tag:gpgtools.tenderapp.com,2011-11-04:/discussions/problems/9705-gpgservices-phone-home-bug-few-other-questionsGPGTools: Discussion 2018-10-18T19:54:08Ztag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-16T09:10:43Z2013-07-16T09:10:44ZGPGServices phone home bug & few other questions<div><p>Hi,<br>
(1) I think there is a small bug/issue with your implementation of
Sparkle Update.</p>
<p>I don't want GPGTools 'phoning home' at all. In GPGPreferences I
made sure "automatically check for updates" was deselected. And in
GPG Keychain access i also set auoto update to off via the
prefs.</p>
<p>I double checked the plists in ~/Library/Preferences<br>
org.gpgtools.GPGKeychainAccess.plist<br>
org.gpgtools.GPGPreferences.plist<br>
org.gpgtools.gpgservices.plist.<br>
All SUEnableAutomaticChecks were set to so automatic updates were
off.</p>
<p>So I presumed all auto updates were disabled.</p>
<p>Then a couple of days ago in nettop I noticed GPGServices
phoning home! It contacted 95.143.172.182 which is
gpgtools.org.</p>
<p>On checking org.gpgtools.gpgservices.plist the time and date
stamp for SULastCheckTime matched the phone home time t the second.
Its worth noting that org.gpgtools.gpgservices.plist does not have
a SUEnableAutomaticChecks</p>
<p>Could you please confirm if this GPGServices/Sparkle
Update/phone home issue is a bug and if not why not?<br>
I'm guessing that if I simply add SUEnableAutomaticChecks and set
it to it will fix the issue?</p>
<p>(2) Another bug/improvement: it would helpful to have
GPGPreference list the GPGTools version in the About box.</p>
<p>(3) Again in GPGPreference in the About box why does it say "On"
in the bottom right hand corner?</p>
<p>(4) When encrypting using GPGServices, in the "Choose
Recipients" dialogue there is a tick box "Add to Recipients". What
does that do?</p>
<p>Thanks</p>
<p>GPGTools ver 20130330<br>
OS X 10.8.4</p></div>Samanthatag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-16T09:37:56Z2013-07-16T09:37:58ZGPGServices phone home bug & few other questions<div><p>Re (4) Sorry, I just found<br>
<a href=
"http://support.gpgtools.org/discussions/everything/9076-secret-key-add-to-recipient">
http://support.gpgtools.org/discussions/everything/9076-secret-key-...</a></p>
<p>Just to confirm:<br>
So it automatically adds me (the encryptor) to the list of people
that can decrypt the file. I was selecting my own key manually from
the list but with this option selected I don't need to that?</p>
<p>Wow, now that I think about it, it raises the unexpected
possibility that it is actually possible to encrypt a file but not
be able to decrypt it yourself (by deselecting that option)?</p></div>Samanthatag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-17T13:04:58Z2013-07-17T13:05:17ZGPGServices phone home bug & few other questions<div><p>Hi Samantha,</p>
<p>thanks for bringing this to our attention, we'll have a closer
look at it.<br>
Sparkle Updates are on by default, since it's really important for
our users to always have the latest versions of the tools.<br>
However it should be possible of course to disable that option AND
if disabled, our tools should abide to that setting.</p>
<p><a href=
"https://gpgtools.lighthouseapp.com/projects/67607-gpgservices/tickets/162-it-should-be-possible-to-disable-sparkle-for-gpgservices">
https://gpgtools.lighthouseapp.com/projects/67607-gpgservices/ticke...</a></p>
<p>(2): You're absolutely right, the version of GPGTools should be
listed and actually I thought it already was. The versioning is a
bit problematic, since you could have a version of GPGTools
installed, but all nightly versions of all other tools. But I hope
we find a way to make this less confusing</p>
<p><a href=
"https://gpgtools.lighthouseapp.com/projects/66966-gpgpreferences/tickets/50-display-gpgtools-insstaller-version">
https://gpgtools.lighthouseapp.com/projects/66966-gpgpreferences/ti...</a></p>
<p>(3): The "0n" you're seeing is the version which is displayed if
