Gnu Privacy Guard relies on one underfunded person (2015) | Hacker News Reader

Gnu Privacy Guard relies on one underfunded person (2015)

propublica.org

199 pointsbuttly70 comments

It seems like so much of the internet is reliant upon technology created by, and supported by, people who get little to no reward or recognition for their important contributions.

An idea (not a serious one, but a point for discussion): in civil society we have a government that collects taxes that are used to fund the vital infrastructure that allows the society to function. How about if all ISPs were to charge a very small levy to customers? This levy would go to an independent and neutral body to be used to pay for the salaries of those who are creating the internet infrastructure we all rely upon.

Obviously there would be many problems with trying to implement such a system across the entire world. Worth discussion though?

P.S. I have no doubt that this idea has probably already been thought of and discussed before. There is nothing new under the sun :-)

[edit: fixed fat finger typo.]

> How about if all ISPs were to charge a very small levy to customers?

At least in the US, we know we can't trust the ISPs to "do the right thing". Maybe things are different elsewhere but I cannot support this idea in the US. Sorry.

it seems too much to both not support a thing directly and also decry potential support as unfit.

The ISPs would not support it. They would take the levy and find some clever loophole to steal it or to use it to reinforce their own walled gardens.

You're talking about possibly the scummiest, least moral companies in the global tech industry.

LARGE ISPs. The small ones are fighting tooth and nail to survive and bring the local people better internet. It has to be folly to be in it for the money at many local scales unfortunately. Thats why I get one choice of 2mb internet here. There are local guys working out of a pickup truck laying copper and fiber to local business. #notallisps

Sounds like the cassette and compact disk taxes that were implemented in some countries. Did they ever support the performers who really needed the money?

Not exactly the same. A more accurate analogy would be if the CD was invented by some volunteers instead of Sony, and everyone used them but the volunteers never got paid for their contribution

Why not let projects ask for government funding? Perhaps a specialized agency could help with this.

I'd start with NSF or NIST.

If someone figures this out, please blog about it.

Politically at least, because in the US you'd hear screams of "Socialism" and all of the usual nonsense any time you try to marginally improve anyone's lives below the top 1%.

I was thinking exactly this. Any calls for help to any person would just be called socialism and get shot down immediately.

> How about if all ISPs were to charge a very small levy to customers?

How about levying such a tax on ISPs themselves? They're the ones making a profit off of the infrastructure you're talking about.

They mean the same thing (if implemented properly). The taxes will be split by the ISPs and the consumers.

It's worth noting that while GPG's financial situation is better now, GPG is still looking for funds. Here[1] is a post from June about their current donation campaign.

[1] https://gnupg.org/blog/20170606-campaign-launch.html

It would be super if they were helped to achieve their EUR15K/month target, but after nearly three months, they're only a third of the way there (a situation that is made a little better by having a couple months worth of one-time donations).

https://gnupg.org/donate/

The fact that someone of his ability can take an intern's wages to do this, and for that long, shows the incredible altruism in tech.

That shows his own personal altruism. I'm afraid that in tech, like in any other domain, altruism in gifted people is something rare (just because altruism is rare plus being gifted is rare).

Now, everybody is doing his share, most of us are a bit altruist and a bit gifted in a way or in another. It's a question of scale.

I'd argue that P(altruism | largely gifted) > P(altruism), but that being said, I completely agree with your statement. It's still a minimal amount of people in general (and with some good economic reasons, too).

The broad altruism in tech that has allowed this situation, and which still underfunds the projects' modest needs? Yes, astonishing generosity.

It's almost like the "I got mine, buzz off" attitude is prevalent in not just the cartoon caricatures of <insert opposing political team here> but is prevalent in society as a whole.

Even further, it's almost like that attitude is the Nash equilibrium of human life. (And if it is, then we cannot expect rational people to deviate from it without significant imposition of force upon them.)

I meant of Koch in this case — the fact that he's getting a raw deal surely even more so emphasises his generosity, rather than undermining it.

From the article, we get "while the U.S. spends more than $50 billion per year on spying and intelligence, pennies go to Internet security".

It is wild to me that US intelligence is sincerely scared of their sources "going dark". I've never gotten over just how asymmetric the conflict is, and how much first-class privacy software gets written for little or no money.

GPG is used by some for email sure, but it isn't the only option. S/MIME has native support in pretty much all native mail clients, and is more pragmatic about how you trust an identity.

I bet that all the non-email uses of gpg are actually greater than the email uses. Its used as a component of many Linux distribution package managers, for example.

Agreed, and I don't mean to diminish the importance of gpg. But claiming all the worlds "encrypted email" depends on it is a bit of a stretch is all.

Note that libgcrypt is also part of GnuPG, which finds its use in many projects as well.

Then maybe the distros should find a way to fund things they rely on?

Some companies rely on distros. Do these companies make sure to fund the distributions?

I always tell people to just put the content in files that they then encrypt with GPG. Then, send them over some transport (eg email, IM, postal service). Makes usage really simple where you only need to know a few commands. Those can be turned into a shell script or GUI client if someone wanted to put work into it.

Is there much deployment of S/MIME in the corporate world? Identity generation is much easier in GPG in my experience.

We have a national PKI for doctors that could have been, but isn't, used for S/MIME. Missed opportunity.

In some ways it's easier for corporate, as the ca's have more incentive to make it useable.

I asked a ca about s/mime pricing - on its own they have a 50x3yr minimum purchase. They offered to waive the minimums if I combined with a regular server cert purchase.

A while back you could get a globally trusted free cert from Comodo. I'm not certain they're still doing it but you could see if the free route will work. (The keying material is generated inside the browser and never leaves your machine)

You still can but they're a bit of a pain to use, and honestly anything that's not Comodo would be nice.

After their shitbird response to LetsEncrypt, I'd rather pay someone else than use their "free" option.

Edit: for those who didn't follow it at the time, this sums it up: https://arstechnica.com/tech-policy/2016/06/800-pound-comodo...

Wow, I missed that story the first time around. Just catching up on the details. That Comodo CEO Melih Abdulhayoğlu is such a dishonest, incompetent buffoon! I had no idea how terrible a company Comodo is, but now I do thanks to the CEO's own words and actions.

https://www.youtube.com/watch?v=Z7Wl2FW2TcA&feature=youtu.be...

Thanks for posting that video, I hadn't seen that before.

JFC I knew it was bad but... just.. f..k.

I feel like a fool for not being hip to this.

Guess what? GnuPG also supports S/MIME.

But it isn't required for S/mime.

I'm not aware of any other pgp implementations besides the original.

Isn't the obvious answer here that he creates a company that offers "professional level" support contracts, ala Red Hat, Sendmail, ...

or a bigger picture company, like "The Internet Security Company" that funds him, openssh, ...

What if he doesn't want to run a company? He isn't a consultant, he's a programmer. Being good at programming doesn't make automatically good at running a company, which requires a totally different skillset

This general problem is discussed in depth by Nadia Eghbal (now, with community outreach Github):

https://www.fordfoundation.org/library/reports-and-studies/r...

Are there any other projects of such nature?

Not quite the same, but the time zone database was voluntarily maintained by some random guy for decades, until he got a lawsuit in 2011 and ICANN eventually took over.

https://news.ycombinator.com/item?id=3081281

https://en.wikipedia.org/wiki/Tz_database#2011_lawsuit

ncurses and the terminfo database (which ship with pretty much every Unix-like) are maintained by one person, Thomas E. Dickey.

This is sad, we need to fund projects like this.

2+ year old article.......

But there is potential for seeing what has happened since, and for followup. It is useful.

Misleading title. After the publication of this article that 1 Guy got a buncha money.

Well, it's misleading now. It wasn't misleading when it was published.

Yes, and normal communication is such that we preface what we're saying if it's set in another time. We don't when we're talking about the present time.

Not overly so. After having an article written about him, one guy got the better part of one year's salary in charity. In exchange for 18 years of work maintaining a piece of software that kinda everybody uses.

Another reminder that selling goods and services in exchange for money still works better than giving things away and hoping somebody gives you a donation.

> After having an article written about him, one guy got the better part of one year's salary in charity. In exchange for 18 years of work maintaining a piece of software that kinda everybody uses.

$60,000 from Linux Foundation's Core Infrastructure Initiative (one-time)

$137,000 in donations (one-time)

$50,000 a year from Facebook (recurring)

$50,000 a year from Stripe (recurring)

I think he got more than one year's salary in one-time funding alone, plus he's got a "salary" of $100,000/yr from Facebook and Stripe together.

The most idealistic funding model that I can think of for this kind of work would be colleges (banned from 'tech transfer' and other money grabs) actually being used to advance academic research and 'core intellectual infrastructure'. Basic, public funded, 'research' and common components support.

Unfortunately, in the US at least and probably elsewhere, the shift has been away from this, since it creates 'competition' with corporations, who also are major funders of both universities and the politicians which create legislation and funding applying to them...

Yeah but he has 6 developers working on it now (including himself).

I had no clue! That's useful information.

Why does the project need 6 developers?

https://www.gnupg.org/donate/index.html

Great to hear that he gets about $100k in "salary". (I guess taxes work differently when you get donations like that.)

At least he won't be starving now. But it would not be a bad thing if someone threw some more money at it, or someone assembled a small team to help out, or something.

Edit: saw in comment below there is a team on it. Good stuff.

Kudos to Facebook and Stripe for stepping up. Either these individuals are funded or some company comes along and acquires them and they lose their independence.

We need to urgently find a sustainable way for individuals to support open source developers or accountability and relationship with end users will continue to diminish.

There must also be ways to gently encourage successful startups to contribute as now it seems they use a whole bunch of open source software and simply forget about it once successful, which is not a sutainable model.

> selling goods and services in exchange for money still works better than giving things away and hoping somebody gives you a donation

The problem is, had he tried to sell GPG, I doubt many people would be using it now...

Well to be honest few people ARE using it now. PK crypto has failed since its inception. It's never been widely adopted. PK has been too hard to implement and manage.

In contrast to say openssh which everyone uses.

What do you mean by "PK crypto"? (OpenSSH makes extensive use of "public-key cryptography", as does, say, HTTPS, and both seem to be massive successes, so I think I am understanding you incorrectly.)

That money pays for far more than Werner's salary:

https://www.gnupg.org/donate/index.html

Reply on news.ycombinator.com