2026-04-16 16:31 UTC
@betabug @bms48 @jonny @david_chisnall @chris_evelyn Regarding PGP in general, it has way too many footguns, and the complexity and poor usability mean people are likely to trigger them. Here’s an article about it:
https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/
For signing code for repos, you can use SSH. For email, S/MIME (which is also bad but at least not as bad as PGP). For files, age.
Replies (2)
-
@betabug@mastodon.sdf.org 2026-04-16 16:54
@mathew @bms48 @jonny @david_chisnall @chris_evelyn OK, I get your point. I have used gpg for mail in the past in two time periods in very closed groups of correspondents, and things worked that way ... but now things like Signal have stopped making that necessary since a long time.
-
@grahamperrin@mastodon.bsd.cafe 2026-04-16 23:23
@mathew wow wot (web of trust), blast from the past. I want to put on a 45.