David Runge

@mttaggart@infosec.exchange Antonio Rojas is a member of Arch Linux and a year-long package maintainer of the distribution (e.g. for all of KDE). Antonio often drops larger amounts of packages to the AUR and therefore is the last committer. The bot infecting packages in the AUR impersonated/reused the last committer. It's trivial to do with git. I know this is not directly obvious, but please correct previous statements about this (also made elsewhere). 🙏

Meanwhile another person next to me dumped internal corporate letters with PII of colleagues as docx into ChatGPT for some rephrasing. GDPR in German HR is going great! 👌 #Train #DeutscheBahn #ICE371

@delta@chaos.social but, most importantly, does the cat have its own chatmail profile? 😻 😜 Joke aside, a lot of nice features now widely available!

Everything gets even more wild once you notice that upstream itself appears to flag the package out of date and is trying to upsell the new features. Apart from the incompatibility madness: Without the #FreePG patches, there no longer would be #systemd support (which we require!) in 2.5, because upstream removed it (what seems to me, out of spite).

@r10s@mastodon.social @delta@chaos.social hot damn!

@kushal@toots.dgplug.org man, this sucks. I'm sorry 💜

@maklem the general direction of Stateless OpenPGP (https://wiki.archlinux.org/title/Stateless_OpenPGP) might also be of interest to you. And https://codeberg.org/heiko/rsop/ in particular, as rsop-oct offers OpenPGP card support.

@maklem FWIW, email may strongly depend on your preferred mail client and interface. Beyond Thunderbird (which still only offers integration with gpg when it comes to card support), I know that there are other, new clients on the horizon (e.g. chithi), but no idea about timelines. There are also TUI/CLI clients (e.g. himalaya), but so far without card support. Suffice to say: People are fed up enough to look into alternatives

@gregsie @freepg it's indeed a mess and quite terrible for other implementers and all users of OpenPGP. I agree about the somewhat ambiguous term "proprietary" in this context. It is not meant as "proprietary software" (antonym of "free software"), but as "owned solely by GnuPG" (see e.g. 2 in https://www.collinsdictionary.com/dictionary/english/proprietary) Maybe you have an improvement suggestion for a spec/a set of features "developed by a single person without effective oversight or a genuine desire to collaborate"?

@serebit well, not necessarily. We luckily have options for #OpenPGP outside of #GnuPG 😅

@Foxboron @csolisr @archlinux Basically what Morten wrote above. Whether and to what extend Valve uses what we do is out of our hands. Generally speaking, we do hope to create broadly reusable code (as always) though. More details about the (work on the) signing service can be gotten via the following link: https://chaos.social/@dvzrv/113204676874021796

@netzpolitik_feed@chaos.social wie die Zeit vergeht! 😮 Alles gute beim Finden weiterer Knöpfe zum Drücken @markus_netzpolitik@chaos.social!

@csolisr @archlinux no, but it conflicts and replaces redis. Functionality in both projects will drift over time and I guess there is no real use in a provides.

@pitastrudl@chaos.social omg 🫠

@randahl@mastodon.social time for "Lessons of Darkness" (again) 🫠😩 https://imdb.com/title/tt0104706/