GnuPG 2.1.2 released

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html

by Sami_Lehtinen • 11 years ago

188 28 11 years ago

lists.gnupg.org

acqq2• 11 years ago

What is different from the previous 2.1 is not clear.

The most interesting part is:

"Since the start of the funding campaign in December several thousand people have been kind enough to donate a total of 250000 Euro to support this project. In addition the Linux Foundation gave a grant of $ 60000 for 2015, Stripe.com and Facebook.com each pledged $ 50000 per year.

I am amazed by this superb and unexpected support for the GnuPG project. This will not only allow us to continue the project and hire at least a second full time developer but gives us also the resources to improve things which have been delayed for too long."

I think everybody agrees that the most of the success of the campaign is due to this single article:

http://www.propublica.org/article/the-worlds-email-encryptio...

invernomut0• 11 years ago

Yep, let's hope the project gets in a better shape thanks to all these funds.

teamhappy2• 11 years ago

I've uploaded the relevant part of the changelog for you.

http://pastebin.com/raw.php?i=6meWbFYv

HSO• 11 years ago

And to my delight, the article was written by Julia Angwin whose book

[1] J. Angwin. Dragnet Nation: A Quest for Privacy, Security, and Freedom in a World of Relentless Surveillance. Times Books, 2014.

I recently finished and recommend. It's one of those few "books" written these days (quotation marks because they`re really more like stretched-out magazine articles) that actually make sense, come from the right place in terms of sentiment and tone, and most important are logical or coherent. I was curious about the author because I was so surprised and saw in her bio that she studied mathematics in college. Go figure ;-)

icebraining• 11 years ago

Yeah, without taking any credit away from the donors (or from the GPG authors, of course), we should be grateful to her and ProPublica for bringing this to light.

It kinda bothers me that, while I can make a donation to ProPublica, there's no way to express why I'm doing so. On the other hand, maybe there's a danger in becoming too donation-focused.

EDIT: After donating, they say: "Please consider sending a note to thoughts@propublica.org or tweeting @ProPublica sharing your reason for donating. We’ll use some of these messages to encourage others to donate."

Which I think is fair enough.

nothrabannosir• 11 years ago

Not to take away from the article, but this is like saying Yo-Yo Ma is so good at playing the Cello because he's talented.

He is talented, but that's not why he's good. He's good because of years of hard work, blood, sweat, and tears.

Most of the success of this campaign is due to Werner Koch's years of hard work. The article was the catalyst.

EDIT: I'm as grateful as the next guy for all the generous donors, to Propublica for publishing the article and to Julia Angwin for writing it. Let's just not forget who the real hero of this story is.

acqq2• 11 years ago

Claiming "most" is "due to" "years of hard work" sounds good but is far from enough to explain what actually happened.

See the state before the article was published:

https://gnupg.org/donate/kudos.html

   Donations for the previous years:
   Year 	# 	€ 	net €
   2011 	21 	553 	465
   2012 	53 	5991 	4963
   2013 	148 	5041 	4145
   2014 	801 	34700

Do you think Koch worked much less hard in 2011 or 2012? It's that Snowden's revelations raised awareness both among the potential supporters and by Koch himself (he claimed in the article he'd have quitted due to the "lack of support" hadn't had Snowden "happened") motivating him to continue working.

Then before the ProPublica article, the only known contributions were cca 30000 EUR (apparently the Linux Foundation grant was agreed but still not public). But just in exactly 24 hours since the ProPublica article was published, the contributions were 180000 EUR plus commitment from Facebook and Stripe for 50000 USD yearly each, plus the publishing of the Linux Foundation grant. People who did contribute on that day could see how the "goal bar" moved from "mostly empty" to "full" and above in a few hours.

akg_67• 11 years ago

This case is a good example of plight of donation supported products and users unwillingness to support Volunteerily. If it wasn't the threat of project shutting down and the article about it, I doubt project would have recived the funding it did.

It also goes to show that Users are very bad at judging the value of a product and paying accordingly. They need to be provided an anchor price.

I believe this project will be a good case study for business of free and donation supported products.

zx2c44• 11 years ago

If anyone here is a `pass` [1] user, and you're using 2.1.1, or 2.1.0, I encourage you to upgrade. These two older versions of GnuPG had some nasty bugs, fixes for which the pass community sent upstream where they were accepted.

