Adam Back <aba@dcs.ex.ac.uk> wrote:
Fill out and email me, and I'll tabulate results, and post here and on ietf-open-pgp:
==============================8<============================== mini straw poll on pgp2.x and 5.x usage:
1. What are you currently using for everyday use: 2.x or 5.x
[ 2 or 5 ]
2.x. 5.x is purposefully incompatable and crippled.
2. What proportion of people you use PGP to communicate with are using 5.x
[ x / y ]
None. If they're using 5.x I by definition can't communicate with them.
3. How many of the 5.x users you communicate with are cypherpunks
[ z ]
See above.
==============================8<==============================
The question has come up on ietf-open-pgp as to how important it is for the OpenPGP standard to support backwards compatibility with pgp2.x.
Very. 5.x right now is nothing but annoying. I can understand wanting to use the new algorithms. However if the authors want to do that and literally force people into upgrading then they need to make sure that every platform which had a version of 2.x has a version of 5.x available, and they need to stop breaking *every* script and program which calls PGP. If they release a version of PGP for one platform before they do others and the new version is incompatable with the old for all intents and purposes, they're just feeding OS wars, frustration, and hostility.
The IETF generally likes to steer clear of patented algorithms as MUSTs in standards. This encourages implementations, etc. (Personally I'm pretty keen on this point, though I would like more backwards compatible pgp5.x implementations -- I've already received emails I can't read without resorting to the pgp5 command line app, which doesn't work with my mailer integrated system.)
That's exactly my situation. I figure, however, that if somebody is going to send out broken email I won't bother kludging around to read it no more than I will go start X11 and fire off a 20 MB browser (Communicator) because some moron doesn't know how to use HTML as it was originally designed. I'm personally appalled at the number of Cypherpunks using a version of PGP which is completely incompatable with previous versions and outrageously annoying to use unless you run Windows since it breaks everything which is integrated.
So the question arises, just how many pgp2.x users are there. PGP Inc are pointing to the ratio of RSA keys to DSA/EG keys on keyservers as showing that pgp2.x users are in the minority. However that ratio is something like 20,000 to 75,000, and I'm sure we've heard statistics in the past about there being literally millions of pgp 2.x users. One suspects that either many pgp 2.x users aren't using keyservers (I know several cypherpunks who have something against key servers and avoid them for perceived security or privacy reasons), and/or the pgp2.x user base is exaggerated.
You can't compare the user bases this way. First, 5.x integrates easily into several Windows mailers. This encourages people to go get it and install it over 2.x. Second, 5.x integrates keyserver functions. 2.x does not. It's really no work for 5.x users to submit a key to a keyserver, where it takes some effort with 2.x. Third, most people probably have Windows installed already. They heard 5.x was out, and didn't realize that it was so...well, broken. I know I fetched 5.x when it came out and installed it. I almost sent my key to the servers, then stopped to think about how the generated key doesn't work with 2.x. Fourth, if you're using Windows and communicating with other Windows users there is really no reason not to use 5.x. People communicating with classmates at universities and such are likely to go install 5.x because it's easy to use, send their key to the keyservers because they can, and inflate the numbers. Fifth, there are far more Windows users than users of other OSes. Windows users have no reason not to upgrade, while other users have every reason to stick with previous version. I think the major problem with 5.x right now as it stands is the complete lack of support from http://beta.pgp.com, the forced command-line incompatabilities, and the lack of a stable multiplatform version. Add to that the CMR debacle. Now in defense of PGP 5.x I do like the keyserver integration, expiry dates on keys, and some of the other features. I like how it integrates with the mailers. This entire thing makes me think of a web site which checks your browser and OS. If you aren't running what the author likes, it tells you that you suck, you're a moron, you're behind the times, you're using an inferior operating system, and then doesn't show you the data. This is analogous to what PGP Inc. has done. This compatability thing could have very easily been avoided. Face it, PGP Inc. screwed up. I think it's ultimately going to be the job of Cypherpunks outside of the Land of the Freeh to clean up their mess. Has anyone considered hacking up 2.6.xi to handle the new format? It would have to be saner than 5.x is at this point. I would try, but I'm in the Land of the Freeh where you put your backside on the line to write any crypto software at all. Ah, I love America. CompatabilityMonger