[gpgtools-devel] Joint OpenPGP (JS) implementation

Alex (via GPGTools) alex at gpgtools.org
Thu Nov 24 20:58:45 CET 2011 

(copy to gpgtools and gnupg for the last time)

Hi Felix,

> we are happy to join forces with anyone who's interested in bringing
> OpenPGP functionality into browsers and web mailers.

this is very good news! Do you have a Github account?

> In terms of project organization, hosting, name, etc. we are completely
> open. We can put up additional tools (bug tracker, wiki, etc.) or
> anyone of you can take over.

Do you have a continuous build server? I started to configure an infrastructure so we can move on. If anyone has objections or want to use another setup, please feel free to communicate this. Here are the links:

* Most important (everyone should be part of the mailing list)
* Web: openpgpjs.org
* Mail: list at openpgpjs.org / list.openpgpjs.org

* Second most important (with full access for seancolyer, Fitblip, me)
* Web (Tickets): tickets.openpgpjs.org
* Web (Sources): src.openpgpjs.org
* Web (Documentation): docs.openpgpjs.org

* For someday
* Mail (core group): org at openpgpjs.org
* Mail (core member): username at openpgpjs.org
* Mail (Donations): donations at openpgpjs.org
* Web (Statistics): stat.openpgpjs.org
* Web (RSS): rss.openpgpjs.org
* Web (Twitter): twitter.com/openpgpjs
* Web (Youtube): youtube.com/openpgpjs
* Web (Google): plus.google.com/101278333271226805222

* Not yet started
* Web (Support): support.openpgpjs.org (e.g. tender)
* Web (Buildbot): build.openpgpjs.org (e.g. buildbot)
* Web (Blog): blog.openpgpjs.org (e.g. wordpress)

Best regards, Alex

On 24.11.2011, at 12:02, Felix 'FX' Lindner wrote:

> Hi all,
> 
> we are happy to join forces with anyone who's interested in bringing
> OpenPGP functionality into browsers and web mailers. Right now, we are
> incorporating the fixes that follow the initial wave of issue/bug
> reports. Feel free to use the code anytime.
> 
> In terms of project organization, hosting, name, etc. we are completely
> open. We can put up additional tools (bug tracker, wiki, etc.) or
> anyone of you can take over.
> 
> Regarding key managment, I'm with Sean here. The user should be able to
> choose between server side storage, client side storage, no-secret-key
> (encrypt only), etc. That's why we clearly say that you should not use
> our prototype for confidential communication.
> 
> cheers
> Felix
> 
> On Wed, 23 Nov 2011 00:08:44 -0500 Sean Colyer <sean at colyer.name> wrote:
>> I just came upon gpg4browser as well. Looking at the code it looks
>> like this is the most complete implementation out there currently. I
>> imagine that they have been working on this for some time and it's
>> quite impressive. Ironic that there was minimal development on this
>> for so long and now so much coincidental parallel development..
>> 
>> I've been working on key generation which is one area that I think
>> gpg4browser hasn't, and I'm sure there are a few others as they have
>> noted on their site.
>> 
>> As for key management -- I like the concept of offering a range of
>> solutions, I think it's important we create a common interface for the
>> different methods that we can use to connect to a range of options.
>> 
>> Thanks,
>> Sean
>> 
>> On Mon, Nov 21, 2011 at 9:22 PM, Crypto Stick <
>> cryptostick at privacyfoundation.de> wrote:
>> 
>>> Hi!
>>> I'm just wondering if unhosted.org could be an interesting and easy
>>> to implement storage backend for OpenPGP.js. It's advantage is that
>>> the keys could be stored at a different server resp. service
>>> provider than the web application is hosted.
>>> 
>>> Regards,
>>> Jan
>>> 
>>> Am 22.11.2011 01:59, schrieb Alex (via GPGTools):
>>>> Hi there,
>>>> 
>>>> just updated the attached overview picture, added two more
>>>> participants
>>> to this list (Jan (Crypto Stick) and David (DOMCrypt)) and also the
>>> GnuPG mailing list (might be of interest for someone there). Please
>>> have a look at the message thread below for details.
>>>> 
>>>> If we can agree on the name OpenPGP.JS/openpgpjs (analog to
>>>> videojs,
>>> pdfjs, ...) we should move the documentation, tickets and sources
>>> from
>>>> 
>>>> https://github.com/GPGTools/openpgpjs/wiki
>>>> https://github.com/GPGTools/openpgpjs/issues
>>>> 
>>>> to
>>>> 
>>>> https://github.com/openpgpjs/openpgpjs/wiki
>>>> https://github.com/openpgpjs/openpgpjs/issues
>>>> 
>>>> Best regards, Alex
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> On 19.11.2011, at 23:04, Alex (via GPGTools) wrote:
>>>> 
>>>>> Hi there,
>>>>> 
>>>>> also attached the scope of our project from my point of view.
>>>>> 
>>>>> Best regards, Alex
>>>>> 
>>>>> On 19.11.2011, at 11:55, Alex (via GPGTools) wrote:
>>>>> 
>>>>>> Hi there,
>>>>>> 
>>>>>> just found GPG4Browsers[2], added the URL to our (temporary)
>>>>>> wiki[2]
>>> and the contact to our (again temporary) mailing list.
>>>>>> 
>>>>>> It seems to be clear that there is a big demand of a single core
>>> JavaScript OpenPGP implementation and we find more and more
>>> projects and developers. Still, the next issue seems to be to agree
>>> on a name before we can setup a infrastructure. Does anyone have a
>>> strong opinion on that (we can Doodle for a name)? I would like to
>>> continue with https://github.com/openpgpjs and add everyone
>>> interested in this project as admins.
>>>>>> 
>>>>>> Best regards, Alex
>>>>>> 
>>>>>> [1] http://gpg4browsers.recurity.com/
>>>>>> [2] https://github.com/GPGTools/openpgpjs/wiki
>>>>>> 
>>>>>> On 19.11.2011, at 07:27, Ryan Sears wrote:
>>>>>> 
>>>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>>>> Hash: SHA256
>>>>>>> 
>>>>>>> Hi Guys,
>>>>>>> 
>>>>>>> So I realize that we're still in the very early stages of
>>>>>>> getting everything started, but I raised an issue here:
>>>>>>> 
>>>>>>> https://github.com/GPGTools/openpgpjs/issues/9
>>>>>>> 
>>>>>>> about potentially moving to a different repo, as I feel like
>>>>>>> this is more under the GPGTools wing, and less of an
>>>>>>> independent project, with equal shares from all the developers
>>>>>>> (which is what I would like to
>>> see).
>>>>>>> 
>>>>>>> I also wonder if we wish to stick with openpgpjs? Maybe we
>>>>>>> could come
>>> up
>>>>>>> with a cooler name?
>>>>>>> 
>>>>>>> What are everyone else's thoughts on this?
>>>>>>> 
>>>>>>> Also like I said last night, I'm all finished with the
>>>>>>> signature
>>> stuffs,
>>>>>>> so now it's mostly just getting everything more polished then
>>>>>>> it
>>> already is:
>>>>>>> 
>>>>>>> http://fitblip.github.com/JSPGP-Stuffs/pubkey.html
>>>>>>> 
>>>>>>> Ryan
>>>>>>> 
>>>>>>> On 11/18/2011 11:30 AM, Alex (via GPGTools) wrote:
>>>>>>>> Thanks. Added it to the page:
>>> https://github.com/GPGTools/openpgpjs/wiki
>>>>>>>> 
>>>>>>>> On 18.11.2011, at 16:45, Lukas Pitschl | Dressy Vagabonds
>>>>>>>> wrote:
>>>>>>>> 
