The PGP Problem
First, thanks enormously for writing this -- and for all the other recent articles that have appeared here the vein of &quot;PGP is as bad as it is unpleasant to use&quot;. It&#x27;s a point I didn&#x27;t really appreciate (at least as much as I (sh&#x2F;c)ould have) and I&#x27;m sure I&#x27;m not alone.<p>It seems that the state of package distribution for many distributions is poor, security-wise. (OpenBSD, to nobody&#x27;s surprise, is an exception.) For instance, archlinux (I&#x27;m loyal) signs packages with PGP[1] and, for source-built packages, encourages integrity checks with MD5. My recollection is that, about 5 years ago, MD5 was supposed to be replaced with SHAxxx. Am I misinterpreting this? Is this actually Perfectly Okay for what a distro is trying to accomplish with package distribution?<p>(I&#x27;m particularly suspicious of the source-built package system, which consists of a bunch of files saying &quot;download this tarball and compiler. MD5 of the tarball should be xyz.&quot; I&#x27;m pretty confident that&#x27;s not okay.)<p>Okay, now moving from package distribution to messaging, and again looking at the state of my favorite system. How am I supposed to message securely? The best nix messaging tools are all based around email. Even when I can get the PGP or S&#x2F;MIME or whatever toolset to work (let&#x27;s face it, that&#x27;s at least 45 minutes down the drain), it&#x27;s clear that I&#x27;m not in good shape security-wise.<p>I should use signal, apparently. Great. Just a few problems: (1) no archlinux signal package, (2) I&#x27;m guessing I can&#x27;t use it from the terminal, and (3) most severely, it seems signal has incomplete desktop support. In particular, I need to first set up signal on my phone. Well, let&#x27;s face facts: I have a cheap phone from a hard-to-trust hardware vendor, and I think there&#x27;s a &gt;5% chance it&#x27;s running some sort of spyware. (The last phone I had genuinely <i>did</i> have malware: there were ads showing in the file manager, among other bizarre behaviors.) So in order to use signal on my desktop, I need to buy a new phone? That&#x27;s even worse, usability-wise, than PGP.<p>Is... is it really this bad? I&#x27;m getting the sense that the desktop linux community has completely dropped the ball on this one. (And perhaps more generally desktop mac&#x2F;windows... I wouldn&#x27;t know.)<p>[1] Perhaps not so bad, since the keyring is distributed with the system -- but how was the original download verified? Options are: PGP, MD5, SHA1, with the choice left up to the user. That can&#x27;t be right.