Re:A New Future for GnuPG
by GoldenGateBRDG on Tuesday January 04, 2022 @02:39AM
(#29792375)
They partnered with https://en.wikipedia.org/wiki/Rohde_%26_Schwarz - so basically GnuPG is now funded by military auxiliaries…
[ Parent
| on HN ]
Rohde&Schwarz is better known for their test equipment.
Think oscilloscopes, spectrum analyzers and signal generators. They also sell massive amounts of production line testers for cellphones.
They are one of the big 3 in this field along with Anritsu and Keysight.
It's not funded by Rohde&Schwarz. Probably they partnered because both products are used by German governmental agencies and have to work together.
Re:A New Future for GnuPG
by southerntofu on Tuesday January 04, 2022 @06:16AM
(#29793616)
I am strongly anti-militaristic, but i'm glad if such horror has to exist some funds end up in FLOSS projects that directly benefit the general public (not some random FLOSS project that only makes sense for the military) instead of always the same proprietary software vendors who are quite comfy with the whole military industrial complex (like Thales).
Uh, they do sell military radios but it's far from their only product range..
Vote with your wallet.
Re:A New Future for GnuPG
by thaumasiotes on Tuesday January 04, 2022 @05:18AM
(#29793270)
If the military wants something, and you want the same thing, is that a problem?
The concern many have with military involvement in encryption and other security standards is that while they want for themselves exactly what we want for ourselves, they have an internal conflict of interests due to the fact that they want a bit of the exact opposite for other actors¹ which, if those concerns win out and they have the influence to force through or block changes, this could lead security issues² that potentially affect you or I.
[1] They don't want the enemy (whoever that happens to be at the time) to be able to keep secrets as securely as they want to keep their own secrets.
[2] An accidental backdoor or side-channel vulnerability not fixed nor mitigations made known publicly, because it is useful once discovered and they have mitigations to protect their use, for instance.
Re:A New Future for GnuPG
by southerntofu on Tuesday January 04, 2022 @06:19AM
(#29793632)
That's why it's a good thing it's a FLOSS solution. Despite a track record of bad code and security, GPG has always been good-willed, and has progressed over the years. For sure having more eyes/resources on the code can only help. Also the recent Sequoia PGP project can prove to be an inspiration for further improvements.
Agreed, I was mainly responding to what seemed to be a more open “why could it be a problem that a military organisation is involved?” question.
And as other recent issues highlight, open to many eyeballs does not necessarily imply completely robust and secure code.