>>>>>>>>> Hi,
>>>>>>>>> 
>>>>>>>>> the most complete OpenPGP implementation besides GPG I could
>>>>>>>>> find
>>> was an implementation in Perl.
>>>>>>>>> http://search.cpan.org/dist/Crypt-OpenPGP/
>>>>>>>>> 
>>>>>>>>> Maybe it's possible to learn a little from it and help by
>>>>>>>>> porting
>>> portions to Javascript.
>>>>>>>>> 
>>>>>>>>> Best,
>>>>>>>>> 
>>>>>>>>> Lukas
>>>>>>>>> 
>>>>>>>>> Am 18.11.2011 um 12:06 schrieb Alex (via GPGTools):
>>>>>>>>> 
>>>>>>>>>> Hi there,
>>>>>>>>>> 
>>>>>>>>>>> I think it would be good to outreach to the GPG mailing
>>>>>>>>>>> list.
>>>>>>>>>> 
>>>>>>>>>> I agree, this is issue 5 (
>>> https://github.com/GPGTools/openpgpjs/issues/5 ). If someone from
>>> our small list here could sum up our current status and plan on the
>>> wiki ( https://github.com/GPGTools/openpgpjs/wiki ), I will post to
>>> other mailing lists/google/twitter/..., ask for others to
>>> participate and link to the according wiki page for more
>>> information.
>>>>>>>>>> 
>>>>>>>>>> Best regards, Alex
>>>>>>>>>> 
>>>>>>>>>> 
>>>>>>>>>> On 18.11.2011, at 03:46, Sean Colyer wrote:
>>>>>>>>>> 
>>>>>>>>>>> I think it would be good to outreach to the GPG mailing
>>>>>>>>>>> list.
>>> Since Tino and Bill were added to this list, do either of you have
>>> any interest in working on this development?
>>>>>>>>>>> 
>>>>>>>>>>> I still have not heard back from mete0r, unfortunately.
>>>>>>>>>>> 
>>>>>>>>>>> I've continued to work on this from my end. I'm currently
>>>>>>>>>>> working
>>> on key generation, and seem to have most of the basics outlined...
>>> I'm having some trouble generating Key ID's that agree with the
>>> ID's generated by gpg. I believe I'm following 12.2 of RFC 4880
>>> pretty closely, but I would love some insight if anyone has worked
>>> with this bit directly...
>>>>>>>>>>> 
>>>>>>>>>>> On Sun, Nov 13, 2011 at 5:52 AM, Alex (via GPGTools) <
>>> alex at gpgtools.org> wrote:
>>>>>>>>>>> Hi there,
>>>>>>>>>>> 
>>>>>>>>>>>> * How to proceed (e.g. which infrastructure to use)?
>>>>>>>>>>> ...
>>>>>>>>>>>> I can offer to extend our existing GPGTools
>>>>>>>>>>>> infrastructure to
>>> host everything related to this project.
>>>>>>>>>>> 
>>>>>>>>>>> 
>>>>>>>>>>> just to take the next step:
>>>>>>>>>>> 
>>>>>>>>>>> * Sources: https://github.com/GPGTools/openpgpjs/
>>>>>>>>>>> * Tickets: https://github.com/GPGTools/openpgpjs/issues
>>>>>>>>>>> * Documentation: https://github.com/GPGTools/openpgpjs/wiki
>>>>>>>>>>> 
>>>>>>>>>>> Best regards, Alex
>>>>>>>>>>> 
>>>>>>>>>>> 
>>>>>>>>>>> On 08.11.2011, at 23:59, Alex (via GPGTools) wrote:
>>>>>>>>>>> 
>>>>>>>>>>>> Hi there,
>>>>>>>>>>>> 
>>>>>>>>>>>> Thank you for all your answers! I think there's a big
>>>>>>>>>>>> chance for
>>> us to develop a core OpenPGP JavaScript core library. Let me try to
>>> summarize:
>>>>>>>>>>>> 
>>>>>>>>>>>> Main Objectives (partly from
>>> https://github.com/GPGTools/Mobile/wiki/Introduction):
>>>>>>>>>>>> * (Test-driven) implementation of a standard JavaScript
>>>>>>>>>>>> OpenPGP
>>> implementation
>>>>>>>>>>>> * Make it clean and object orientated
>>>>>>>>>>>> * Merge existing code projects while starting from scratch
>>> creating a core library but without reinventing the wheel
>>>>>>>>>>>> * Use/integrate it in other projects
>>>>>>>>>>>> 
>>>>>>>>>>>> Current Issues:
>>>>>>>>>>>> * How to proceed (e.g. which infrastructure to use)?
>>>>>>>>>>>> * How to contact Mete0r?
>>>>>>>>>>>> * Find even more developers (e.g. via gnupg mailing lists)
>>>>>>>>>>>> * Write initial tests (use cases, workflows, example
>>>>>>>>>>>> messages,
>>> expectations, ...)
>>>>>>>>>>>> * Which BigInt library to use?
>>>>>>>>>>>> * Support v3 keys?
>>>>>>>>>>>> 
>>>>>>>>>>>> Needed Infrastructure:
>>>>>>>>>>>> * Ticket system (e.g. lighthouse)
>>>>>>>>>>>> * Source versioning (e.g. github)
>>>>>>>>>>>> * Documentation (e.g. github wiki)
>>>>>>>>>>>> * Communication (e.g. mailing list)
>>>>>>>>>>>> * Continuos Testing (e.g. build bot)
>>>>>>>>>>>> 
>>>>>>>>>>>> Codebase:
>>>>>>>>>>>> * Original HaneWIN
>>>>>>>>>>>> * gmail-Crypt
>>>>>>>>>>>> * mete0r
>>>>>>>>>>>> * JSPGP
>>>>>>>>>>>> 
>>>>>>>>>>>> I can offer to extend our existing GPGTools
>>>>>>>>>>>> infrastructure to
>>> host everything related to this project.
>>>>>>>>>>>> 
>>>>>>>>>>>> Best regards, Alex
>>>>>> 
>>>>>> 
>>>>>> 
>>>>>> --
>>>>>> http://gpgtools.org
>>>>>> http://gpgtools.org/about (Google+, Twitter, RSS)
>>>>>> 
>>>>> 
>>>>> <OpenPGP.js.pdf>
>>>>> 
>>>>> 
>>>>> --
>>>>> http://gpgtools.org
>>>>> http://gpgtools.org/about (Google+, Twitter, RSS)
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> --
>>>> http://gpgtools.org
>>>> http://gpgtools.org/about (Google+, Twitter, RSS)
>>>> 
>>> 
> 
> 
> -- 
> Recurity Labs GmbH           | Felix 'FX' Lindner 
> http://www.recurity-labs.com | fx at recurity-labs.com 
> Wrangelstrasse 4             | Fon: +49 30 69539993-0
> 10997 Berlin                 | PGP: A740 DE51 9891 19DF 0D05  
> Germany                      |      13B3 1759 C388 C92D 6BBB
> HRB 105213 B, Amtsgericht Charlottenburg, GF Felix Lindner


--
http://gpgtools.org
http://gpgtools.org/about (Google+, Twitter, RSS)

More information about the Gnupg-users mailing list