{"slug": "gpg", "name": "GPG", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 1, "commenters": 3, "warners": 2, "score": -0.959, "rising": -0.33, "first": "2026-03-31", "latest": "2026-06-17", "why": "I wrap the executable with a script that runs gpg --decrypt and injects an environment variable.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 0, "compare": 0, "warn": 2}, "spark": [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I wrap the executable with a script that runs gpg --decrypt and injects an environment variable.", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["GPG", "gpg"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 761342384, "item_id": 47583899, "url": "https://news.ycombinator.com/item?id=47583899", "by": "Hackbraten", "date": "2026-03-31", "stance": "recommend", "quote": "I wrap the executable with a script that runs gpg --decrypt and injects an environment variable.", "excerpt": "I am now migrating all my unencrypted secrets on my machines to encrypted ones. If a tool supports scripted credential providers (e.g. aws-cli or Ansible), I use that feature. Otherwise, I wrap the executable with a script that runs gpg --decrypt and injects an environment variable. That way, I can at least limit the blast radius when (not if) I catch an infostealer.", "context": "", "use_case": "encrypting secrets", "switched_from": "unencrypted secrets", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 777159681, "item_id": 48572480, "url": "https://news.ycombinator.com/item?id=48572480", "by": "freedomben", "date": "2026-06-17", "stance": "warn", "quote": "There are just a lot of sharp edges in gpg that you don't know when you don't know.", "excerpt": "Agreed. I use and love git crypt, but it doesn't get enough use. I think because it's easy to screw up gpg keys. Most of my uses (for one to three devs) have become symmetric keys shared out-of-band instead of using gpg keys because we've had lots of onboarding pain even from people who are quite competent. There are just a lot of sharp edges in gpg that you don't know when you don't know.", "context": "small teams of one to three devs", "use_case": "key management for git-crypt", "switched_from": "", "story": "Epic Games announces Lore version control system"}, {"id": 776080736, "item_id": 48505046, "url": "https://news.ycombinator.com/item?id=48505046", "by": "marysol5", "date": "2026-06-12", "stance": "warn", "quote": "how do you get and trust a public key? Key servers are chock full of fake keys.", "excerpt": "I used to always use GPG, had my keys listed on keybase, which cross references my social media and websites to validate they're me. And there already is the first problem, how do you get and trust a public key? Key servers are chock full of fake keys. Just search Linus Torvalds on there... But even then, the sheer amount of people who'd complain and wonder what the block of base64 data was at the bottom of the e-mai", "context": "former GPG user", "use_case": "email signing", "switched_from": "", "story": "The Future of Email"}]}], "who": [], "tags": [], "use_cases": ["key management for git-crypt", "email signing", "encrypting secrets"], "compared": [{"slug": "age", "name": "age", "co": 1, "switched_from": 0, "switched_to": 1}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48571081", "title": "Epic Games announces Lore version control system", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48502321", "title": "The Future of Email", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47582220", "title": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {"warn": 2}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 777159681, "item_id": 48572480, "url": "https://news.ycombinator.com/item?id=48572480", "by": "freedomben", "date": "2026-06-17", "stance": "warn", "quote": "There are just a lot of sharp edges in gpg that you don't know when you don't know.", "excerpt": "Agreed. I use and love git crypt, but it doesn't get enough use. I think because it's easy to screw up gpg keys. Most of my uses (for one to three devs) have become symmetric keys shared out-of-band instead of using gpg keys because we've had lots of onboarding pain even from people who are quite competent. There are just a lot of sharp edges in gpg that you don't know when you don't know.", "context": "small teams of one to three devs", "use_case": "key management for git-crypt", "switched_from": "", "story": "Epic Games announces Lore version control system"}, {"id": 776080736, "item_id": 48505046, "url": "https://news.ycombinator.com/item?id=48505046", "by": "marysol5", "date": "2026-06-12", "stance": "warn", "quote": "how do you get and trust a public key? Key servers are chock full of fake keys.", "excerpt": "I used to always use GPG, had my keys listed on keybase, which cross references my social media and websites to validate they're me. And there already is the first problem, how do you get and trust a public key? Key servers are chock full of fake keys. Just search Linus Torvalds on there... But even then, the sheer amount of people who'd complain and wonder what the block of base64 data was at the bottom of the e-mai", "context": "former GPG user", "use_case": "email signing", "switched_from": "", "story": "The Future of Email"}, {"id": 761342384, "item_id": 47583899, "url": "https://news.ycombinator.com/item?id=47583899", "by": "Hackbraten", "date": "2026-03-31", "stance": "recommend", "quote": "I wrap the executable with a script that runs gpg --decrypt and injects an environment variable.", "excerpt": "I am now migrating all my unencrypted secrets on my machines to encrypted ones. If a tool supports scripted credential providers (e.g. aws-cli or Ansible), I use that feature. Otherwise, I wrap the executable with a script that runs gpg --decrypt and injects an environment variable. That way, I can at least limit the blast radius when (not if) I catch an infostealer.", "context": "", "use_case": "encrypting secrets", "switched_from": "unencrypted secrets", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}]}