Re: gpgme replacement

[Carlos Morgado <chbm chbm nu>]

On 2003.03.27 02:35:57 +0000 Jacob Perkins wrote:
> Hi,
> I am the lead developer of seahorse and am currently considering the
> idea of a library for integrating gpg support into gnome apps.  This
> could replace balsa's gpgme dependence and make developer's lives much
> easier by providing API consistency, common components, and easy to use
> operations.
> 

Hi,
there are plans to move to GMime on the next balsa devel cycle. Among
other things, gmime provides the gpg interface relevant for a MUA, so
the 2.0 dependency on gpgme is 'temporary'. (there was a discussion about
this some time ago on the list)
Using Gmime without using it's own gpg support seems dificult to me.

GMime uses the sucky direct execution method like all other gpg api libs,
that must be address at GnuPG level :\ Until GnuPG provides a good
programatic interface all gpg api libs are equaly bad to me ;) gpgme
has the relative advantage of being coupled to gnupg.

As for Albrecht's concerns about security and passphrases, i tried
to address that problem a couple of years ago (resulting in one of my
stillborns, Zurich). My conclusion after a few discussions was all bets
are off against root. There isn't a lot of point in trying to be extra
paranoid in protecting against local attacks from root (overwriting
sensitive data = good - even from a buffer overrun exploit PoV) as
there's always subtle and less subtle ways you can't protect against.

-- 
Carlos Morgado - chbm(at)chbm(dot)nu - http://chbm.nu/ -- gpgkey: 0x1FC57F0A
http://wwwkeys.pgp.net/ FP:0A27 35D3 C448 3641 0573 6876 2A37 4BB2 1FC5 7F0A
Software is like sex; it's better when it's free. - Linus Torvalds