Hacker News Reader

Comment by deknos | Hacker News Reader

i would bet that if debian had some sane requirements, sequoia could fulfill them.

sequoia is a rewrite which avoids the legacy cruft of the old OpenPGP. and they already have a library, a cli tool and tests

View on HN

That's an absurd statement. OpenPGP _is_ the legacy cruft. It's made for _emails_. It makes no sense elsewhere. The encoding for clearsigned signatures is overly complex.

And Rust is inappropriate in any case for now, it's not allowed in Ubuntu main.

> That's an absurd statement. OpenPGP _is_ the legacy cruft. It's made for _emails_. It makes no sense elsewhere. The encoding for clearsigned signatures is overly complex.

No. It's a message encryption, and namespaces are emails, but then, most logins nowadays are identifiers via some email. this is not true. and encodings are fixable and doable in a good library, so there's no misuse.

> And Rust is inappropriate in any case for now, it's not allowed in Ubuntu main.

that's new to me, but possible, why? any link?

Rust is a security nightmare. We'd need to add over 130 packages to main for sequioa, and then we'd need to rebuild them all each time one of them needs a security update.

It's a problem of Ubuntu then, not Debian.

Not gonna have two different signing implementation. Same security concerns apply to Debian too, of course.

Having 130+ packages to rebuild for a critical security update is no fun.

Reply on news.ycombinator.com