Is there another thing to use? At least for the flow(s) of “encrypt, transfer, decrypt” or “sign, transfer, verify” for binary files. BSD licensed, preferably.
EDIT: minisign was mentioned on the talk… not in the most positive way but would still trust (after they get their shit together of course); however would never trust “age” with what they did
(I actually managed to watch basically the same talk at a different event on the site pgp.fail, whoops)
For me, I feel like the mistake mentioned was the most dead obvious one. Prefixing a plugin name from the file with a path then literally running the executable named. At the end of the talk, an age dev bought the researchers with stickers on camera.
Is there another thing to use? At least for the flow(s) of “encrypt, transfer, decrypt” or “sign, transfer, verify” for binary files. BSD licensed, preferably.
EDIT: minisign was mentioned on the talk… not in the most positive way but would still trust (after they get their shit together of course); however would never trust “age” with what they did
What happened with
age(or its devs?) that made you not trust it?(I actually managed to watch basically the same talk at a different event on the site pgp.fail, whoops)
For me, I feel like the mistake mentioned was the most dead obvious one. Prefixing a plugin name from the file with a path then literally running the executable named. At the end of the talk, an
agedev bought the researchers with stickers on camera.