Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Businesses Encryption Security IT

Symantec To Acquire PGP and GuardianEdge 160

Posted by CmdrTaco from the well-that's-different dept.
An anonymous reader noticed the news that Symantec has bought PGP and Guardian Edge for $370 million. They plan to standardize their encryption stuff on PGP keys.
This discussion has been archived. No new comments can be posted.

Symantec To Acquire PGP and GuardianEdge More

Symantec To Acquire PGP and GuardianEdge

Comments Filter:

  • suckitude (Score:5, Insightful)

    by SoupGuru ( 723634 ) on Thursday April 29, 2010 @12:30PM (#32032344)
    Let the soul sucking begin!

    • Re: (Score:2, Insightful)

      by sopssa ( 1498795 ) *

      It means hold on to your current PGP versions.

      I wont be trusting Symantec with it.

      What are good open source alternatives?

      • Re:suckitude (Score:5, Informative)

        by Virak ( 897071 ) on Thursday April 29, 2010 @12:43PM (#32032538) Homepage

        GnuPG [wikipedia.org] is what you're looking for.

        • GnuPG is what you're looking for.

          Is GnuPG what you need when what you are looking for is a uniform GUI for the non-technical end user and enterprise deployment and management tools for your business?

          • Re:suckitude (Score:5, Informative)

            by Locklin ( 1074657 ) on Thursday April 29, 2010 @02:09PM (#32034088) Homepage

            It *is* uniform if you pick one of the available GUI's and standardize on it.

          • Re: (Score:3, Informative)

            by X0563511 ( 793323 )

            GnuPG (gpg) is the underlying tools and libraries. As locklin states parralel to me, there are plenty of GUIs out there.

            Have a look [gnupg.org] but realize that there are even more out there, these are just the hilights.

            • Any decent web-based GPG interfaces that can be 'pointed at a directory of files, and encrypt each one', like wise for decryption?

              I coded the basics of one in PHP, but wondered if anyone had a decent implemented solution already?

              • Not that I am aware of, but then I am no fan of web-based anything but web pages (so, I can't say I've looked for a solution like what you ask for).

          • I have no problem with GPG, and use it with Linux. I've also used PGP since the good old illegal days when it was all command line, and the Feds were still trying to put Phil in jail. The problem with GPG is that it's not going to really get traction until there is a one-shot binary install for Windows that integrates with common programs that people use. While we all know it isn't that tough to install the command line version and then a GUI front end, most users can't/won't do that.

      • Because you trusted it when it was in the hands of McAfee? LOL.

      • Encrypt file containers, partitions with TrueCrypt (Score:5, Informative)

        by Futurepower(R) ( 558542 ) on Thursday April 29, 2010 @01:21PM (#32033226) Homepage
        TrueCrypt [truecrypt.org] is reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux.

        The TrueCrypt documentation is very good, but not perfect.

        TrueCrypt can encrypt a file that contains other files (a drive letter) or encrypt an entire partition, even the boot partition.

        No one I know has any connection with TrueCrypt. We are just happy users.

        • Re:Encrypt file containers, partitions with TrueCr (Score:4, Informative)

          by X0563511 ( 793323 ) on Thursday April 29, 2010 @04:33PM (#32036408) Homepage Journal

          Truecrypt is not the same thing as PGP/GPG. Truecrypt is great, mind you, but it is not public key cryptography and signing, with web-of-trust. It's just data encryption and hiding.

          • GPG [gnupg.org] is also reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux.

            What we need is a list of things PGP can do that the free, open source GPG can't do. Is there anything? If GPG can do everything PGP can do, then there is no reason to pay a lot of money for a closed-source alternative.

            For example, here is the GPG manual: web-of-trust. [gnupg.org]

            It would be difficult to trust closed-source encryption software, especially from a company that so many people who have commented her

    • Re:suckitude (Score:5, Informative)

      by Em Emalb ( 452530 ) <ememalb AT gmail DOT com> on Thursday April 29, 2010 @12:47PM (#32032614) Homepage Journal

      Not off-topic at all.

      Symantec will more than likely manage to screw this up just like they screw everything else up. Seriously, once upon a time their virus stuff was good. Now, you've gotta jump through hoops to remove it, their enterprise-level customer service is garbage, so I can only imagine how bad their home user support must be, and at some point their code base for the AV stuff grew so bloated you could run a Toyota (poorly) off it.

      What's wrong with pointing out that they're simply gonna screw it up?

      • Comment removed based on user account deletion

    • Re: (Score:2)

      by Sorthum ( 123064 )

      Nice to see that Symantec is continuing its tradition of buying terrific products solely to bloat them, screw them up, and effectively turn them into shit.

