Please remove MacGPG from due to serious security concerns

Hugo Osvaldo Barrera hugo at
Tue Feb 17 00:53:11 CET 2015

On 2015-02-16 22:48, Jonathan Schleifer wrote:
> Hi!
> I hereby request that MacGPG gets removed from due to serious security concerns. Basically, the first thing the Makefile in all their repos / tarballs does is this:
>         @bash -c "$$(curl -fsSL"
> So you type make not expecting anything bad (you verified the checksum and everything), but you just executed remote code. Great. And they even hide it from you by prefixing it with @, which is downright evil. So you never notice unless you look at the Makefile. Currently, that script clones another common repo using the unverified git:// protocol (because, why use submodules if you can do it in an insecure way?), but obviously, that can change any minute and could change just for certain IPs etc.
> The developer(s) don't allow any issues on GitHub, so I tried contacting them by other means (e.g. Twitter), only to get ignored. They clearly don't care about security.
> In any case, somebody who does something like this clearly doesn't care about security the least. The potential for backdoors is extremely high and I think nobody should be using any software written by this developer / these developer(s), as they clearly demonstrated that they couldn't care less about your security.
> I don't feel comfortable that the majority of Mac users are using this software which doesn't care for security at all, but is used for extremely security sensitive tasks. I guess this is because recommends it and therefore people think it's safe. I think should do the contrary instead and strongly discourage using it.
> --
> Jonathan

It is true that there's a pretty big security hole there with "git clone
git://", since any malicious attacker can intercept that
communication. There's no checksuming or anything to make this difficult *at

What *does* suprise me is that there's a commit to specifically remove git+ssh
in favour of insecure ssh. There's no comment on why that was done either:

However, I'd recomend that you go over the proper support channels first
(rather than merely twitter) before asking that references to the proyect are

As stated on

   Please report any issues you find on our support platform.

Which points to


Hugo Osvaldo Barrera
A: Because we read from top to bottom, left to right.
Q: Why should I start my reply below the quoted text?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: </pipermail/attachments/20150216/5adf4c60/attachment.sig>

More information about the Gnupg-users mailing list