The result is that pass 1.6.5 and GnuPG 2.1.2 work nicely together.

[1] http://www.passwordstore.org/

tokenizerrr2• 11 years ago

Could you elaborate? I'd be interested in what kind of nasty bugs.

zx2c44• 11 years ago

https://lists.gnupg.org/pipermail/gnupg-devel/2015-January/0...

Fastidious2• 11 years ago

Interested on those nasty bugs too, as I am on pass mailing list and have not read anything about them. This sounds more like a plug to pass, from a throwaway account.

zx2c44• 11 years ago

Um, no. This isn't a throwaway account. This is my account - the username I use for everything. Type it into google. It's been my handle since I was super young. Whois the .com of it - I registered it in 2000.

IN FACT the mailing list archives of the pass mailing list happen to be at that domain. Here's the relevant post: http://lists.zx2c4.com/pipermail/password-store/2015-January... This is from a CC that went to the GnuPG mailing list.

tokenizerrr2• 11 years ago

zx2c4 has 1440 karma and their account is nearly 4 years old...

DanBC• 11 years ago

throwaway account.

ahem

    user:	Fastidious
    created:	192 days ago
    karma:	98
    avg:	1.82


    user:	zx2c4
    created:	1362 days ago
    karma:	1441
    avg:	5.48

gtirloni• 11 years ago

Is there any work being done to formally prove GnuPG' algorithms correctness? Just curious since there are other topic around Coq in the front page and I couldn't find much by searching.

Ixiaus• 11 years ago

They should use cryptol instead which was recently open sourced.

gsnedders• 11 years ago

Algorithmic correctness is probably less interesting than the presence of side-channels nowadays, and that's far, far, far harder to model.

xnull2guest• 11 years ago

I do know of one researcher working on this: Julian Bangert at MIT out of Dartmouth has modeled x86 family processors in SMT, and is able to prove that all paths through a particular piece of code compile so that all cache hits are identical, CPU ticks are identical, etc. Brilliant young man - I expect we'll be seeing a lot more from him.

kerkeslager• 11 years ago

A quick PSA for those using Mac OSX with homebrew or a Linux variant with apt-get:

There are two versions of gpg on homebrew. If you're like me, you installed gpg with:

    brew install gpg

    sudo apt-get install gpg

However this gives you:

    $ gpg --version
    gpg (GnuPG) 1.4.18
    ...

What you probably want is:

    brew install gpg2

    sudo apt-get install gnupg2

This gives you:

    $ gpg2 --version
    gpg (GnuPG) 2.0.26
    libgcrypt 1.6.2
    ...

This is probably what you want, as it's the stable version.

There's no harm in using gpg 1.4.x; the docs indicate that this is maintained because of its use on older and embedded systems, and AFAIK there's no reason to suspect gpg 1.4.x's security if you trust 2.0.x. It's just that the 1.4.x version has fewer features.

I haven't tried other package managers, but I suspect they also have this minor pitfall.

teamhappy2• 11 years ago

In case you still want 2.1 on OS X:

    brew tap homebrew/versions
    brew install gnupg21

isomorphic• 11 years ago

It's worth noting that Homebrew has "gpg" and "gpg2" as aliases for the "gnupg" and "gnupg2" formulae, respectively. This might be confusing to some people wondering why there are two versions of the same thing.

bostik• 11 years ago

I've been wondering if there was anything like "proper" forwarding in gnupg-agent, and thus at least signature support over SSH connections for remote mail clients.

My use-case: I have a shell server which receives my emails. I use a local client (mutt) to read my mails, but I do not want to save my private key on the server, because it is not 100% under my control. The idea is that my physically local box would hold my private keys, and the agent would simply forward the to-be-signed data from the remote host to my local system, and transmit the signed data back.

When I send encrypted emails, at least those I can easily do on my physical box and send the file over first. It's a bit of an inconvenience, but I can live with that. Being able to sign my mails on that remote shell box without actually putting my keys there is the one thing I'm looking for.

I found some kind of hack for this a year or so back, but now I can't even remember what google-fu I had to employ.

jmgrosen• 11 years ago

Does anyone know when Curve25519 (encryption, not signing, I know Ed25519 is already there) will be implemented? I'm waiting until that happens to generate my new long-term keypair.

hackuser• 11 years ago

It's very generous of them to do this work and give it away, but consider paying for what you are getting.

GnuPG 2.1.2 released

Related Stories