Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Feed Techdirt: The World's Email Encryption Software Relies On One Guy, Who Is Going Broke (google.com)

The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive.

Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded.

"I'm too idealistic," he told me in an interview at a hacker convention in Germany in December. "In early 2013 I was really about to give it all up and take a straight job." But then the Snowden news broke, and "I realized this was not the time to cancel."

Like many people who build security software, Koch believes that offering the underlying software code for free is the best way to demonstrate that there are no hidden backdoors in it giving access to spy agencies or others. However, this means that many important computer security tools are built and maintained by volunteers.

Now, more than a year after Snowden's revelations, Koch is still struggling to raise enough money to pay himself and to fulfill his dream of hiring a full-time programmer. He says he's made about $25,000 per year since 2001 — a fraction of what he could earn in private industry. In December, he launched a fundraising campaign that has garnered about $43,000 to date — far short of his goal of $137,000 — which would allow him to pay himself a decent salary and hire a full-time developer.

The fact that so much of the Internet's security software is underfunded is becoming increasingly problematic. Last year, in the wake of the Heartbleed bug, I wrote that while the U.S. spends more than $50 billion per year on spying and intelligence, pennies go to Internet security. The bug revealed that an encryption program used by everybody from Amazon to Twitter was maintained by just four programmers, only one of whom called it his full-time job. A group of tech companies stepped in to fund it.

Koch's code powers most of the popular email encryption programs GPGTools, Enigmail, and GPG4Win. "If there is one nightmare that we fear, then it's the fact that Werner Koch is no longer available," said Enigmail developer Nicolai Josuttis. "It's a shame that he is alone and that he has such a bad financial situation."

The programs are also underfunded. Enigmail is maintained by two developers in their spare time. Both have other full-time jobs. Enigmail's lead developer, Patrick Brunschwig, told me that Enigmail receives about $1,000 a year in donations — just enough to keep the website online.

GPGTools, which allows users to encrypt email from Apple Mail, announced in October that it would start charging users a small fee. The other popular program, GPG4Win, is run by Koch himself.

Email encryption first became available to the public in 1991, when Phil Zimmermann released a free program called Pretty Good Privacy, or PGP, on the Internet. Prior to that, powerful computer-enabled encryption was only available to the government and large companies that could pay licensing fees. The U.S. government subsequently investigated Zimmermann for violating arms trafficking laws because high-powered encryption was subject to export restrictions.

In 1997, Koch attended a talk by free software evangelist Richard Stallman, who was visiting Germany. Stallman urged the crowd to write their own version of PGP. "We can't export it, but if you write it, we can import it," he said.

Inspired, Koch decided to try. "I figured I can do it," he recalled. He had some time between consulting projects. Within a few months, he released an initial version of the software he called Gnu Privacy Guard, a play on PGP and an homage to Stallman's free Gnu operating system.

Koch's software was a hit even though it only ran on the Unix operating system. It was free, the underlying software code was open for developers to inspect and improve, and it wasn't subject to U.S. export restrictions.

Koch continued to work on GPG in between consulting projects until 1999, when the German government gave him a grant to make GPG compatible with the Microsoft Windows operating system. The money allowed him to hire a programmer to maintain the software while also building the Windows version, which became GPG4Win. This remains the primary free encryption program for Windows machines.

In 2005, Koch won another contract from the German government to support the development of another email encryption method. But in 2010, the funding ran out.

For almost two years, Koch continued to pay his programmer in the hope that he could find more funding. "But nothing came," Koch recalled. So, in August 2012, he had to let the programmer go. By summer 2013, Koch was himself ready to quit.

But after the Snowden news broke, Koch decided to launch a fundraising campaign. He set up an appeal at a crowdsourcing website, made t-shirts and stickers to give to donors, and advertised it on his website. In the end, he earned just $21,000.

The campaign gave Koch, who has an 8-year-old daughter and a wife who isn't working, some breathing room. But when I asked him what he will do when the current batch of money runs out, he shrugged and said he prefers not to think about it. "I'm very glad that there is money for the next three months," Koch said. "Really I am better at programming than this business stuff."

