> But I was discussing it with some techies once and someone mentioned to me that it had less entropy (I think they mentioned 256 bits of entropy) whereas they wanted 512 bits of entropy which pgp supported

> I can be wrong about what exactly they talked about since it was long time ago so pardon me if thats the case, but are there any "issues" that you know about in age?

Entropy bikeshedding is very popular for PGP / GnuPG enthusiasts, but it's silly.

age uses X25519, HKDF-SHA256, ChaCha20, and Poly1305. Soon it will also use ML-KEM-768 (post-quantum crypto!). This is all very secure crypto. If a quantum computer turns out to be infeasible to build on Earth, I predict none of these algorithms will be broken in our lifetime.

PGP supports RSA. That's enough reason to avoid it.

https://blog.trailofbits.com/2019/07/08/fuck-rsa/

If you want more reasons:

https://www.latacora.com/blog/2019/07/16/the-pgp-problem/

> PGP supports RSA. That's enough reason to avoid it.

I hate to break the narrative but age also supports RSA, for SSH compat:

https://man.archlinux.org/man/age.1#SSH_keys

That's only because SSH supports RSA. Mainstream usage of age with age public keys only supports X25519.

Eh. You don't really get to do this sleight of hand. If you're gonna rag on RSA support as a shibboleth for bad design, it's bad for GPG and bad for age. If it's direct evidence of bad design, age shouldn't have permitted it via their SSH key support.

I agree in principle, but I'm not looking at "what SSH dragged in". I'm looking at age as a pure isolated thing, according to the spec: https://github.com/C2SP/C2SP/blob/main/age.md

This transparency keyserver actually gives us an excellent opportunity to measure how many people use Curve25519 vs RSA, even with SSH support.

We should contrast this with actively valid public keys on a PGP keyserver in 2026 and see which uses modern crypto more. The results probably won't be surprising ;)

Those goalposts are really agile.

We've moved from "PGP supports RSA. That's enough reason to avoid it." to "We should contrast this with actively valid public keys on a PGP keyserver in 2026 and see which uses modern crypto more".

We aren't having the same discussion in both places, so no, it's not a fucking goalpost.

Every time someone does something like this, I recall this post from Xe:

https://xeiaso.net/blog/anything-message-queue/

This Mozilla fiasco has convinced me that being a nonprofit isn't enough. We need a web browser that is actively hostile towards corporations and surveillance capitalism.

Why hasn't the anti-corporate fiasco (not a single successful example) convinced you that it's not enough?

Corporations, private equity, the ever encroaching monopolies and centralization of economic power, the steady march towards authoritarianism... all of these things are connected and are making our lives shittier. We should oppose them.

> This Mozilla fiasco has convinced me that being a nonprofit isn't enough

I'm not sure to what extent Mozilla actually functions as a nonprofit. All the bits one cares about (i.e. FireFox) are developed by the for-profit subsidiary, which is at least somewhat beholden to Google/Microsoft for revenue...

Starting with a strong copyleft license helps a lot. See Blender being GPL.

How so? Corporate and surveillance capitalism's infrastructure is built on copyleft software. The equivocation of license dogmatism with social good and sustainability that those movements were never actually aligned with is part of what's left socially minded technologies and communities so vulnerable to the predation that led the web to this current mess.

man curl

> hostile towards corporations and surveillance capitalism

... they said. Not against users.

"oh look, my browser doesn't work with Facebook, any Google sites and most of the web"

Oh great. I finally get used to GitHub Actions after Travis CI shat the bed, and now I have to find something else.

Thanks, enshittification.

What part of this is “enshittification”? It’s just a company starting to charge for a formerly free service. Hardly seems like that aggressive a move.

From https://www.wired.com/story/tiktok-platforms-cory-doctorow/

"Here is how platforms die: First, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die."

We are on step 2: then they abuse their users to make things better for their business customers.

