Relax 😎! GPG is not OpenPGP!

Yesterday, vulnerabilities were published https://gpg.fail but they don't affect #deltachat or any other #chatmail client because

A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.

B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg has not implemented that spec)

Please spread the word that #gpg is not #openpgp ... Thanks!

Relax 😎! GPG is not OpenPGP!

Yesterday, vulnerabilities were published https://gpg.fail but they don't affect #deltachat or any other #chatmail client because

A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.

B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg has not implemented that spec)

Please spread the word that #gpg is not #openpgp ... Thanks!

These #GnuPG vulns are awesome for embedded hacking. Firmware update mechanisms often rely on pgp signatures. Now that there’s multiple ways to forge one, I am looking forward to more devices getting liberated. 🥳

The #39C3 “To sign or not to sign” (https://gpg.fail) talk is excellent. 👏

IMHO: Avoid PGP altogether, especially #GnuPG. Avoid memory unsafe programming languages, wherever feasible.

It is mind boggling, that the gpg team / g10 Code GmbH refuses to fix all vulnerabilities, given that their @bsi certification and thus their business model being at risk.

Also goes to show, that BSI certifications are worthless. Quel surprise?

These #GnuPG vulns are awesome for embedded hacking. Firmware update mechanisms often rely on pgp signatures. Now that there’s multiple ways to forge one, I am looking forward to more devices getting liberated. 🥳

The #39C3 “To sign or not to sign” (https://gpg.fail) talk is excellent. 👏

IMHO: Avoid PGP altogether, especially #GnuPG. Avoid memory unsafe programming languages, wherever feasible.

It is mind boggling, that the gpg team / g10 Code GmbH refuses to fix all vulnerabilities, given that their @bsi certification and thus their business model being at risk.

Also goes to show, that BSI certifications are worthless. Quel surprise?

J'ai un problème avec #gnupg : ma clef privée reste indéfiniment en cache, phrase de passe comprise, malgré des instructions contraires dans gpg-agent.conf (linux mint 22.2).
Jusqu'à nouvel ordre donc, ma clef privée est enlevée du trousseau et n'est restaurée qu'à la demande.
Suis-je seul dans ce cas?