Re: slow PGP in No Gnus v0.4

[Juliusz Chroboczek <jch@pps.jussieu.fr>]

>> 1. Message has been signed and verification failed (obvious);
>> 2. message has been signed and verification succeeded (as opposed to)
>> 3. message hasn't been signed in the first place.

I actually see six states.

  1a. verification has failed because the public key is not available;
  1b. verification has failed for some other reason.
  2a. verification successful, key valid (``trusted'').
  2b. verification successful, key validity unknown (``untrusted'').
  3. message insecure (not signed).
  4. message is signed but hasn't been verified because mm-verify-option
     is not set.
 
Unlike 1b, which is obviously bad, 1a happens all the time.  And Gnus
(even with gnus-buttonized-mime-types set to multipart/signed) doesn't
allow me to easily distinguish between the two -- the button just says
``Failed''.  Which I hereby report as a bug.

> In my opinion, the difference between 2 and 3 is [not interesting]

A visible flag in the modeline would be an improvement over the
current situation.  You could replace the current ``p'' with a choice
of well-chosen characters.  Perhaps someone can make a better design
than

  1a. ?
  1b. -
  2a. +
  2b. ?
  3. space
  4. p

And if these could be coloured, that would be cool.

> Of course, you're free to disagree.

Thank you.  What the button is important for is knowing which part of
the message is protected, and reminding people that headers are not
protected.

In particular, there's absolutely nothing preventing me from signing a
message with my key and putting ``From: larsi@'' in the headers.
There's absolutely nothing to indicate that case in the non-buttonised
interface.  Which I hereby report as a bug.

Gnus should notice that case and put something like 

  Juliusz Chroboczek <jch@> (posing as <larsi@>)

in both the From header line and the summary line.  (Yes, that requires
rewriting the summary after verification.)

(There's also nothing preventing me from taking a plain text messaged
signed by larsi@, putting it into a text/fake subpart of a
multipart/mixed, and following it with an unsigned text/plain.)

                                        Juliusz