It is not abuse to charge what amounts to a relatively small fee for a useful service.

It's not "a relatively small fee for a useful service".

It's an unnecessary fee to use self-hosted (i.e., not GitHub-hosted) components in CI pipelines.

They're squeezing their customers after locking in to juice their margins, having become a monopoly/monopsony. This is the classic enshitificaton playbook.

Nobody is locked in (unless they made some incredibly bad decisions) and this is a tiny fee in exchange for a useful service. I’m just baffled by the response to this.

It's not baffling if you read his Enshitification book. This is phase 2.

In 2010, people were saying it was very reasonable to start prioritizing publishers' ability to reach you over your organic contacts. After all, Facebook is providing this utility for free; shouldn't they be able to extract some additional revenue from their platform? And here we are in 2025...

Oh you sweet summer child

Both of those functions were deprecated years ago.

mysql_real_escape_string() was removed in PHP 7.0.

get_magic_quotes_gpc() was removed in PHP 8.0.

https://www.php.net/mysql_real_escape_string

https://www.php.net/get_magic_quotes_gpc

The current minimum PHP version that is supported for security fixes by the PHP community is 8.1: https://www.php.net/supported-versions.php

If you're still seeing this in 2025 (going on 2026), there are other systemic problems at play besides the PHP code.

mysql_real_escape_string is only deprecated because there is mysqli_real_escape_string. I always wondered why it's "real"...like is there "fake" version of it?

Yes.

https://www.php.net/manual/en/function.mysql-escape-string.p...

https://stackoverflow.com/questions/3665572/mysql-escape-str...

One hardly even tries to do the thing it says on the tin, the other one at least tries to be the real thing. None of them worked very well, however.

Hence why I chose "had" for my previous comment.

Decades ago.

Human minds are more complicated than a language model that behaves like a stochastic echo.

Birds are more complicated than jet engines, but jet engines travel a lot faster.

Birds don't need airports, don't need expensive maintenance every N hours of flight, they run on seeds and bugs found everywhere that they find themselves, instead of expensive poisonous fuel that must be fed to planes by mechanics, they self-replicate for cheap, and the noises they produce are pleasant rather than deafening.

Jet engines don't go anywhere without a large industry continuously taking care of all the complexity that even the simplest jet travel imply.

They also kill a lot more people when they fail.

Is birdflu the failure mode?

I mean, via bird flu, even conservative estimates show there have been at least 2 million deaths. I know, I know, totally different things, but complex systems have complex side effects.

Jet engines run on oil-based fuels. How may deaths can be attributed to problems related to oil ? We can do this all day :) I would suggest we stop, I was really just being snarky.

I literally logged into codeberg using my GitHub account. It's two clicks of the mouse to do this.

Yeah that's good for Codeberg, but most sites haven't set things up to be so seamless. And how many clicks of the mouse was it to set up your SSH key?

As discussed elsewhere in this thread: They're under DDoS, and have been very public about this fact.

In addition to the malleability attack (high-S and low-S both being valid for a given value of R), ECDSA doesn't provide a property called exclusive ownership: https://soatok.blog/2023/04/03/asymmetric-cryptographic-comm...

In contrast, EdDSA (which is based on Schorr signatures) does, by construction: the public key is included in one of the hashes, which binds the signature to a particular public key.

I haven't investigated whether cryptocurrency's use of Schnorr satisfies this property or not. (Indeed, I do not care about cryptocurrency at all.) So it's an exercise to the reader if it's satisfactory or not :3

Excellent blog by the way. I esp. love the humility - advanced concepts about cryptogtaphy then I see an article for new people about how to get into tech. Keeping the ladder out, so to speak.

Why would privacy apps have this feature?

To make it easy to meet friends/family in crowded places

Its not permanent, you just enable it for a few minutes until you find each other

to share your location with trusted people when e.g. you are in a dangerous situation.

or to set up a timed SOS signal if you don't disarm it within a given deadline.