<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 21/05/2018 06:20, Robert J. Hansen wrote:<br>
<blockquote
cite="mid:d2a76017-293b-ed77-6ed5-064079763c26@sixdemonbag.org"
type="cite">
<pre wrap="">Here's my own set of suggestions for breaking changes to GnuPG:
1. End-of-life 1.4 already.
Yes, it's the only option for PGP 2.6. Yes, it's the only option for
old and out-of-date stuff. Yes, there will be people who need to
decrypt this stuff. All of that is true, but *we* don't need to be the
people who cater to their needs.</pre>
</blockquote>
<br>
Get real. These people are long-time GnuPG users and now you want to
throw them under the bus because... well, because you prefer it that
way. No, that's not a fair, it's not reasonable, it's not ethical,
or it's even professional.<br>
<br>
<blockquote
cite="mid:d2a76017-293b-ed77-6ed5-064079763c26@sixdemonbag.org"
type="cite">
<pre wrap="">At this point if you need pre-Web
crypto (which, I remind people, is pretty much what PGP 2.6 is), you
have a specialized need and you need to talk to someone about a custom
solution.</pre>
</blockquote>
<br>
Err... the specialised solution surely is GnuPG 1.4.<br>
<br>
<blockquote
cite="mid:d2a76017-293b-ed77-6ed5-064079763c26@sixdemonbag.org"
type="cite">
<pre wrap="">There are companies that specialize in this sort of thing
(like, say, g10 Code).</pre>
</blockquote>
<br>
So you are saying that long-time users should be deprived of an open
source ongoing-maintained solution to their entirely valid present
day use case to benefit a private company.<br>
<br>
Isn't that effectively equivalent to commercial sponsors taking
previously open source code base private? It's hardly a popular move
when it happens.<br>
<br>
Yes, I know that the scenario you are proposing is not <i>exactly</i>
the same but people will, quite understandably, treat it as such.<br>
<br>
<blockquote
cite="mid:d2a76017-293b-ed77-6ed5-064079763c26@sixdemonbag.org"
type="cite">
<pre wrap="">We should keep the 1.4 source code available, but wash our hands of it
and say it will receive *no* future fixes, not even for security issues
-- and we need to stand on that when people start screaming.</pre>
</blockquote>
<br>
Surely if you can recognise that people will start screaming then
you must also understand that it is entirely the wrong thing to do.<br>
<br>
<blockquote
cite="mid:d2a76017-293b-ed77-6ed5-064079763c26@sixdemonbag.org"
type="cite">
<pre wrap="">Rationale: as long as we keep GnuPG 1.4 around and even semi-supported,
people will insist on not upgrading.</pre>
</blockquote>
<br>
If you drop maintenance of code that can handle the data that some
people need to cope with then they will naturally have to stay with
old, unmaintained code anyway. So dropping maintenance of 1.x will
only cause a problem in this respect, not cure on.<br>
<br>
If you are (understandably) concerned about people still use 1.4 for
encryption of new data then the sensible choice is surely to do what
people have suggested in this thread: That is to produce a
decryption-only maintained version that still allows users who need
to access archived legacy-encrypted data to do so.<br>
<br>
Clearly you are concerned with preventing people using legacy
encryption for new data and I agree with this concern. But there is
no need to throw present day, long-time users who must handle
legacy-encrypted data under the bus to do so.<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Mark Rousell
PGP public key: <a class="moz-txt-link-freetext" href="http://www.signal100.com/markr/pgp">http://www.signal100.com/markr/pgp</a>
Key ID: C9C5C162
</pre>
</body>
</html>