PGP, which is something you have to explicitly install, is a badly flawed way to encrypt files; it has a poor password KDF and you should look at how it authenticates data.
No, it's not "badly flawed". Your files won't be compromised.
GnuPG could do with better defaults, but that is true for every system good enough to have aged. A more modern KDF would also be welcome but it won't impact end user security. Just to put things in perspective.
No, that's the point. For long term encrypted storage, GnuPG is one of few options and perfectly good best practice.
Telling users that it's broken without pointing to a clear alternative is counter productive as they are likely to end up much worse.
A more modern KDF would be welcome, but it is also important to communicate the benefit to an end user: You get comparable security with a shorter password. There are other things to consider when choosing an encrypted file format.
Interesting that the comment above is off-and-on turning grey.
It's pragmatic, informative, and highlights that bashing gpg for this specific use case, without naming something better...is arguably worse than saying nothing.
Why downvote it instead of just naming a better choice? What's the big secret?
I downvoted it for making the unhinged argument that a poor KDF is a feature because it encourages users to select better passwords.
I downvote lots of things. On Hacker News, we're explicitly encouraged to downvote disagreement, especially when verbalizing that disagreement will just clutter up the thread. Everyone gets downvoted. I've been downvoted all over this thread. You were just downvoted a minute ago.
The one thing we're not supposed to do is complain about downvoting. That's in the guidelines for the site.
"making the unhinged argument that a poor KDF is a feature because it encourages users to select better passwords."
Where does it say that? It says a better kdf would improve the security of shorter passwords. I don't see anything that suggests a poor kdf is a feature.
The kdf used for "gpg -c" also seems better than "openssh enc". And we've still not heard what the reasonable alternative is for symmetric/password file encryption is. So, I'm sticking with gpg for that use case.
Install something better.