had the chance. It's a shame, but it's shameless the way he's going about this.

    For a good read w/r/t Crypto in general (including Zimmerman and some of his past,) check out Stephen Levy's book Crypto. It is excellent.

  • Windows users: try GPGshell with Nullify GnuPG (Score:4, Informative)

    by Jim Efaw ( 3484 ) on Tuesday July 02, 2002 @09:20PM (#3811864) Homepage

    I was using WinPT [winpt.org] for a while, until I stumbled on GPGshell. It calls GnuPG to do the work, so you never have to worry about entering your passphrase into a GUI. IMHO, it's a lot nicer than WinPT. When you install it, you get 3 programs, which don't need each other to work:

    • GPGkeys, a program to do manage all the keys.
    • GPGtray, which has a lot of the options on the system tray, and magically knows the "right" thing to do with the clipboard if you double-click it. Highlighting a PGP key in a terminal window then double-clicking on an icon makes importing keys really slick.
    • GPGtools, which lets you drag-and-drop files onto it.

    So anyway, here's what you do:

    1. Get GnuPG (1.0.7 or later) from Nullify [nullify.org]. It comes with an installer, plus contains those sinful patented algorithms (like IDEA) that PGP was fond of using in various versions.
    2. Get GPGshell [jumaros.de], install, and tell it where you put GnuPG.

    So far this setup has had no problem dealing with any PGP messages I've encountered, from 2.6.2 to 7.x, but I haven't tested it extensively.

Slashdot Top Deals

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Close