Hacker News Reader

Comment by nickpsecurity | Hacker News Reader

I got back on GnuPG recently because an associate wouldn't communicate without it. We came up with a trustworthy way to exchange keys. After that, I just cut and pasted crap from this:

http://irtfweb.ifa.hawaii.edu/~lockhart/gpg/

Been working fine so far. I'm sure there's all kinds of complicated ways to use it but it just takes a few commands to do most of the work. I only use two these days: one for sending and one for receiving. I scripted the more complicated one (send) where I type an alias and a text file with it doing the rest. The decrypt command, -d (file), is easy to remember. Pretty simple compared to trying to learn OpenBSD.

Not to say they're wrong for making something easier or the interface couldn't be way better. Just that me using this thing with almost no thought argues against all this difficulty people are bringing up.

View on HN

Are you really confident that cutting and pasting crap from a random web page (particularly one without TLS, so the guy sitting across from you at Starbucks can MITM it) provides you with sufficient understanding to notice when you are accidentally doing something insecure?

I cross-referenced it against the documentation. Let's assume someone won't, though. The commands' appearance make their intent pretty obvious. Further, using them produces output that confirms what the cheat sheet says. For instance, adding a public key said something along the lines of "public key added." Decrypting the incoming message showed its plaintext. Encrypting outgoing plaintext turned it into ciphertext other party decrypted. Along with a warning that the key didn't have others' signatures on it, which ironically re-assured me more because it shouldn't.

So, a visual inspection of the commands and their results in a sandboxed machine was about all one needed to know that they worked. My experience with similar tools helps there. More concerned people can thoroughly cross-reference them with the documentation, source code, program's author, and so on. Whatever level of assurance they like. The basic level, though, was incredibly simple.

I'd take using GPG over learning Emacs or OpenBSD any day. In level of difficulty, that is.

Agree with regard to Emacs, but OpenBSD has some of the best technical documentation I've ever come across. For example, their networking FAQ[0] or (especially) the PF guide[1].

[0] http://www.openbsd.org/faq/faq6.html

[1] http://www.openbsd.org/faq/pf/

Their documentation is great. I won't disagree in the slightest. I also praised them in other places for working as hard on docs as software itself. Docs are lacking in most places. The only point of these comments is that people are way overhyping the difficulty of basic GPG use given I installed it easily using Google and used it by cut n pasting a cheat sheet. Others have too. That's all I'm trying to do here while using things like the overall OpenBSD experience (or Emacs) as points of comparison to support that.

I'd have to use my brain with either OpenBSD stuff or Emacs. Of course, I cheated there too: Absolute OpenBSD. I know I could've used their great docs for everything but the reviews of the book were too good. I had to attempt using it to shortcut the learning process. Lol.

The problem with copying and pasting from a website is not whether you think you know what the command does. It is that copying from a HTML page might contain stuff you can see.

https://thejh.net/misc/website-terminal-copy-paste

s/can/can't

Damn! That was a surprise! Alright, point taken. I'll... have to validate things on terminals a lot more thoroughly in the future. And type my own code by hand based on the documentation. Maybe just make my own cheat-sheets for the cut and paste. Text files.

Reply on news.ycombinator.com