Related stories: For more coverage, read our previous reporting on the Heartbleed bug, how to encrypt what you can and a ranking of the best encryption tools.

Republished from ProPublica. ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter .



Permalink | Comments | Email This Story








User Journal

Journal Journal: I logged in. 2

I was doing some research for a project and happened back here. Hello slashdot.

Find me on Twitter, or put dot com after my user name.

Submission + - 'Star Wars: Episode VII' has a title: 'The Force Awakens' (ew.com)

schwit1 writes: If you feel a disturbance in the Force, it’s millions of voices suddenly crying out the new title of Star Wars: Episode VII — The Force Awakens. The reveal comes as the movie finishes its final day of shooting (with many more months of post-production to come.)

Although there were still a few days left of shooting, the cast of the J.J. Abrams film already celebrated their wrap party last weekend, following a bumpy few months of principal photography thrown into crisis when Han Solo himself, Harrison Ford, broke his leg on set in an accident involving a falling door on the Millennium Falcon.

Comment Re:Not where *I* work. (Score 1) 342

We can't change the fact that we work with machines. However, we can change the fact that we work alone. Make programming more social by adding pair programming at all levels, including academia, and you'll get more women willing to join and stay. You'll also get the rest of the benefits which come along with pair programming such as fewer bugs and higher quality code.

Comment Re:Not where *I* work. (Score 1) 342

Indeed. I find it more than coincidence that the majority of women stay away from fields where they need to work alone with machines. IT, auto mechanics, construction, and engineering are all male-dominated fields. Why? Sexism? Yes, some fields are more sexist than others. However, medicine and law were also extremely sexist in the recent past. And yet, we have tons of women doctors and lawyers. The main difference I see with those fields is that doctors and lawyers actually work with other people. The work is often group work. Frankly, it appears that most women simply don't like IT work once they get a chance to perform it in the industry. If they truly loved the work, I'm sure we'd see many more women rushing to come into tech and stick around.

This brings to mind an interesting solution. You want to see more women in tech? Then make tech work more social. We already have an answer to that: Pair programming.

Comment Re:No rage over roofers, drillers, and boilermaker (Score 2) 342

Why are companies pushing women into IT? Simple. Follow the money. If companies could find a way to make IT interesting for women, then they could double their workforce. Doubling the supply of workers for the same number of jobs means that companies could cut salaries in half. Cutting salaries means increasing profits and bonuses for executives. That's the real motivation, not some altruistic concern over womens' rights or equality.

Comment Re:Bullshit. (Score 1) 342

You'll have to look beyond school. What is media telling men and women about IT?

Not many third graders pay attention to "the media". Why didn't the media keep women from becoming doctors, lawyers, police officers, and soldiers? Why is it ONLY with professions that involve solitary interaction with inanimate machines, that women suddenly turn into delicate snowflakes and collapse in the face of the slightest, almost undetectable, pressure from "the media"?

Exactly. Why are auto mechanics overwhelmingly male? It's the same damn reason. Most women aren't interested in working alone with machines. If women were interested in this work, then they'd already be doing this work.

Whenever I see articles like this, I keep getting the feeling that we're trying to hammer square pegs into round holes. Then we sit and wonder why we see a problem.

Comment Re:Bullshit. (Score 1) 342

But why is it really frustrating?

Because I want to see flying cars, robotic maids, and real AI, in my lifetime. The chance of that happening is a lot lower if we waste half of humanity's brain power. If there is something we can do to get more girls interested in science and tech, then we should at least try to do it.

Sorry, if end goal is to turn out engineers, then I don't see the logic in pushing uninterested girls to become interested when we're turning away boys who are already interested. From my experience, the kids that do best in any field are the ones most interested in that field. If you really want to see all those technological marvels, then we should be focusing effort on the kids with the interest, motivation, and drive to learn the topic. Let's focus on the kids who are interested regardless of their gender.

User Journal

Journal Journal: [Beloved] It Is Not a Word 2

It is not a word spoken,
Few words are said;
Nor even a look of the eyes
Nor a bend of the head,

But only a hush of the heart
That has too much to keep,
Only memories waking
That sleep so light a sleep.

