yossarian (1.3.6.1.4.1.55738)May 21, 2023

PGP signatures on PyPI: worse than useless

https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI-worse-than-useless

#programming #devblog #cryptography #rant #python #xp

PGP signatures on PyPI: worse than useless

Show threadGregory P. Smith (he/him)  🚲🦝 May 21, 2023

@yossarian
PGP signatures: worse than useless.

There, I fixed it for you.

As tools GPG (and PGP) are simply unusable by anyone but fastidious zealot pedants. And thus always used wrong.

@glyph

Show threadKushal Das   🇸🇪May 21, 2023
@gpshead @yossarian @glyph I still have hope to fix the usability of tools/services in future. I know most of my friends totally lost all hope :)
Show threadGlyphMay 21, 2023
@kushal @gpshead @yossarian the world needs more good signing and security tools, but the sooner you abandon GPG (and OpenPGP more broadly) the sooner you can start building those ;-). There's really nothing worth salvaging here.
Show threadKushal Das   🇸🇪May 21, 2023

@glyph @gpshead @yossarian I beg to differ on that point. @[email protected] & I are building https://tumpa.rocks/

Here is an example where we can have better UX focused tools in the #OpenPGP land.

Tumpa

Tumpa is a usability-minded OpenPGP desktop application that makes key management and smartcard controls easy and usable for everyone.

Show threadMark EichinMay 21, 2023
@kushal
Is any of that something you could build atop signify instead?
@glyph
Show threadKushal Das   🇸🇪
@eichin @glyph I guess for the signing part, yes. We also have #age with hardware support (and I love that).
May 21, 2023 at 7:59pmWeb
Show threadGlyphMay 22, 2023
@kushal @eichin if you're doing stuff with age and pgp in the same process don't you have to have some kind of magnetic containment field so they don't touch and cause a matter/antimatter annihilation reaction
Show threadGlyphMay 22, 2023
@kushal @eichin I am seriously curious though: what about your problem domain makes GnuPG a desirable component? Why not throw its broken overcomplexity in the trash, define what you want your app to do in terms of user security guarantees, and then build it on top of a good backend or a novel cryptographic construction instead? I know "roll your own crypto" is bad, but it's a cut above "wrap gnupg"
Show threadKushal Das   🇸🇪May 22, 2023

@glyph @[email protected] Something that works for both encryption & signing. Bonus is that I can use the same for my ssh. Works out of my Yubikey, means no secret on disk. My mutt setup mostly works :)

I can see the pain points and hoping to improve them by creating newer things with usability in mind.

On the software side, most of the applications I install separately uses OpenPGP to sign the artifacts, including @fedora and also #debian.