2026-04-16 16:17 UTC
Replies (2)
-
@bms48@mastodon.social 2026-04-16 16:23
@betabug @mathew @jonny @david_chisnall @chris_evelyn I think I'd let what Paul Vixie said speak for itself, but... gpg-agent exposes unprotected filesystem endpoints on Windows, will not let you remove loaded keys, nor does it support any of the other official OpenSSH options. It also caches keys on disk. Microsoft's ssh-agent port is slightly less bad but still pretty bad; it caches them in the per-user Registry. https://github.com/PowerShell/Win32-OpenSSH/issues/1487#issuecomment-2894953357 I was hoping this was more common knowledge by now...
-
@mathew@universeodon.com 2026-04-16 16:31
@betabug @bms48 @jonny @david_chisnall @chris_evelyn Regarding PGP in general, it has way too many footguns, and the complexity and poor usability mean people are likely to trigger them. Here’s an article about it: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ For signing code for repos, you can use SSH. For email, S/MIME (which is also bad but at least not as bad as PGP). For files, age.