Re: [openpgp] Backwards compatibility vs streaming verification of v6 clearsigned messages

[iang <[e-mail]>]

lol...

jokes aside, cleartext signing was useful back in the old days - PGP was 
mostly used for email, and email didn't have binary or attachment 
capabilities until "much later".

Sometime in the early 2000s this question came up, and I was the only 
strong defender of cleartext signing which was used for a thing called 
Ricardian contracts.  There didn't seem to be too many other fans or 
users at the time.

But, since then, around 2011, I abandoned OpenPGP bc maintaining it was 
just too hard, and did my own stack for Ricardians and all the other 
stuff.  Never looked back, maintaining own stack is like a fifth of the 
work and arguably more secure bc so much more focus and tightness and 
clear lines of responsibility.

Point being, why not ask who's using it?  If nobody, then maybe it can 
be deprecated in new forms?

iang

On 24/05/2023 21:10, Andrew Gallagher wrote:

> On 24 May 2023, at 14:36, Andrew Gallagher 
> <andrewg=[e-mail]> wrote:
>>
>> I’d suggest that the reason CSF is popular is because it allows 
>> people to bypass cryptographic verification by eyeballing the source 
>> format,
>
> And of course there’s an XKCD for that: 
> https://imgs.xkcd.com/comics/pgp.pngimage
>
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp