Once starving GnuPG crypto project gets a windfall. Now comes the hard part

Aurich Lawson / Thinkstock

For almost two decades, the open source GnuPG encryption project has teetered on the brink of insolvency. Now, following word of that plight, the lone developer keeping the project alive has received more than $135,000in a single day, no less.

Short for Gnu Privacy Guard, GnuPG or simply GPG was first conceived in 1997. It makes upthe guts that run GpG4Win, GPG Tools, and Enigmail, encryption programs that run on Windows, Macs, and as a plugin for the Thunderbird e-mail program respectively. An open source version of Phil Zimmermann's PGP, GnuPG quickly surged in popularity. Because it was written by a German citizen outside the US, it wasn't subject to then-draconian US laws restricting the export of strong cryptography technologies. Former NSA whistleblower Edward Snowden relied on the program to evade monitoring as he carried out his massive leak of top-secret documents. Many journalists and security professionals also swear by it.

Despite the popularity of the program, Werner Koch has struggled to make ends meet. According to a profile published Thursday by ProPublica, the 53-year-old resident of Erkrath, Germany, grew so impatient with the lack of funding that he considered abandoning the project and taking a better paying programming job. When documents leaked in 2013 by Snowden showed the extent of NSA surveillance, he decided the time wasn't right to drop the project. He has been stuck in limbo ever since.

Things took a dramatic about-face following the ProPublica post. According to the GnuPG front page, the project brought in 120,000 (the equivalent of about $135,600) in donations in the first 24 hours following publication. That didn't include a 60,000 infusion that was recently donated from a group called the Core Infrastructure Initiative and payments of 50,000 each from Facebook and payment service Stripe.

The financial strain Koch has endured underscores a cruel irony that has only recently come to light. Developers of some of the most sensitive and mission-critical software often struggle to maintain their projects, while many who sell smartphone apps and other comparatively less crucial software are flush with cash. It wasn't until last year's surfacing of the catastrophic Heartbleed vulnerability in the OpenSSL crypto library that it became common knowledge the project had just one employee working full time and typically received just $2,000 per year in donations. In response, the Linux Foundation spearheaded the Core Infrastructure Initiative to fund OpenSSL and similar projects. The initiative gets financial support from the likes of HP, IBM, Red Hat, Intel, Oracle, Google, Cisco, and others.

It's encouraging to see the GnuPG project benefitting from similar largess. But it also raises the question: how is the money best spent? Matt Green, a professor specializing in cryptography at Johns Hopkins University, said he has looked at the GnuPG source code and found it in such rough shape that he regularly assigns chunks of it to his students for review.

"At the end I ask how they felt about it and they all basically say: 'God, please I never want to do something like this again,'" Green told Ars.

The main problem with the code, he said, is it hasn't been properly maintained over the years.

"It's overly complex," he explained. "It's not maintained by enough people, given how big it is, and it contains a lot of old cruft that should be gotten rid of. When it got re-engineered from version 1 to version 2, version 2 got re-engineered in this abstract way [so] that it's hard to figure out what's going on on the back end."

See the original post:
Once starving GnuPG crypto project gets a windfall. Now comes the hard part