Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Brad Knowles
On Jun 15, 2018, at 10:26 AM, Mark Gardner wrote: > ​​I'm cool with Python. When I am not programming in Go, I am programming in > Python. It seems to be installed by default on all the Linux systems lately. > I am no longer so fond of perl, which is strange to say as I have done some >

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Steve Gilberd
I feel the same - the simplicity of it, and the ability for me to easily audit the source code, are significant reasons for my choosing *pass* as my password manager. I feel quite strongly that it should remain both simple / small, and ideally still written in bash. No objections to a rewrite to

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Tobias Girstmair
On Fri, Jun 15, 2018 at 08:57:57AM +0300, Matthieu Weber wrote: > It is very difficult to write correct programs in C, and very easy to > write C programs with security holes in it. Since the topic here is > security, I would advise against C. Go, Rust, Java even, or scripting > languages such as

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Steve Gilberd
On Sat, 16 Jun 2018 at 01:36 Ben Oliver wrote: > I don't think that 'simple' necessarily means bash. It doesn't - 'simple' and 'written in bash' were two separate points. I was endorsing bash, because: (a) bash is something I already know and can easily audit; and (b) bash has no concept of

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Nick Klauer
I just want to point out that there already exists a pass-compatible version written in go: https://github.com/gopasspw/gopass I use it, and it would just fine for my purposes. On Fri, Jun 15, 2018 at 10:28 Mark Gardner wrote: > On Fri, Jun 15, 2018 at 8:13 AM, Tobias Girstmair > wrote: > >>

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Ben Oliver
On 18-06-16 01:53:52, Steve Gilberd wrote: One other thought regarding the choice of language. I personally keep a copy of pass stored *inside my pass git repository*, so that I can still easily use it on systems where pass is not installed without adding too many extra steps. Bash is

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Steve Gilberd
One other thought regarding the choice of language. I personally keep a copy of pass stored *inside my pass git repository*, so that I can still easily use it on systems where pass is not installed without adding too many extra steps. Bash is everywhere, which makes it extremely portable. It's

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Ben Oliver
On 18-06-16 01:11:51, Steve Gilberd wrote: I feel the same - the simplicity of it, and the ability for me to easily audit the source code, are significant reasons for my choosing *pass* as my password manager. I feel quite strongly that it should remain both simple / small, and ideally still

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Kevin Lyda
Close to what I do - I keep a copy in my vcsh home repo. Kevin On Fri, Jun 15, 2018 at 2:55 PM Steve Gilberd wrote: > One other thought regarding the choice of language. I personally keep a > copy of pass stored *inside my pass git repository*, so that I can still > easily use it on systems

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Mark Gardner
On Fri, Jun 15, 2018 at 8:13 AM, Tobias Girstmair wrote: > I should've probably phrased that very differently. What I meant to say > was I'd support a pass 2.0 written in a language that is an integral > part of the GNU/Linux/BSD/etc ecosystem[1]. A scripting language like > Python or Perl[2]

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Héctor Rivas Gándara
> what initially drew people to pass over other (perhaps more conventional database-backed) solutions In my case, this: $ gpg -d < ~/.password-store/test/hello.gpg ;) -- Héctor Rivas On Fri, Jun 15, 2018 at 8:32 AM, Ben Oliver wrote: > On 18-06-15 09:16:27, Volkan Yazıcı wrote: > >> I see

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Sebastian Reuße
Tobias Girstmair writes: > On Thu, Jun 14, 2018 at 05:09:35PM +0200, Jason A. Donenfeld wrote: >> Our recommendations for authenticity and integrity continue to be to >> enable git commit signing, which pass has built-in support for. > Maybe this should be mentioned/explained on

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Ben Oliver
On 18-06-15 09:16:27, Volkan Yazıcı wrote: I see the point of replacing bash with another programming language, that being said, I feel the urge to say something about this without falling into the trap of ranting about programming languages. One of the key points of pass that was really the

Re: Security Vulnerability: Faulty GPG Signature Checking

2018-06-15 Thread Volkan Yazıcı
I see the point of replacing bash with another programming language, that being said, I feel the urge to say something about this without falling into the trap of ranting about programming languages. One of the key points of pass that was really the selling point for me was, apart from perfectly