Ask HN: In Emacs, is there an alternative to GPG encryption in Org Mode? It's GPG is starting to show it's age, Debian abandoning it for signing packages and it's general lack of usage. Was wondering how one could probably use https://github.com/FiloSottile/age or something. (Not an emacs pro, so sure don't know some of the trivial ways to use this) |
Also, keep in mind that HN is actually fairly similar a forum, and with that in mind, it’s very reasonable to point them into the direction of Reddit.
This is not true. There was a proposal near the start of the year. That proposal has been almost entirely ignored.
Would age provide any advantage over GnuPG to make it worth the bother to switch to a new message format?
I don't want to reopen a can of worms on that very weird age vs. PGP thing you wrote (Debian isn't going to use age) but again, I think you should correct it, because it openly advocates for malleable unauthenticated encryption, which beclowns the rest of the points it tries to make. If you want to recover from single (or multiple) bit errors in your ciphertext, you don't relax authentication of your ciphertext; you forward-error-correct it.
If you are doing FEC then you need to decide how many bits you are going to be able to correct. That determines the amount of redundancy you need. Media problems generally come in physical media sized chunks, often adjacent. Hundreds, thousands or millions of bits might be involved. FEC is not a magic bullet for data loss, particularly in this case. Usually the best you can do is to recover the good parts and age deliberately prevents you from doing that.
'age' is still quite beta, so not sure if it's entirely worth the switch. But yeah I guess the long-term archival is something that I hope to have.
Probably you would get better answers about Emacs on https://emacs.stackexchange.com/ or https://www.reddit.com/r/emacs/ .
It lets you encrypt/decrypt files or regions of a text file and is pretty easy to use.
EasyPG is very mature in Emacs, makes using GPG a breeze and is integrated really well. Age doesn't even support signing and has no Emacs integration.
I’m aware of the wiki article but that’s not any official position. In the very least anyone can edit that wiki.
Or just tick on the full disk encryption option in your OS (assuming it's a modern one like Win 10, recent Ubuntu, etc.). It's just as good at keeping your data protected at rest as any other encryption option you can run in userspace, and there's less chance of some file operation snafu accidentally unencrypting or leaking your data.
Because in this case you have to backup the whole encrypted disk, instead of syncing a couple of encrypted files. Also, setting up gpg in Emacs is very easy task. I am using selective encryption of orgmode entries with a specific tag, this case is covered in documentation.
If you need to worry about that kind of thing then you need some kind of workload isolation. One way to solve that is Qubes OS.
Here are some other FOSS alternatives: https://fly.io/blog/sandboxing-and-workload-isolation/
To get this you have to sacrifice the convenience of using gpg-agent, though, right? Otherwise any other program that can open your gpg agent socket can use your gpg keys.
has tooling on pretty much every platform,
is a mature, well-established product.
The complicated features are optional.
Using something like age, with one reference implementation in Go, not supported by most languages, nor time-tested, is just asking for trouble, like surprise exploits or bitrot making your data unusable.
I am perplexed by the frequency of "PGP/GPG is old, let's replace it with something new and untested" posts on HN...
In software development, OLD is GOOD.
(As a side note, I don't think Debian has been at the forefront of rational decisionmaking for a while, so I wouldn't watch them too closely.)
For those you are new to IRC and want to take a quick glance at the channel without choosing clients and configuring them, here is a web-based interface to connect to the #emacs channel:https://web.libera.chat/#emacs
Here is the Matrix bridge for it accessible via Element's web interface: https://app.element.io/#/room/#emacs:libera.chat . The Matrix bridge could be useful for those who want their nick to stay connected to the channel even after closing the browser without having to set up an IRC bouncer for themselves.
I doubt this will happen any time soon.
I think you should probably dig into the age code before writing posts about why PGP is better than age. The question of whether adversaries can modify age messages in transit is a pretty basic one.