mikegerwitz

I don't need "modern alternatives" to things that aren't broken. I'm not interested in replacing my one tool with N others when I understand my threat model and understand the benefits of my existing, battle-tested tooling.

The opening paragraph is off-putting:

> Did your last Yubikey just break?

Is this supposed to imply that I'm not supposed to be inconvenienced by my security token breaking? Of course I am. I've lost and misplaced my Nitrokey on numerous occasions, leaving me completely locked out of my systems without physical access. That's a feature, and that's intended.

> Perhaps you forgot an offline backup password.

What does that have to do with PGP?

> Maybe you're just tired of living like a spy and never using smartphones.

That absolutely has nothing to do with PGP.

> Linux distributions and many other software update mechanisms use PGP signatures to prevent malicious mirrors or network attackers from altering the contents of their packages.

GnuPG's use here is hidden from the user by the package manager. Most users have no idea it's using PGP, and don't understand what it is. They work through a package manager's abstractions. If you replaced PGP with something else, the user would likely be none the wiser. Why does it matter? Also, why do I want to abandon a keyring?

For manually verifying signatures: why does the weight of the tool matter? Is `gpgv' (which is probably already installed on your system) really weighing you down that much? Tools like signify emphasize keysize and speed compared to RSA. Do you _really_ notice as a user? Is that _really_ the bottleneck for what you're doing? It might be, but I suspect for your average user, it's not.

> I wrote one as a party trick last month – it's less than 200 lines of code and that includes some silly key parsing tricks.

Are we worried about attack surface? GPG is heavily audited---you're far more likely to be pwned through one of the 100s of other poorly audited programs on your computer. And in any case, I don't care how easy it is to write---leave the crypto to the experts. An easy-to-understand implementation is great and certainly preferred where possible, but that's only part of the battle. And tools like GnuPG already have their implementations written and audited by numerous parties over the years. That doesn't mean they're bug-free, but it's not like we're starting from scratch here.

> Original need: You want to store individual pieces of data without making their contents accessible to anyone else on your system.

I'm not arguing against the use of other programs, but I see nothing wrong with GnuPG (or PGP) for this. Again, it's a widely supported tool that's probably already available on your system, and it probably came with your distribution image, so it probably can also be trusted. Directing users to install programs is a risk in its own unless it can be authenticated through the distribution's package manager---users must understand how to verify the program themselves otherwise.

Using GnuPG also gives you some other benefits for free, like support for a smartcard, even over SSH. (You should generally prefer symmetric algorithms for long-term secrets, but if you know your threat model, or have secrets that are easily changed or don't need to stay secret long term, asymmetric may be a fine choice for you if you gain the benefit of a security token.)

> Original need: You have files that you want to send to another person, but you don't want the data to be visible in transit or stored in the cloud. For this, folks often attach an encrypted ZIP file to an email.

> Modern alternative: magic-wormhole.

This works out great (or a tool like OnionShare) if it actually addresses your problem. But what if I want to encrypt files to N people who may be online at different times, and store that file somewhere? What if I _do_ actually want to communicate over email? I happen to do most of my communication with online communities via email.

PGP does suffer from many legitimate issues, like forward secrecy. Certainly use the right tool for the job. I'm not going to use PGP as an alternative to OMEMO, for example---they're fundamentally different.

Things that certain people see as weaknesses, like logistical issues surrounding the establishment and maintenance of a web of trust, aren't weaknesses to others. I have no problem with people suggesting useful tools for certain tasks. But I'm frustrated by the FUD around PGP, as if it's insufficient for any job. It does work, it is battle-tested, and it is trusted.

PGP is still widely deployed, whether you like it or not. "I don't like it" isn't a valid argument for considering something "legacy", when it works just fine for certain cases.

I'm a father of 7- and 5-year-olds, and I constantly think of this.

I have some anxiety issues and frequently have mild panic attacks, which can have symptoms similar to heart attacks. I have vasovagal responses triggered by odd and benign things. I also have bad muscle tension in my neck and upper back, which can extend around into my chest. And to top it all off, because I have children, I am often sleep deprived and drink too much caffeine. Heart-related issues are on my mind so frequently that I've almost convinced myself that I'm going to die of a heart attack one day, despite me being in good health.

I spend a lot of time worrying, so if I could share my advice with others: if you are worried, just see a doctor. It's not worth being wrong. One day I had symptoms of a heart attack for hours and went to an urgent care facility and got an EKG and x-ray of my heart. They found nothing, and attributed it to musculoskeletal pain. Considering I've been worrying about my heart for many years prior, those tests gave me a strong sense of relief and allowed me to focus on learning how to control my anxiety without getting into a feedback loop (anxiety -> heart attack symptoms -> more anxiety from worry). I can now calm myself down pretty quickly.

This may seem obvious, but getting extra sleep and cutting out caffeine helps immensely with all of the above symptoms. Easier said than done as a parent whose kids don't even sleep through the night. :)

The fact that this comment was flagged is deeply troubling to me.

This is a late reply, but thanks for your input. I'll look into them further. What interests me is your replacing Dovecot + Sieve with your MUA; I'll have to see if I want to do that or not.

I haven't researched Notmuch, but I've heard some interesting things about it. I used to use Mutt back in the day. Whatever I use would have to have Org integration, though.

Tbh, I just haven't researched other things and I haven't had the time. But Gnus does seem to fit well how I organize my mail: I subscribe to a lot of mailing lists, each of which are filtered into their own folders via Sieve scripts, before they touch my MUA. I also organize normal mail similarly.

Most of my communication with various people/communities is done via mail. For those using Emacs:

I use a Kanban (or GTD, depending)-style workflow using Org mode and Gnus. Org mode recognizes `gnus:'-prefixed links. For certain types of mail, I use an Org capture template within Gnus which inserts a TODO item into an Org document, along with a link to the original message (which can be opened in Gnus using C-c C-o).

You can then go through your usual workflow as you would with any other item; mail is just another source of data.

Considering that the task originated via mail, chances are it'll require some back-and-forth, potentially over the course of weeks and perhaps with a handful of people involved. I also keep detailed timestamped logs of correspondence and my actions, linking to important messages as needed. This is particularly useful for large threads, since I highlight the most important information. Since I'm logging via Org mode (and not my MUA), my logs can also include any other additional information and time tracking that has nothing to do with mail, so this creates a useful timeline that combines both actions and correspondence into a single view.

Because this is married with the rest of my Org-based task management, my mail also shows up in my agenda and reporting.

> Note IceCat is not very well maintained.

Its maintainer is working on upgrading to the latest ESR now. If anyone is interested in helping maintain IceCat, please e-mail [email protected].