Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why should a service for publishing keys host manuals for GPG? The manuals are available at www.gnupg.org, where they belong.

https://www.gnupg.org/documentation/index.html

Also, why would that be grounds for shaming people who use published keys in a way it was designed for? I don't get your point.



The specific point is that there's nothing on the directory site to indicate that uploading a key to the directory will cause people to start encrypting your emails. From the description it sounds like a directory of pgp keys, nothing more and nothing less.

The more general point is that this is why people don't use these systems. There's very little thought given to UX. It's barely usable for average developers, let alone laypeople. Instead there's gatekeeping and stubborn pointing at ideals.


What do you think a public directory of PGP keys exist for? To publish them so that other people can use them without asking you for one in person. Why would it need a oh-this-is-not-actually-meant-to-be-public-it's-a-trap-for-shaming-people-who-reasonably-assumed-otherwise flag? Would that flag also need another this-flag-should-not-be-respected flag?

Yes, there are UX problems with PGP. No, that's not relevant to this particular case.


> To publish them so that can use them without asking you for one in person

without asking you for it, but not without asking you what to use it for.


Just like how people purchasing books from a bookstore have to ask each author what they're going to use the books for? I think not. The act of publishing a book clearly indicates that the author wants the book to be read. It's the same thing with public keyservers and PGP encryption keys.

Another example. When you put your email address in a contacts page in your blog, is the message "don't email me, ever" unless you add another "yes, you can use this for email purposes" disclaimer? If that's the case, shouldn't that disclaimer need another "yes, this disclaimer is what you think it means" disclaimer? And shouldn't that disclaimer also ... you get the idea.

Some actions, such as publishing something, has well-established meanings. You can't yell at people for thinking "publish" meant publish.


Your comparisons don't help, they are just verbose ways for you to (re-)state that you think publishing a key on keys.openpgp.org obviously means "you can email me encrypted" and that others may be a bit stupid to think otherwise (a bit like your "You can't yell at people for thinking "publish" meant publish" sentence, honestly, cut the bullshit)

I don't believe this to be the case. It's fine that we don't agree on this. Do you have sources? Because that would settle the discussion for good. Happy to be wrong. I'm not an expert on this stuff anyway.

Now, I also believe that it's not a big deal, if you unexpectedly receive an encrypted mail you can still decrypt it using your private key and if you don't know how to do this, you can always send your recipient "Hey, sorry, you sent me an encrypted mail that I can't decrypt, can you send me one without encryption?".

Unless, of course, your recipient's provider doesn't let them do this.

Maybe Proton doing this will push the ecosystem toward a more seamless support for encrypted mail, so it might even be a good thing. I don't know.


I mean encrypting email was what PGP was created for. It's my understanding that uploading keys was a sign that you wanted your emails to be encrypted as much as possible. Not a mere "I'll accept encrypted emails, even if begrudgingly."

Here's a snippet from the PGP FAQ last updated in 1998:

> Public Key Servers exist for the purpose of making your public key available in a common database where everybody can have access to it for the purpose of encrypting messages to you. Anyone who wants to write you a message, or to check a signature on a message from you, can get your key from the keyserver, so he doesn't have to bother you with it.

https://www.pgp.net/pgp-faq/faq.html#8.1

Of course, the writing was on the wall for PGP in email when I created my first keys a decade ago. But it was still touted as a tool for encrypting emails even then during the height of the Snowden disclosures. The complete loss of interest in using it for email is a relatively new phenomenon.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: