-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Nick Andriash wrote:
> Hello Steve,
>
> On Sunday, February 25 2007 at 09:11 AM PDT, you
wrote:
>
>> Not trying to be argumentative, I am just trying to
understand what
>> there is to gain by switching from GnuPG on XP.
Not a lot.
> Well, GnuPG is never going to be ported to Windows
beyond v1.4.6 if Werner
> is to be believed, so in time...v1.4.6 will become
outdated. PGP on the
> other hand already has a beta version out that works
with Windows Vista.
Please guys, the "version number envy" is getting
pretty palpable. GnuPG 2.0 is
not so much a 'new version' as it is a new architecture. It
includes some X.509
bits that (surprise) are handled natively by most Windows
MUAs (and browsers) as
well as gpg-agent for caching passphrases, and scdaemon
which allows OpenPGP
cards to be used with OpenSSH. gpg-agent is the main bit not
already in 1.4 that
would be extremely useful if back-ported. scdaemon's
functionality would be
useful to some, but would most likely be better implemented
as a windows-style
service than a *nix daemon.
There is nothing in the OpenPGP standard which is missing
from either GnuPG
1.4.x or GnuPG 2.0. GnuPG 2.0 is just built is a different
manner. Perhaps
Gnu-GnuPG would have been a better name as it's a complete
redesign.
OpenPGP is a mature, pretty stable standard. As the standard
changes, those
changes will go into GnuPG 1.4 as well as 2.0
WK has said that he's "not interested in porting GnuPG
2.0 to Windows at this
time' - that's not the same as "never." He's also
hinted that financial backing
for such a project could change his mind.
> Currently, there is nothing wrong with GnuPG...nothing
at all...in fact in
> some cases, I prefer using it instead of PGP. But, as
mentioned, it's a
> dead end street so one may as well go with a product
that has an active
> 'R&D' element to it.
As for the premise that 1.4.6 is the
"End-of-the-Line" or a "Dead-end
Street",
there should be a 1.4.7 release "REAL SOON NOW",
probably next Monday.
Active 'R&D'? There is still active work being done on
1.4 as evidenced by the
changes emailed out with each svn commit. They're not so
much in core
functionality as they are cleaner and simpler
implementations. Much of what I
see in 2.0 looks like what Fred Brooks called "The
Second-System Effect." I have
a few philosophical problems with the the 2.0 design as
well. What may make
sense from a software engineering standpoint may not
translate well to a
security approach.
The code for GnuPG 1.4 is pretty stable and has been picked
over by 1000s of
pairs of eyes. GnuPG 2.0 is new, still receiving bug
reports, and the code
hasn't been examined too deeply yet. Add the myriad mistakes
one can make
porting a *nix app to Windows 2000 and XP (Vista is a whole
'nother nightmare.),
and I ask you, "Which product would you rather trust
with your security?"
- --
John P. Clizbe Inet: John (a)
Mozilla-Enigmail.org
You can't spell fiasco without SCO. PGP/GPG KeyID:
0x608D2A10/0x18BB373A
"what's the key to success?" / "two
words: good decisions."
"what's the key to good decisions?" / "one
word: experience."
"how do i get experience?" / "two
words: bad decisions."
"Just how do the residents of Haiku, Hawai'i hold
conversations?"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7-svn-4431+-2007-02-20 (Windows PIII)
Comment: When cryptography is outlawed,
b25seSBvdXRsYXdzIHdpbGwgdXNlIG
Comment: Be part of the £33t ECHELON -- Use Strong
Encryption.
Comment: It's YOUR right - for the time being.
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iQCVAwUBReIGOr4fmBEYuzc6AQK49AP/cKWX8go2LTGdFBB4NrSojMKJNwfU
8T6M
scrpQCMDW0AFBVqQDhVvq3Jt3T+pUN3FUde+Tm85vt0TMs567LJ+r2Sg5lj1
9rxO
ue8RzI3IPXNAZP7J7Cyezza8gUByzheNl2lN/6XVkM1lEEOc/jIqAqOQwP9N
wOky
IxTnzcqUYNGIPwMFAUXiBjodBKxKYI0qEBECuPQAoP6YFRiRkSx7grLGjhHg
Z9gm
9d7SAKCyNF3C+kT9SDjDcge3VIhx8qFUtA==
=Td80
-----END PGP SIGNATURE-----
____________________________________________________________
__
Archives: htt
p://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://gr
oups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:
mailto:PGP-Basics-OT-subscribe@yahoogroups.com
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://grou
ps.yahoo.com/group/PGP-Basics/
<*> Your email settings:
Individual Email | Traditional
<*> To change settings online go to:
http://
groups.yahoo.com/group/PGP-Basics/join
(Yahoo! ID required)
<*> To change settings via email:
mailto:PGP-Basics-digest@yahoogroups.com
mailto:PGP-Basics-fullfeatured@yahoogroups.com
<*> To unsubscribe from this group, send an email to:
PGP-Basics-unsubscribe@yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.c
om/info/terms/
|