you build GPGPreferences yourself. Otherwise you should not be
seeing this.</p>
<p>(4): The GPGServices UI is a huge mess. But you figured it out
what it does. It's confusing as hell to me, to be honest. And yes,
it's absolutely possible to encrypt a file which you yourself can
no longer open. This should not be a problem, unless you deleted
the original.</p>
<p>You can follow progress on the bugs you reported under the URLs
above.<br>
It might take us some time however to get those changes in, since
we're currently focused on getting GPGMail just right.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-17T18:30:02Z2013-07-17T18:30:03ZGPGServices phone home bug & few other questions<div><p>Hi Luke thanks for your reply.</p>
<p>Re (1) It came to mind afterwards that both GPG Preferences and
GPG Keychain Access have GUI's that allow the user to toggle
updates on/off.<br>
GPGServices doesn't have a GUI so there's no way to toggle the
updates to off.</p>
<p>I'd suggest adding a toggle for GPGServices updates to
GPGPreferences pane (I originally thought that the way it was set
up)</p>
<p>As a work around to solve my own issue I went ahead and added
that key SUEnableAutomaticChecks and set it to false. I'm 99% sure
that should stop GPGServices phoning home.</p>
<p>Re (3) Are your sure that's 100% correct? I have the "On"
displayed but I didn't build my version. I installed it using the
official GPGTools-20130330.dmg.</p>
<p>According to the download page it should have the SHA1
617427f478990228f72683cc15d359df5b56a69c which I can confirmed it
has.</p>
<p>Has that dmg been compromised somehow on the server side? I'd
really appreciate if you could clarify the the thought of a
compromised GPG is worrying.</p>
<p>Re (4) It's not that the interface is confusing, for me its more
that the FAQ and documentation could do with a little beefing
up.</p>
<p>Thanks again for your help and for listing the bugs/issues on
the bug tracker :-)</p></div>Samanthatag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-18T10:18:45Z2013-07-18T10:18:45ZGPGServices phone home bug & few other questions<div><p>Hi Samantha,</p>
<p>(1) that's exactly the reason why it's currently not possible
for GPGServices, but as you say, it should definitely be possible
from within GPGPreferences</p>
<p>(3) There's no need to worry, chances are very good that this is
a bug of ours. BUT could you please install the new version of
GPGTools v20130520? It's the most current and much more stable
version than the one you have installed.</p>
<p>If it had been compromised chances would be very little that the
SHA1 still matches.</p>
<p>(5) Absolutely true, lots of documentation is still missing, yet
we'd love to create and design our tools in a way that
documentation is not really necessary in the first place.</p>
<p>Let us know if you have more questions.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-18T17:12:34Z2013-07-18T17:12:35ZGPGServices phone home bug & few other questions<div><p>Re (3) Sounds like a good idea.<br>
Sorry to be a pain, but what's the procedure for updating when
using the GPGTools.dmg: should I uninstall the previous version
first or just run the newer installer.pkg over the existing
installation?</p>
<p>Thanks Luke</p></div>Samanthatag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-18T17:31:00Z2013-07-18T17:31:00ZGPGServices phone home bug & few other questions<div><p>No problem at all, we're happy to answer all your questions
:)</p>
<p>You can simply install the newest version over the previous one.
No need to uninstall.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-18T18:35:11Z2013-07-18T18:35:11ZGPGServices phone home bug & few other questions<div><p>Brilliant. Thanks Luke :-)</p></div>Samanthatag:gpgtools.tenderapp.com,2011-11-04:Comment/277964952013-07-18T21:13:05Z2013-07-18T21:13:05ZGPGServices phone home bug & few other questions<div><p>Closing this discussion then. Feel free to open a new one
anytime should you have more questions or run into problems.</p></div>Luke Le