Hacker News Reader

Comment by moosingin3space | Hacker News Reader

Additionally, NaCl/libsodium is actually designed as a misuse-resistant API to perform real-world tasks, unlike GPG, where the API is "call this binary and use its crappy out-of-band signaling mechanism to figure out if anything went wrong".

View on HN

This is what bugs me most about GnuPG - there's no real API, just an executable program with sometimes unreliable output. I mean, there is the GPGME library which wraps the executable calls in a C API (plus few other language bindings on the side), but it doesn't handle all the features the executable offers, often leaving you with a mix of GPGME API calls and "manual" calls to the gpg executable.

I'd welcome some full-fledged libgpg that would reliably implement gpg the executable's functionality, similar to e.g. libcurl vs. the curl executable.

Everyone would welcome it, but no-one's putting their money behind it. I suspect one of the real reasons that Signal uses a proprietary protocol (or rather, one of the real reasons that Signal was able to attract funding and improvements to GPG have not) is that having a locked-in userbase makes it easier to persuade VCs that there's a potential profit to be had. Whereas improving GPG would benefit everyone, but there's a tragedy of the commons around it.

The Signal protocol isn't proprietary, though. But yes, you make a good point. Although I'm not sure how much VC funding Signal really attracts.

Zero. It's grant-funded.

Yeah, I expressed that badly, but meant to imply that they might receive VC funding in the future.

For the record, I'm a Signal user and advocate.

What VCs are you talking about? Signal isn't VC-funded. It's grant-funded.

Reply on news.ycombinator.com