twitter.com/mjg59/status/1
GPG's entire keyring and trust model is awful, far beyond this issue. As a whole, the software is overly complex with far too much attack surface and poor usability. Even using it for something as simple as verifying a file with a specific key is arcane.
Quote Tweet
This (from gist.github.com/rjhansen/67ab9) is just genuinely awful. There is nothing new about this attack. It demonstrated nothing unexpected. The time to tell people to stop using infrastructure is the moment you know it's vulnerable, not after someone's taken advantage of it.
read image description
ALT
