[Gpg4win-devel] Funding of Gpg4win: How payments are used

[Bernhard Reiter]

Dear Friends of Gpg4win,

in the last two years there has been an improvement how the development
of Gpg4win is funded. When looking back a few years more, another change
becomes visible that has happened so slowly that it was barely noticed.

In Gpg4win's history were a number of public tenders from the German Federal 
Office for Information Security (BSI) to create and improve Gpg4win and 
related software, like Kolab and the groupware client Kontact, which helped 
to fund important development steps [1]. But those were projects and did not 
constitute a needed ongoing flow of funding.

Early in Gpg4win, we wanted it to be a Free Software initative that would be 
long lasting and is carried by a development community [2]. This goal was not 
reached.

Back then we have started accepting donations and volunteered payments where 
my company Intevation GmbH was providing the bank account to "manage" the 
money. We let it run through our books and administered the money for the 
Gpg4win initiative. In addition we were ready to take contracts for 
professional services, extentions and support with companies
like g10code, Intevation and KDAB.

In 2006-2014 we had received ~6400 € in total via volunteered payments [3].
And there weren't many contributions either [4], it was mainly the companies
doing much of the work and funded the needed maintenance for a software that 
needs security updates even when there is no big "project" which allowed us 
to do those updates on the side.

So we'd used the funds for the iniative up to mid 2015 to finance a fraction 
of the maintenance efforts. Given that the initiative we wanted to become was 
centred on this mailinglist, we asked for and reported this here. Not much 
feedback.

What happened in this time was that
**we have slowly changed from trying to be a Free Softwre initiative to a
Free Software enterprise, carried by Intevation and g10code**
(the companies listed to be responsible for www.gpg4win.org). With the (very 
similiar) mission to have end-to-end encryption for email and files ready for 
people and providing a decent user experience. In this we have invested a lot 
of time and money over the years. And it seems many users understand this 
organisational model much better, probably learned about it in a world with 
proprietary software licenses. 
 
Somewhere then we have started asking more directly for a payment on the 
website, of course not requiring one, as we believe that Gpg4win must be 
available for people without payment [5].

In the last two years we are receiving more volunteered payments and are very 
grateful for it. It allows us to fund almost half an engineer to do constant
maintenance and development of Gpg4win and the Outlook Plugin GpgOL. For 2017 
and 2018 Werner (from g10code) has allowed Intevation to keep the funds to 
contribute to the funding of Andre (and some others). Based on the groundwork 
that have again be funded by public contacts, we could offer 

* a public key distribution method [6] that we believe is pragmatic and 
promisses a significant step up in usability. 

* an Outlook-Plugin that does OpenPGP/MIME and offers much more stability.

And there is more to come, within in months we hope to 

* get a approval to handle governmental documents that are
  classified 'restricted' for Germany. 

* offer a paid for standard support package for small to medium organisations.

However we are taking our time, because instead of taking higher risks it is 
more important to keep Gpg4win stable and usable and to be there for the 
foreseeable future. It is you that is making it possible, thanks!

Best Regards,
Bernhard

[1]
Resulting software has always been Free Software and we were openly reporting 
about the contracts, for example with the newer ones documented via
  https://wiki.gnupg.org/Gpg4win

[2]
In 2005/2006 we did a study how this could be done
https://www.gpg4win.de/ShortStudy-Sustainable-FS-example-Gpg4win.html

We did not want to be a "project" in a strict sense, 
but a long lasting "initative". About the wording: 
http://blogs.fsfe.org/bernhard/2012/03/lets-end-all-free-software-projects-quickly/

[3]
http://lists.wald.intevation.org/pipermail/gpg4win-devel/2015-February/001457.html

[4]
My ideas about why Gpg4win fails to attract contributions in short are: There 
is a high entry barrier because of the complexity of the product and the need 
to be conservative. Many users are not in the group of potential 
contributors. It is a lot of packaging and testing work. And yes, when we 
were in "project" mode, we were not spending much resources on trying to be 
transparent because it would have meant lots of friction.

[5]
Being able to download Gpg4win without paying anything makes sense for 
communication partners with little money or the need to get the software 
without revealing ones identity throught a money transaction. It also makes a 
lot of sense for those not being in such a situation to finance those other 
users, as they may end up being in this situation some day and simply because 
they want other people to be compatible to communicate in private with them.

[6] See https://wiki.gnupg.org/WKD , it means you type in the email address 
and automatically get to encrypt the mail. To support it as recipient in the 
simplest version you just need to place a few files with the pubkeys on the 
web server for your email domain. As send you call gpg --locate-keys with 
modern GnuPGs (or gpg -v --auto-key-locate clear,nodefault,wkd --locate-keys 
brinkmeier at uni-osnabrueck.de on slightly older ones like the one coming with 
Debian stable).


-- 
www.intevation.de/~bernhard   +49 541 33 508 3-3
Intevation GmbH, Osnabrück, DE; Amtsgericht Osnabrück, HRB 18998
Geschäftsführer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.wald.intevation.org/pipermail/gpg4win-devel/attachments/20180917/70ad670f/attachment.asc>