GPGTools – OpenPGP Tools for Apple OS X | Hacker News Reader

GPGTools – OpenPGP Tools for Apple OS X

gpgtools.org

99 pointsrosser40 comments

While this is great, the teaser animation/splash screen [1] is incredibly irritating. While slick and very pretty, the "typing" animation took way too long - and there's no obvious way to disable it.

Does anyone know how they got around sandboxing, since that was the problem with Mountain Lion up until now?

[1] https://gpgtools.org/index.html?teaser=1

I think it could be less irritating if they would just increase the speed to be at or above reading speed. Surely someone has researched what that speed is and written something about it?

I think it's worth defending because even though I was annoyed by it, I did read every letter! Maybe because it's because I'm slightly invested since I started using gpgtools a few days ago and was very impressed by the software, but still, getting people to read copy is a very desirable thing on any marketing site right?

We've found a kind of "hole" in Apple's sandboxing (they know about it but I guess it's necessary for legacy software) and hope they don't close it too soon

What's the best way to ensure faster turnaround when a new OS X version comes out? Is the constraint money, or is it more that they need more developers?

I used GPGTools before Mountain Lion and was very sad when the update to Mountain Lion broke it, and if I recall correctly it was because Apple more or less totally redid Mail.app and sandboxed it in a way that made it hard to integrate with. Seems like they have sorted this out now, and this should make it for a quicker turn around in the future.

It's been sorted for a while. I've been using it for months, but if you wanted access to it, you had to either pay for it, or build it from source (I want the latter route).

I used to meticulously sign all my emails with GPG back in the day with mutt. Then, sometime after leaving FreeBSD for the Mac, I decided to move to Mail.app and GPGTools.

Everything worked great, great enough for me to leave mutt behind and painstakingly move my email archives and everything else into a 21st-century gooified mail environment.

And then I upgraded OS X (I think to jag-wire, maybe?) and spent far too long being sad about non-working GPG. Of course to be honest, lagging GPGTools releases were only part of the reason Mail.app eventually came to be the most hated part of my Mac experience. But lagging GPGTools was the thing that stuck in my craw every time.

I used to be really good at email. I was organized and efficient working in it. But now I've totally given up and moved to GMail. My inbox grows like cancer, with a raft of features I don't use like stars and bayesian recommendations.

In anger, I tried mutt a while back. After hours of setup, I found the magic was gone... but at least GPG signing still worked without a hitch.

Great tool but who wants to way months after each major OS X release to use it (again)?

GPGTools is not alone with this problem. LibreOffice for example can't probably be installed by many users because the binary isn't signed Apple-style. Many users will get an error message by OS X and just forget about LibreOffice …

Hopefully it'll be at least some time before the make such a big change to Mail.app. Remember it worked well for many releases before we got into the current situation.

People should probably use operating systems written by people who care about backwards compatibility. Ideally ones that are developed in the open.

If I am understanding the problem correctly...

Apple implemented app signing by default in 10.8. Users can either turn this off in System Preferences (removing the error), or the LibreOffice team can pay the $100 annual fee to get a properly signed app.

Actually, there's a temporary workaround which you can use and works till you update to a new version (works with any app or package not signed with an Apple ID) Simply right-click open and you'll not see the error message. No need to disable gatekeeper in System Preferences

That's correct, or users could use the right-click workaround.

Most users, however, won't know this workaround and it shouldn't be necessary to lessen the security of OS X just to use (or update) LibreOffice.

I'm sure the Document Foundation could afford the necessary app-signing.

The GPGTools team had a paid version (beta) out for months. I felt the functionality was worth the minor investment and also ensured that there was some path forward for future revs.

A beta version is nice but it's a beta, i.e., it's not thought for use on productive systems. Paying is fine too but there're always developer releases of OS X and the GPGTools developers should therefore to get their app ready on or shortly after the release of a new major OS X version.

At the same time, I assume that the developers are well aware of the delay issue. So what exactly causes the delay? Is there any way to support the GPGTools developers in this regard?

For anyone wondering, this comes with GPG 2.0.19, 2.0.20 came out on May 10th 2013 with a security fix: http://www.cvedetails.com/cve/CVE-2012-6085/

I believe they've patched it in this release though: http://support.gpgtools.org/discussions/everything/4323-cve-...

It's disappointing that their release notes don't mention this.

It's true we should have mentioned it in the release notes, I think we forgot. Mentioned it only on Twitter. Will definitely do better in the future!

What is the difference between GPG and PGP?

GPG is the FSF's implementation of the OpenPGP spec. PGP was the original implementation upon which the spec is based, and is now the name of a company, owned by Symantec, that makes a commercial version of the software, and some related tools.

It's good to see a group actively trying to move PGP into the mainstream. I think that PGP is valuable, and that this work is worthwhile if only because it makes it easier to use PGP on a day-to-day basis.

Finally, with Lion support... Although I've since switched to Thunderbird/Enigmail, which works with older version just fine..

I did that, unfortunately the search feature in Thunderbird is just terrible compared to Mail.app (maybe there is a plugin I don't know about?)

If you're actually trying to encrypt email, you probably don't want your mail app building a search index in plain text.

Just getting a working subject / from / to search would be great. That said, my primary purpose with GPG is securing the emails in transit, not on my laptop. I already use disk encryption and most of the documents I send are stored unencrypted on that disk as well. The kind of people that would break into my computer would most likely just install a keylogger to get my GPG key rather than look for plain text indexes.

Depends if you're primary concerned with transit, vs local storage.

Yeah, it's a bit weird, but I usually just click "Display as List" on search results pane and then it becomes more usable...

I've never used PGP or GPG before, is this something that I should be using?

Yes.

Which one?

You want to use the OpenPGP specification, the most popular implementation of which is GPG. But if you want to use the actual PGP software, that is perfectly fine, too.

The point is to make encrypted/signed messages the norm rather than an outstanding event causing suspicion.

Do OpenGPG smartcards work?

Great tool but it's annoying how it messes with homebrew.

Does it? I haven't noticed any problems.

Run `brew doctor` after installing.

Ahhh. I rarely run brew doctor. Warnings aren't the worst things in the world though and I don't think it is unreasonable that they stick libs in /usr/local/lib.

I don't disagree but it does make it harder to debug other homebrew issues.

That's really Homebrew's problem. It's inappropriate for Homebrew to try to take complete ownership of /usr/local. That's what /opt is for.

I had this problem with earlier GPGTools, but this one seems ok. I did an install on a machine where I haven't had the old versions and the doctor is happy afterwards.

This should be no longer the case from version MacGPG2 2.0.19 upwards.

I'm still getting the warning.

Latest MacGPG2 & Homebrew.

Reply on news.ycombinator.com