Why 2.1 is delayed for so long

Robert J. Hansen rjh at sixdemonbag.org
Mon Sep 22 16:17:34 CEST 2014


> I agree with these principles, but I think you are not applying them 
> in the right way. The fact that the user is doing gpg --gen-key 
> already means the choice is relevant...

Emphatically not!

I can count on one hand with fingers leftover the number of times I've
cared over the last 15 years of using GnuPG whether the key I'm
generating used RSA or DSA/Elg.  (Three fingers leftover; twice I had a
specific need for RSA, for compatibility with stuff further down the
toolchain that's outside of GnuPG's control.)  The rest of the time the
choice was completely irrelevant

Some users enjoy tweaking with the knobs and dials.  There's nothing
wrong with that, and I think GnuPG should support that.  But I also
think that irrelevant knobs and dials should be hidden from the user.
Algorithm choice and key size are two such things.  Pick sane defaults,
make it easy to override them with --expert, and don't reveal them to
the casual user.

> There are lots of other point-and-click interfaces for GPG for users
> that "don't care".

There are also a lot of people who look at GnuPG's FAQ for advice on how
to begin using GnuPG.  Those instructions currently amount to "--gen-key
and trust the defaults."

> * Never present to the user a false model of what actually happens.

How is hiding irrelevant choices, or choices the user cannot understand,
presenting a "false model," especially when I've explicitly said that
with --expert the choices should return?



More information about the Gnupg-devel mailing list