Hacker News Reader

Comment by pyre | Hacker News Reader

I knew that the developer pool for GPG was pretty small, and that this is a big reason why development isn't always fast.

On the other hand, I had no idea that he was working full-time on it, and having money trouble.

Also: If you search for "GPG Koch" you can come across this comment:

https://news.ycombinator.com/item?id=6942254

EDIT: An example of development that is slow-coming: library support. Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.

View on HN

Wrapping the command line should be a little bit safer from a security perspective, since a memory exfiltration bug won't transfer across processes. Just don't use the shell between the wrapper and the command.

Is this really the case? I recall that proper library support is slow-coming, not because of security model concerns, but because "doing it right" takes more time / money that there is in GPG development at the moment.

EDIT: For example, I believe that it would require rewriting a lot of code, and that means said code would need to be audited to make sure no security bugs were introduced. It's "easier" to just wrap the current command-line tools because they are a known quantity.

I'm sure you're right, but because of this "laziness" we get a slight security boost at the cost of a slight performance loss.

> Most GPG "libraries" in languages like Python and Ruby are just wrappers around the GPG command-line, because there is no proper library.

IIUC this is intentional design of GPG 1.x vs GPG 2.x: the former is statically linked binaires for "security reasons" while the latter is a shared lib (libgcrypt) + binaries with exactly the same features.

is gpgme not a proper library?

https://www.gnupg.org/%28it%29/related_software/gpgme/index....

I haven't used it, so I really don't know.

It's a library that talks through the shell. I was kinda disappointed when I learned that. But it may be on purpose, as someone else mentioned.

I've used it while making bindings for it for my Scheme project: https://github.com/cslarsen/mickey-scheme/tree/master/lib/op...

Reply on news.ycombinator.com