Faramir wrote: > Well, you have always said any algo in GPG is safe enough to use...
First, I've said the algorithms are safe enough to use. I've never said GnuPG's implementation of them is correct and error-free. There's a _big_ difference between saying "3DES is a trusted algorithm" and saying "GnuPG correctly implements 3DES." I think GnuPG's implementations are probably good; I don't have any evidence to suggest they're not. But I can't say they're good. Second, please don't trust a word I say. Seriously. I make a ton of mistakes every single day. I might be making one right now. Do your own research, find out facts for yourself. > Well, if you have land under the plane, your point of view can be > different... Yes. Please note that I'm not saying either of them made a right or wrong choice. They each came to the table with certain basic assumptions and came to very different conclusions. David and I disagree pretty substantially on the subject of the size of the OpenPGP spec, and how much of it GnuPG should be implementing. I think both he and I are being sensible. We're just coming to very different conclusions. In the world of Free Software, he who writes the code gets to make the decisions. For GnuPG, that means David and Werner. I don't begrudge them that one bit. It's their barbecue, and on the whole the barbecue is good. I don't want anyone to mistake me on this. My quibbles are not with GnuPG. My quibbles are with the OpenPGP spec. I think GnuPG is the best implementation of OpenPGP out there right now. _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