      BackupExec, Norton Utilities, Brightmail... it's like they've got some kind of bizarre scatological alchemy going on.

      I do hope that the whole disk encryption solution that PGP was offering for Mac and Linux will continue to be supported; IIRC Symantec tends not to focus overly much on non-Windows solutions.

  • Not bad (Score:5, Funny)

    by Mikkeles ( 698461 ) on Thursday April 29, 2010 @12:30PM (#32032350)

    It's Pretty Good Proprietory!

    • Re: (Score:3, Insightful)

      by Seakip18 ( 1106315 )

      But, according to my bosses, that proprietary stuff is better! It has support contracts and since we buy the license, that must mean it's good.

      It's not like Opensource stuff comes close, right?

      Well, that is true for Outlook email client interfacing, which is a crapshoot anyways. The rest OpenSource handles quite well.

      • Re: (Score:2, Offtopic)

        by Lunix Nutcase ( 1092239 )

        The rest OpenSource handles quite well.

        Which is why professional graphic design have all dumped Photoshop for Duh GIMP? And all those people who work in professional video arena have dumped all their proprietary tools for KDenlive?

        • Here's where we get into the point of "professional tool" vs. "something I install on my home PC". For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them. When you pay $300 for a computer, even $50 on a windows license, or $50 for

          • Here's where we get into the point of "professional tool" vs. "something I install on my home PC".

            The GP was talking about software for his job. So no, your point has nothing to do with the topic.

            For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them.

            That's why home users buy Photoshop Elements [amazon.com] and they will download Visual Studio Express.

        • Re: (Score:3, Informative)

          by Seakip18 ( 1106315 )

          I was specifically talking about PGP vs. GPG.

        • Which is why professional graphic design have all dumped Photoshop for Duh GIMP? And all those people who work in professional video arena have dumped all their proprietary tools for KDenlive?

          GIMP started as a toy project. It's much better now, but would certainly profit from a major redesign (and I'm *not* talking about UI here). As far as video editing is concerned, what about Lightworks? :)

      • Where's the "sad but true" moderator category when you need it?

      • You shouldn't be using PGP for email encryption anyways. S/MIME is built into almost all modern email clients. The real reason that email encryption has not caught on is that it is basically impossible to implement it in webmail clients. (although signing is still possible).

        • True, as I was looking at S/MIME with openSSL. That implementation would be quite clean, with the right certificates.

          Turns out they wanted more than S/MIME and GPG/PGP was the next tool on the list to look at.

          Also true about the webmail client. I have a firefox addon that'll do both sign and encryption for gmail, but never really have a use for it.

        • You shouldn't be using PGP for email encryption anyways. S/MIME is built into almost all modern email clients.

          Does S/MIME work with a web of trust like that of PGP and other implementations of OpenPGP, or does it rely exclusively on central commercial certificate authorities?

        • Re:Not bad (Score:4, Insightful)

          by mlts ( 1038732 ) * on Thursday April 29, 2010 @02:47PM (#32034776)

          If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust. I will either get a copy of the public key of someone face to face printed physically with a fingerprint (and will download and verify the public key and has from a keyserver), or I will agree on a passphrase that is used only once, and that is to send and receive a copy of the public key.

          I also don't like keeping my public key that would be needed for S/MIME on an online machine. My secure private key resides on a machine that isn't Internet connected, it will reside on a smart card, or it will be on a smart card and used on an offline machine, so an attack would have to be done on a physical/local level in order to compromise my private key material. I do use S/MIME and a client key, but that is mainly a stopgap, better than nothing measure, compared to actual end to end manual encryption of data with gpg or PGP.

          PGP WOTs were in use a lot in the early to mid 1990s by cypherpunks, but for the most part, convenience won over security and it is extremely rare for someone to use a public key of someone to send mail. A good WOT is far better than a CA. I have more trust in a public key claimed to be someone that is 3-4 links out from me on my PGP/gpg keyring than I do a key that is signed by a CA and told "hey, trust us." Of course, creating a WOT is a lot harder than just letting a CA do the work, but like Phil Zimmermann said, it is better to pack your own parachute when security is critical.

          Another use for PGP over S/MIME is signing of files. A signed E-mail is difficult to forward and keep the integrity intact. However, if I have a file and a PGP/gpg signature of it (or just a PGP signed file), I can forward it, archive the two files, back them up to whatever backup media, and all it takes is a validation in the future to ensure that the file and the signature were not tampered with, assuming I have the public key in my keyring, and that hasn't been tampered with. Of course, I can use facilities like the file signing capabilities built into Acrobat, Word, or other software, but again, I have to use a third party CA, or pay for a special signing key, as opposed to a secure WOT. Plus, some files (archives and such) can't be signed internally, so having a separate .sig file is needed.

          S/MIME is decent, built into most dedicated E-mail clients, and is better than nothing. However, if you want reliable E-mail security, you are best off using a PGP/gpg WOT.

          • I just want a nice lock icon in clients inboxes. It makes them feel all warm and fuzzy. :P

          • Re: (Score:3, Insightful)

            by ToasterMonkey ( 467067 )

            Arg... this is so painful to read. What is with the mods? +1 Long post?

            If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust.

            I'm not a big defender of the big CAs, but trust chains serve a purpose. In a WOT, who first decides that someone really is associated with a given name, and why on Earth do you trust _them_? Sure, you will all be talking to the same person, but who is that? The point of the chain model is that at least someone is responsible for verifying a certificate holder's identity in some minimal way. To what length they go depends on wh

      • Re: (Score:3, Interesting)

        by JWSmythe ( 446288 )

        You know, I've seen a lot of that in the corporate world. That's why folks have gone with RHEL rather than Fedora. They get to pay for something, so they feel better about it.

        Of course, Microsoft servers are that much better, in that they can pay more for them. :)

        Way back in the day, one boss was interested in going to Linux, but he couldn't find anything that satisfied his needs to pay for it. That was primarily a BSDi shop, but it switched over to Windows be

        • Re: (Score:2)

          by Sorthum ( 123064 )

          Actually, CentOS is the free version of RHEL; Fedora has an 18 month lifecycle.

          You'd have to be some kind of masochist to deploy that as a server to an environment of more than a few servers.

          • Or an idiot.

            I've got to pull/clean lots of Fedora-Core 7 (or older) dedicated servers because of inept customers.

          •     Off the record, once they deployed, they stayed like that forever. No patches, no upgrades, nothing. The party line was "It works this way, and has worked this way, we'll keep doing it this way." That was regardless of the fact that machines got exploited. If it didn't come in on the install CD, they didn't want it. Some days I'd just sit down and cry.

          • Ahem, just to clarify what you mean by lifecycle.

            Fedora has a 6 month release cycle, CentOS has an 18 month release cylce. This is how often they come up with a new version.

            Fedora provides updates for the last 3 versions so 18 month supported updates.

            CentOS provides updates for 5-7 years same as RHEL.

      • There are a few OpenSource email clients that do a decent job. Evolution works as well as Outlook, and Thunderbird + Lightning trumps Live/Windows Mail. Where OpenSource falters, is they don't have a solution that works better, or equal to Exchange and costs less. There are open-source Exchange-like servers, but are generally hindered in some way for the open-source version, or require a closed-source plugin to be really effective with Outlook, and/or other exchange clients. Usually this licensing winds

        • > Evolution works as well as Outlook

          Not on clustered Exchange it doesn't! Tried it with the mapi plugin...no good.

          But as far as GPG is concerned, it's well done. Integrated nicely as it should be.

  • This is a smart move on their part, but I just have a really bad feeling about this.

    I have zero trust when it comes to Symantec.

  • Having my data encryption in Symantec's hands makes me feel extremely safe..... NOT!!!

    • Re:Scary (Score:5, Insightful)

      by dgatwood ( 11270 ) on Thursday April 29, 2010 @12:56PM (#32032752) Homepage Journal

      Just another enterprise company that Symantec will acquire, make a half-hearted attempt to integrate it into their company, then systematically lay off all the workers, outsource product development to India, release a nearly completely nonfunctional successor to it, and eventually cancel it outright after the support contract revenue dries up. I've seen this worthless company pull this stunt too many times to expect anything different.

      Note to CEOs: getting acquired by Symantec is corporate suicide. If you care at all about your employees or your product, the correct answer is not "no", but rather "hell f**king no". Just saying.

  • oh great, just what everyone was waiting for.

    • You can just bet there will be backdoors for the NSA/CIA/FBI/etc in no time.

      • >> You can just bet there are already backdoors for the NSA/CIA/FBI/etc.

        Fixed that for you.

        • There was a time when despite not being Open Source licensed, the source was available. I don't know if it's still the case.

          • Re:Pretty *Bogus* Privacy (Score:4, Insightful)

            by calmofthestorm ( 1344385 ) on Thursday April 29, 2010 @02:07PM (#32034058)

            Regardless, I would assume the NSA has its fingers everywhere. Backdoors are not trivial to catch in the source code, like the famous if (uid = 0) test on an obscure flag combination on an obscure call.

            Don't get me wrong, I'll trust OSS a lot more if the code can be read by anyone,but what good is the potential if no one actually does it?

            The beauty is the I don't do anything the NSA cares about, I just like my privacy. Anyone powerful enough to get my personal data has bigger fish to fry.

            • but what if the agent just needs a few XP to "level up"??

            • I don't do anything the NSA cares about right now,

              Fixed that for you.

              It used to be the Japanese, then the commies, now the Muslims. Who's to say in 20 years it wont be some group you happen to be a part of.

            • Re: (Score:2)

              by Trogre ( 513942 )

              Until you come to realise that, with all that expensive computing power and data mining algorithms, they can happily fry you, your neighbours and the big fish in the same pan.

              • I was trying to differentiate ability to get info on /anyone/ vs ability to get info on /everyone/ but I guess I didn't make it clear. As long as you have nothing to hide AND htey can't watch us all, life is good.

      • Re: (Score:2)

        by TheLink ( 130905 )
        Some years ago PGP was bought by Network Associates Inc (which was a merger of McAfee + Network General).

        McAfee, Symantec? Meh...

  • Open Source Alternative (Score:4, Informative)

    by Anonymous Coward on Thursday April 29, 2010 @12:36PM (#32032452)

    GPG is out there { http://www.gnupg.org/ } and we should use it.

    Privacy is a human right. Democracy can't work if it's citizens are controlled like slaves in the roman empire.

    Freedom is ours to take! Long live the RPG!

  • I don't trust Symantec (Score:2, Insightful)

    by Anonymous Coward

    This really sucks. In dial-up days, I used a cool, lightweight firewall application published by WRQ [wikipedia.org] called AtGuard [cryogenius.com]. Symantec licensed the product and incorporated it into their own software; the stand-alone product known as AtGuard then disappeared from the market. I used to use Partition Magic [wikipedia.org]. Again, Symantec bought it and it exists no more.

    With that little bit of sample history, I'm sure we can bid PGP farewell.

  • I work for a giant TLA. [irs.gov] Our AV is Symantec. Our removable media and whole-disk encryption products are in mid-migration to all-GERS (from a combination of GERS and WinMagic).

    We're headed straight to hell, aren't we?

    • Re:Oh. My. God. (Score:5, Funny)

      by Amouth ( 879122 ) on Thursday April 29, 2010 @01:33PM (#32033440)

      I work for a giant TLA. [irs.gov] ... We're headed straight to hell, aren't we?

      humm I believe you have already arrived

      • It's a pretty nice place to work if you're in IT. Other parts of the organization vary widely. Generally speaking, if you're willing to work hard at helping people, you can find a place to do it here.

        This may be blasphemous, but I actually *like* my job.

        • Re: (Score:2)

          by Amouth ( 879122 )

          It's not blasphemous.. your fortunate that you like where you work and what you do.

          personally i like where i work but not exactly what i do.. but i'll take the good with the bad to not have to live in an over crowded city and have more than a 15-20min commute

  • What is this, aquire and merger week? (Score:4, Funny)

    by frambris ( 525874 ) on Thursday April 29, 2010 @01:18PM (#32033174) Homepage
    Everybody seems to buy eachother this week. By the end of the year the Internet is run by three companies: MicroApple (software), HP (hardware) and Ciscoogle (Internet)

  • Acronym change (Score:4, Funny)

    by Limburgher ( 523006 ) on Thursday April 29, 2010 @01:29PM (#32033366) Homepage Journal
    Now, it's Pretty Good Privacy. Soon, it will be Poof Gone Permanently.

  • This is fantastic! (Score:5, Funny)

    by JonJ ( 907502 ) <jon.jahren@gmail.com> on Thursday April 29, 2010 @02:33PM (#32034472)
    I've always wanted encryption-software from people who can't write a fucking uninstaller properly.

  • I've kept a copy of the installer for the freeware version of PGP before they started getting uppity about it.
    Works on XP just great. Version 8.0.2.... dunno if this version is still found in the wild....

  • PGP got taken over by McAfee / Network Associates years ago. Look here: http://www.openpgp.org/members/nai.shtml [openpgp.org]

    They took it over and killed it.

    Well, it was already dead. Although we loved PGP at the time because it was encryption when no one was allowed to have it, the product itself was very badly designed. The user interface was hostile (Trust? Invalid? Implicit? WTF?), and although they provided E-mail plugs for Eudora and Outlook they never supplied one for Mozilla/Thunderbird. You had to copy paste th

Slashdot Top Deals

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Close