-- Sara Teasdale

Comment Re:Who is stopping him? (Score 1) 372

GP poster is just trolling, with his "Eclipse, like all free IDE's, sucks" comment. You don't notice him mentioning his own environment.

The only other strong suggestion he can make is Android Studio, which instead of bundling Android SDK with Eclipse it bundles Android SDK with IDEA. Which would be fine, if it wasn't languishing in bug reports of its own, new major releases every week, breaking due to Gradle configurations that cause hair-pulling (what the fuck is Gradle and what was wrong with Ant and Maven for dependency management), etc etc. And forget trying to migrate from Eclipse with the SDK over to Android Studio. For God's sake, even when Google I/O was going on, the current builds of Android Studio on offer still didn't work any better than the Eclipse SDK. Life apparently is no better in the Mac world but I don't have experience there.

Don't get me wrong, I love Android, I have 3 Android devices, I'm interested in developing Android apps personally. I'm not knocking Java, I use it. I'm not knocking existing IDEs, I use them. What I'm knocking is the constant moving target status of Android where things change so fucking quickly their own devs can't even keep up with their own IDE bundles or their own documentation. As a potential Android developer, everything I run into is a turnoff. Look at the project and look at all the open issues with the IDE tools and the SDK (forget API and device bugs, those are all to be expected, I'm talking serious problems with the developer tools only). I don't have time to deal with that shit for fun.

Comment Re:Who is stopping him? (Score 5, Insightful) 372

Let's say you're a competent Java developer and you'd like to build an Android app. I wish you the best of luck!

First you're going to need to pick an IDE. I've always used Eclipse and hey look, there's an Android SDK for Eclipse. Perfect! Download, extract, fire it up... Errors. This version of Android SDK requires Android API version foo, you have version (foo - 9), please use the SDK manager to upgrade. The hell, the IDE bundle doesn't even launch out of the box?

Alright, so you're distributing your IDE with an outdated version of your API, I can forgive that. Run SDK Manager like it suggested, let it do its thing,. Update available for SDK tools and SDK platform tools, looks good, do it! ...And, errors. Package not found, blah blah, let's see what Google has to say about this one.

OK, apparently hundreds of other developers are having the same problem and have, after much wrangling, figured out a solution on their own. I see, I have to go into SDK Manager Settings, create a new User-Defined Add-On Site pointing to https://dl-ssl.google.com/andr... because the URL that ships with the IDE is missing the "s" in "https" and that server doesn't have the right packages available to download. That highly intuitive process would surely have been my first try anyway, but at least someone else found the fix.

SDK Manager seems to find the packages now, great! Got past that hurdle so let's do the upgrade. Wait, now what! What do you mean you can't upgrade to SDK Tools rev. 23 while SDK Platform Tools 19.0.2 is installed? I checked the boxes to upgrade them both; if Platform Tools has to hit rev. 20 before SDK Tools can be upgraded, why is the installer going in the wrong order?

If and when you finally get the actual goddamned IDE installed and working, have fun with the official developer tutorials to create your first "Hello World" app. See, the API has changed over the years^Wmonth^Wpast week and so the app architecture that the tutorial talks about isn't valid anymore. XML files that it says should be there, aren't, so there's no way to follow along in the tutorial by editing them.

I gave up on Android and won't touch it again unless I'm being paid to.

Comment Re:Free market economy (Score 5, Insightful) 529

We didn't just build industry. We built the freeway system. We built the space program. We rebuilt our military to defend the world against the Russians. That was all government spending. And yes, our top tax rate was 91%. Millionaires still made buckets of money. But, they paid their taxes and shit got done.

Then, Reagan came into office and lowered that top rate. All of a sudden, the government deficits started going up and work didn't get done. Millionaires started using their new buckets of money for speculation. Now, we're in a recession as a result of Wall Street speculation and we can't fix a fucking pothole let alone pave a single new freeway.

Slashdot Top Deals

Stellar rays prove fibbing never pays. Embezzlement is another matter.

Working...