1. 29

    1. 3

      That’s a great Twitter thread.

      I hadn’t seen the concept “distant state invariants” before, though it seems like a very useful concept!

      1. 3

        Yes, “distant state invariants” is indeed useful - although I tend to call it “locally correct code” (i.e. code which isn’t only correct, but where you can convince yourself it’s correct by just looking at the surrounding lines. Such code is much less likely to break under maintenance.)

    2. 4

      I am frightened by the behavior and development style of (some) principal gnupg/libbcrypt developers:

      1. The fix release 1.9.1 apparently did not build on x86: https://twitter.com/FiloSottile/status/1355153432081031171
      2. Feature requests to use ASAN are closed: https://twitter.com/FiloSottile/status/1355194247482384392
      3. It appears that even a basic CI is missing, leave alone CI runs with sanitizers and static code analysis (e.g. Facebooks infer)

      I really like to switch away from gpg as fast as possible. Luckily there are already some alternatives, like https://sequoia-pgp.org/, emerging.

      1. 1

        I would also look at age: https://github.com/FiloSottile/age

        1. 2

          This does not seem to be OpenPGP based, which rules it out as gpg replacement.