<story><title>PGP Marks 30th Anniversary</title><url>https://philzimmermann.com/EN/essays/PGP_30th/</url></story><parent_chain></parent_chain><comment><author>stratosgear</author><text>This brings back memories. I was an international student from Greece at the University of San Francisco, that fall, and I was present at a CS presentation that took place at the time (I&amp;#x27;m not sure if it was Phill or not, but definitely one of the original authors). At the end of the presentation there was a pile of floppies that you could get a copy of the software. I got one along with my other classmates.&lt;p&gt;Unfortunately, I was approached a couple of days later and asked to return the floppy back. My status as an international student did not allow me to have a copy ( arms, munitions export rules, whatever).  I felt really upset about it, since I was the only one asked to give my floppy back.  I might still have a copy of the floppy in a box in the attic somewhere.</text></comment>
<story><title>PGP Marks 30th Anniversary</title><url>https://philzimmermann.com/EN/essays/PGP_30th/</url></story><parent_chain></parent_chain><comment><author>dale_glass</author><text>It&amp;#x27;s very unfortunate PGP&amp;#x2F;GPG hasn&amp;#x27;t kept up with the times. Today it has two significant issues:&lt;p&gt;1. The needed trust model has changed significantly.
2. It&amp;#x27;s not reusable enough.&lt;p&gt;1. The original PGP mostly dealt with direct person-to-person relationships. Alice and Bob needed to safely communicate. Perhaps Bob could vouch for Carol. But that was the intended model: closely related groups, with maybe a person trusted to act as an introducer. Today our needs are different, and we need to securely communicate with people we never met, or to verify their signatures. Any Linux system contains thousands of packages, which were worked on by many thousands of developers, one may need to communicate with securely at some point. Eg, I want to verify the GPG signature on the Tor browser, but I never met anyone on the team, and how do I know who knows the team?&lt;p&gt;My personal network actually extends very far. I did the FOSDEM key signing party several times, so my theoretical reach is enormous. But it can only be achived by hacking around GPG&amp;#x27;s trust model. I need to figure out by hand a path between me and Tor, download the keys, and manually tell GPG I trust each key&amp;#x27;s signature. This isn&amp;#x27;t convenient, user friendly, not as safe as it could be.&lt;p&gt;2. GPG is unfortunately stuck in the &amp;quot;Unix Philosophy&amp;quot; era, where you&amp;#x27;re supposed to just invoke the binary and parse its text output. I believe this crippled GPG&amp;#x27;s adoption, because it&amp;#x27;s &lt;i&gt;slow&lt;/i&gt;. GPG has to do the whole startup, reading its key databases and so on every single time. Back when GPG support was introduced into KMail many years ago this added a very noticeable delay to viewing any signed message.&lt;p&gt;And it&amp;#x27;s sadly still the case. The world badly needs a GPG library, that allows one to skip those startup costs, and to avoid the whole intended model of ~&amp;#x2F;.gnupg and just let a program do things like interpret in-memory data for any conceivable purpose. This is still badly lacking.</text></comment>