News for hackers. Stuff that matters.

A comment on SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTools and python-gnupg. Parent comment

Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by codeflo on Friday June 15, 2018 @06:35AM (#17318745)
The GPL license might be part of why this is done; running GPG in a separate process avoids infecting your code with its license.
[ Parent | on HN ]
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by mkesper on Friday June 15, 2018 @06:59AM (#17318859)
This may or may not be true. Please ask your lawyer.
[ Parent | on HN ]
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by codeflo on Friday June 15, 2018 @05:14PM (#17323618)
IANAL and I'm not saying this works from a legal standpoint (my understanding is it depends), I'm just arguing this is one reason why people might do this (run an executable and parse the output instead of just linking a library and passing proper data structures). I've seen it happen in another context.
[ Parent | on HN ]