Title: With GPG being a common destination for those concerned by the recent privacy revelations, it bothers me a little that I can&#x27;t find any audit or security review of GPG&#x27;s codebase.<p>The Wikipedia page says that a German IT ministry funded a windows port, the EU Agency for Network and Information Security list GPG as part of their index of tools and claim it&#x27;s in use by some related parties [0] but don&#x27;t go so far as to recommend it. Considering that several governments within the EU are allegedly complicit in the SIGINT scandal, I don&#x27;t think their word counts for much.<p>GPG is open source, but while the code is readily available the knowledge and background to determine its security is somewhat rarer. Would you be willing to contribute to a project to fund a public audit of the codebase? If so, what sort of people would you like to see participate.<p>[0] http:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;activities&#x2F;cert&#x2F;support&#x2F;chiht&#x2F;tools&#x2F;gnupg-the-gnu-privacy-guard
Upvote: