[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6F979157-91AD-4C55-8CCD-5CC5AA18BB50.1@smtp-inbound1.duck.com>
Date: Mon, 29 Dec 2025 00:21:16 -0500
From: kf503bla@...k.com
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Best practices for signature verifcation
then what do you suggest to use? i hear it all the time "pgp sucks" but what's the alternative huh?
>
> In light of the recent GnuPG vulnerabilities, I remembered that OpenPGP
> is almost never the right choice. CMS/PKCS#7 isn't any better, and
> X.509 is also bad except that its extremely wide deployment in TLS
> keeps it alive.
>
> See https://www.latacora/com/blog/2019/07/16/the-pgp-problem/
>
> and https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/.
>
> --
> Sincerely,
> Demi Marie Obenour (she/her/hers)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
