GnuPG

“neither gnupg nor openssl could determine what mode and keysettings the sender had used”

“Using two independent implementations (OpenPGP.js on the client, GnuPG on the server) is a nice bonus.”

“the GPG signing just operates on the top level object in the commit and trusts the SHA-1 hashes contained in it”

“Once you force people to do it, it is not terrible once they get the hang of it.”

“key management is a massive hassle for nontechnical users”

“GnuPG abandoned the global standardization processes and in doing so forced an expensive migration to successors”

“GnuPG is admittedly garbage, but also that has not been a valid implementation of PGP specifications”

“GnuPG 2.2 is certified by the German Federal Office for Information Security (BSI)”

“GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing.”

“is quietly protecting basically all serious encrypted communication on the planet”

“GPG signing is useful exactly because it doesn't rely on a central PKI”

“GnuPG no longer conforms to modern OpenPGP standards and is the IE6 grade implementation that we should stop talking about and using”

“I would prefer GnuPG for the availability and compatibility reasons”

“I have never heard of a real world exploit that has actually been used like that against gpg.”

“OpenPGP/GnuPG is more resilient and versatile than those, still usable where those are not.”

“as long as there's not (audited and verified) replacements for each niche, we still have to use it.”

“gpg has the advantage that there is no money in it”

“the problems with pgp/gpg are esoteric and abstract that unless I'm personally are worried about a targeted attack against me, they are fine-ish”

“there are reasons why people still use it, and are actually OK with the flaws described”

“it tries to work around MITM attacks by encouraging users to place their social network on the public record”

“GnuPG has keyrings, and it really wants to use them and to find them in some home directory.”

“GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish"”

“Using my Yubikey for signing (e.g. for git) has a better UX with PGP instead of SSH”

“GnuPG has a lot of more features than signing and file encryption.”

“that argument seems to be used to justify having it behave the same way it always has, which leads to dangerous situations”

“The keyring circus (which is how GPG most commonly intrudes into my life) is crazy too.”

“GPG's position was: they print, in those circumstances, an error of some sort , and that's enough.”

“GPG should probably do more to protect users from shooting themselves in the foot”

“PGP/GPG are of course hamstrung by their own decision to be a Swiss Army knife/only loosely coupled to the secure operation itself”

“And Snowden used gpg and I haven't heard of a single message of his having been decrypted.”

“has worked well for me for nearly three decades”

“because I control the key, not some application or company that embeds encryption into their product”

“I want to be damn sure it goes to a PGP key held on smartcards that decrypt reports on airgapped operating systems”

“I would not recommend generating keys with GnuPG today any more than I would recommend using Internet Explorer.”

“PGP is the only standardized cryptographic online identity layer we have”

“It's truly a shame that hardly any applications leverage the powerful cryptography afforded by GPG.”

“GPG works great if you use it to encrypt and decrypt emails manually as the authors intended.”

“we do know that GnuPG worked for the highest profile case imaginable”

“GnuPG has protected Snowden and he speaks positively of it.”

“a C codebase with nearly no tests, no CI pipeline(!!), an architecture that is basically a statemachine with side effects”