Hacker News Reader

Comment by rectang | Hacker News Reader

> Fortunately, and this is still not common with free software, we have now established a way of financing the development while keeping all our software free and freely available for everyone.

> Our model is similar to the way RedHat manages RHEL and Fedora:

I looked around the website for a bit and didn't find a blog post or anything indicating what they've replaced the donation revenue stream with. Have they been employed? Are they doing consulting?

View on HN

"GnuPG VS-Desktop" has been approved by the BSI for encrypting secret files/messages in the German government (VS=Verschlusssache) so I'm guessing that's where most of the money is coming from.

How is that a government contract at all? Sounds like a bullshit handout if anything, and I’ve seen pretty dumb government contracts before.

Well whatever works!

The german government appear to have fairly widely realised that the available options are support open source, or provide free intel to the US.

So instead of using the open source tool themselves they find a reason to capitalize the stewards, hm alright

Don't vote for them if you don't like their decisions.

I’m not a voter in Germany and I didnt say I didnt like it

(at the part you replied to)

The BSI is great though, they know what they are doing. Also the German government supports Open Source projects financially [1] and one of the states is planning to go full open source in its administration, so you'd think they are interested in keeping these projects alive

[1] https://prototypefund.de/en/

https://gnupg.com/ via https://gnupg.org/service.html

This is good news. Just using gpg isn’t good enough. Knowing how to do it properly is most important.

I hope more companies throw money at these guys.

Maybe they can even document some of their learnings doing deployments in a blog sort of system to give back to the community.

I support some form of FOSS guilds, in moderation; that is, there is knowledge that is documented but not necessarily full, complete tutorial and discussion casually provided. Obviously many companies do this explicitly themselves now with "community documentation" or "public core" and then many other media assets that are not shared widely. This is natural and obvious, with caveats that fairness is inherently difficult, and you can't please everyone. Security practice is certainly the sort of world where that guild behavior can go badly, and many will complain, sometimes falsely. So it goes in the real world.

Corporate and government users have been free-riding FOSS to ridiculous levels, in my view, and I welcome some way that actual practitioners can self-organize and at least survive. As opposed to say, divorce, substance abuse and what amounts to financial suicide, which I have seen happen to real people with good intentions and bright minds.

Here is the blog post with the details of how they started making enough money in the recent years:

https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html

“ GnuPG.com, Düsseldorf, Germany Offers commercial grade support, customized development, porting to new platforms, help with integrating GnuPG into customer projects, code audits, and more. GnuPG.com is a brand of g10code GmbH; owned and run by GnuPG´s and Gpg4win´s principal authors.”

There is certainly a need for consultants to help organizations do PGP-style security well. And it doesn't look like they're transforming GnuPG into an open core product model with critical components only available commercially.

So, this seems good? It doesn't look like they've been bought by anybody (e.g. a VC) who's going to require the sort of rate of return that can only be attempted (and probably not achieved) by doing things incompatible with GnuPG's role in the open source ecosystem. Not every company has to be huge — GnuPG can have outsized positive impact on the world while remaining small and sustainable.

I'm confused as well, it's not clear from that post what the new structure is, or how sustainable, or if there are back-up plans. It just says, that there is a new structure essentially.

I'd appreciate it if someone helped me understand, or get more context.

https://gpgtools.org/support-plan maybe?

Is this one of those things where you could technically pay for Winrar, but perhaps should never admit to doing so?

Reply on news.ycombinator.com