GnuPG 2.1.0 "modern" released [LWN.net]

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 3:52 UTC (Fri) by mathstuf (subscriber, #69389)
In reply to: GnuPG 2.1.0 "modern" released by dlang
Parent article: GnuPG 2.1.0 "modern" released

Versions 1.4 and 2.x are, by design, able to be installed at the same time.

to post comments

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:40 UTC (Fri) by dlang (guest, #313) [Link] (8 responses)

This is still a suboptimal user experience, now the user has to figure this out, and if they just do an upgrade to the new version, they can no longer read their old data.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 10:00 UTC (Fri) by rodgerd (guest, #58896) [Link]

Which is more than a little irritating when one has data retention policies that can go into the decades.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 18:34 UTC (Fri) by dlang (guest, #313) [Link] (6 responses)

expanding on this a bit.

while the two versions can be installed at the same time, they can't both be called gpg, so now the distro (or user) has to pick a name for the old version, it's path, etc and remember it.

Then there is the issue of system automation. You have to change all scripts that could validate or decrypt anything to know about both versions and figure out which version to call.

This is anything but portable and standard from system to system.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 19:00 UTC (Fri) by dd9jn (✭ supporter ✭, #4459) [Link] (3 responses)

I just wonder whether automated checking of PGP-2 signatures does no somewhat contradict the original claim that it is not possible to decrypt or verify old data. We are talking about 15 year old data - you still need to check it by a script?

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 19:06 UTC (Fri) by dlang (guest, #313) [Link] (1 responses)

> We are talking about 15 year old data - you still need to check it by a script?

why not? why should you no longer be able to use automation tools just because the data is old?

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 19:23 UTC (Fri) by dd9jn (✭ supporter ✭, #4459) [Link]

Applying 15 year old patches to at least 15 year old software? If you are forced to use such old and thus buggy software, verification of the patches is not very helpful. But if you think different, there is 1.4.

Also recall that until 2 or 3 years, many people kept an installation of PGP-2 to be able to decrypt their old mail because it was legally not possible for gpg to do that (IDEA patent). Not very different to what GPG 2.1 ask you to do. With the only difference that GPG does this for security reasons.

For the minority of users with these specal needs we spend the time and trouble to keep 1.4 alive and hopefully secure.

GnuPG 2.1.0 "modern" released

Posted Nov 17, 2014 10:30 UTC (Mon) by epa (subscriber, #39769) [Link]

A "script"? No. You want to view these older messages in your email client. What, you don't have older archived mboxes going back decades?

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 21:25 UTC (Fri) by mathstuf (subscriber, #69389) [Link] (1 responses)

IIRC (and I'm not 100% sure about this), but the command line interface isn't completely compatible between the two anyways, so having them both be available as 'gpg' wouldn't be suitable anyways.

GnuPG 2.1.0 "modern" released

Posted Nov 15, 2014 10:13 UTC (Sat) by dd9jn (✭ supporter ✭, #4459) [Link]

Right, the PGP-2 command line compatible options

-k[v][v][v][c] [user-id] [keyring]

have been removed from 2.x a long time ago but are still available in 1.4 despite that they are marked as as deprecated since 1999.