GnuPG Fundraising Rally

https://gnupg.org/donate

by teythoon • 9 years ago

218 27 9 years ago

gnupg.org

dd9jn• 9 years ago

There are also translations to German, French and Japanese:

https://gnupg.org/donate/index.ja.html https://gnupg.org/donate/index.fr.html https://gnupg.org/donate/index.de.html

RX142• 9 years ago

I hope they spend some of that money on the keyservers, they seem to be down every time I want to grab some gpg keys.

AbacusAvenger2• 9 years ago

Keyservers are hosted by volunteers as part of a distributed pool of hosts:

https://sks-keyservers.net/

And the pool's automated management infrastructure prunes misbehaving hosts pretty quickly (e.g. not responding, out of sync, etc). See "servers in the pool" and "servers currently not in the pool" here:

https://sks-keyservers.net/status/

RX142• 9 years ago

Well I'm just reporting the reality that the keyservers are down when I want to use them, almost without fail.

I suspect that gpg isn't trying multiple servers in the pool but only trying the first A record it finds. I've had to edit hosts to select a functioning key server in the pool many times.

heypete• 9 years ago

I run one of the many keyservers. I have various checks running regularly to make sure everything's fine, both on my own server, some selected other servers, and the pool in general.It's rare to have an issue, and bad servers get taken out the pool within an hour thanks to the pool's automated checks (which are completely separate from my own).

What sort of issues are you seeing? What server are you querying? Where in the world are you located?

There's a bunch of servers out there -- https://sks-keyservers.net/status/ -- but most tend to be in North America and Europe. That might be an issue, depending on where you are.

im_down_w_otp2• 9 years ago

I'll happily fund however much it will take to get them to religiously follow SemVer. Because there are soooo many breaking changes in patch releases that it's nearly impossible to keep our automation pipeline around gpg2 working consistently.

hdhzy• 9 years ago

Out of curiosity: what kind of automation? Signing artifacts?

im_down_w_otp2• 9 years ago

Creating keys, certifying keys, signing artifacts, publishing keys, etc.

avar• 9 years ago

I just set up a recurring donation for what I think is fair given my (very small) use of GPG.

I can't help but cynically wonder how much funding GPG would get just from the various journalists in this donation video making a decent salary who claim that GPG is indispensable for their work.

Another case of free software tragedy of the commons.

VMG2• 9 years ago

Should I fund improvements to Signal instead?

102030485868• 9 years ago

Both GnuPG and Signal are great projects, but GnuPG has a different use case from Signal.

You should, ideally, try to fund improvements to both projects.

cJ0th2• 9 years ago

[...] Signal are great projects

If I may derail this thread even further: I find XMPP+OMEMO even better. The security concept is basically identical to Signal but users don't have to rely on particular servers and a widespread adaption would end the problem that people who use different servers/clients can't talk to each other.

Also, there are great apps for XMPP. For desktop user there is Gajim[0], for Android there is conversations[1] and the apple folks have ChatSecure [2].

[0] https://gajim.org/ [1] https://conversations.im/ [2] https://chatsecure.org/

VMG2• 9 years ago

You should, ideally, try to fund improvements to both projects.

And a thousand more. The question is where to channel scarce resources.

lmm• 9 years ago

No. Signal identities are connected to phone numbers (which is fine for most people, but not fine for the very people who actually need end-to-end encryption) and Signal is not fully open-source like GPG is.

wiz21c• 9 years ago

I was wondering, how do they sustain such an effort ? I mean, working on GunPG is not exactly a simple task (I guess), so how do they fund themselves ? I understand the donations campaigns, but when that money dries off ? I read that the main dev had to work on other things not related to GunPG. Does it mean that we do have somebody working on GunPG with a sheer level of pragmatic altruism (i.e. working for close to nothing as long as he can feed its family) ? I'd like to know what it feels like to work on GnuPG from the inside...

rainwolf• 9 years ago

The project was on the brink of collapsing a few years back, there was a ProPublica article back then that shed some light on what you're asking.

https://www.propublica.org/article/the-worlds-email-encrypti...

hasteur• 9 years ago

I understand the need to fund things, but could someone illuminate for a end consumer of the software what requires 15k euros a month development for GnuPG? Yes new cyphers/PRNGs/hashes come online, but it doesn't seem to be moving as quickly as other internet infrastructure (GnuTLS, X.org, SSL, NTPD) products.

It seems like things that were sponsored by major organizations because they saw the good in having their name associated with a product or service in favor of getting the "internet at large" to pay for things that have become ingrained as "But it's free so why should we pay for it?"

anilshanbhag• 9 years ago

Exactly my thoughts. Also, many people have given up signing emails with pgp as most recipients use cloud based service like Gmail making it almost useless. This leaves a small niche community where both ends are outside the cloud based email network like journalist usecase maybe.

Xylakant• 9 years ago

signing emails is by far not the only use-case for gpg. The entire package signing infrastructure of all linux distributions is underpinned by gpg. Even if they spend all of the 15K each month on having a single developer audit and improve the code-base, I'd be fine with that.

waldfee2• 9 years ago

Useful spending of that money would be UX issues, making the horror that is using this stuff bearable.

Usability is atrocious and if you do not use it all the time you have to google the simplest things (for which the results are mostly outdated or wrong or bad practice so you have to be careful with which explanation you follow) which the software itself could explain to you.

cJ0th2• 9 years ago

I'd generally agree. Although I think this is rather something the people behind Enigmail should figure out. The vast majority of gpg users will never interact with it over the terminal, probably.

nickpsecurity• 9 years ago

"Useful spending of that money would be UX issues, making the horror that is using this stuff bearable."

100%. Freeze all work on crypto except for fixes for new problems that show up. All rest of money goes to hiring a UX expert for a design that anyone can pick up for common case and then implementing it.

confounded• 9 years ago

An alternative might just be to expose more of the underlying functionality via non-interactive interfaces, to encourage third-party/FOSS simplified interfaces for specific tasks.

Even trying to use a bash script to automate things is tricky because of gpg2's interactivity. I'm sure it was put there to improve usability, of course :) (which it does, in the interactive case).

simias• 9 years ago

The page gives some informations about where the money will go:

This money will firstly allow us to continue our maintenance of GnuPG. We also intend to use it to fund our work on the Gnuk security token. And, one new project that it will support is a book called "An Advanced Introduction to GnuPG." A book for developers who want to integrate GnuPG into their programs, and need to understand the various concepts, the important security tradeoffs, and common pitfalls; for digital security trainers who need to understand GnuPG to be able to make sound recommendations to users; and, of course, for enthusiasts.

I agree with waldfee that it would probably be a very good idea to invest a chunk of that money into UI improvements. GnuPG is not exactly the friendliest program out there, even for those of us who are very comfortable doing everything from the command line.

philjackson• 9 years ago

I wonder if they've reached out to news organisations like The Guardian and NYT. Also, perhaps human rights charities could make reasonable contributions once someone explains the importance of the project?

GnuPG Fundraising Rally

Related Stories