I'm know GPG supports two types of message signing. One is PGP/MIME and the other is traditional clear signing. Can someone point me to a resource, or explain what the real difference is between the two? I'm primarily interested in what security differences there are if any. Also, I'd like to know why you would choose one method over the other.
I've been Googling for an answer and haven't found a satisfying answer yet.

Thanks.

Here is what I've found about it. It has nothing to do with security, but does help a lot with clutter. I noticed, for example, in a mailing list archives, the difference between the two. The clearsign shows right there in the message where the PGP/MIME is attached and only shows if you look at it in the source.

I also found that this can be problematic when a mailing list is set to accept only plain text attachments. They need to be set to accept attachments that are "multipart/signed" as well.

So, like I found in a post that says it better than I can:

PGP/MIME does not clutter the messages for non-PGP enabled clients
and web based mailinglist archives with inline -----BEGIN PGP STUFF

PGP/MIME signed messages do not carry PGP garbage into reply when
quoted by non-PGP aware mail client

Anita

As ajlewis pointed out, it's to keep down clutter. But it's not only aesthetic reasons. Initially, some poorly-implemented clients would calculate the hash over different parts of the message. Even with the ASCII armor, some messages were commonly mishashed, indicating a forgery, when in actuality it was the difference of a newline character or something like that. Having a multi-part message makes it clear what part of the message is signed.

The only problem with PGP/MIME (if you might call it a problem) is support for "legacy" implementations (i.e., email clients which can handle PGP, but not PGP/MIME).

Ok. So security isn't the reason. The muttrc man page is somewhat misleading as it claims that clear signing is deprecated and strongly urged against. I couldn't find anything to that effect in the gpg man pages.

Thanks.

This is pretty much true.

I thought I'd reproduce a snippet of the gpg man page:
gpg is a standalone program with many uses (one of which is email encryption/signing), but clear-text signing has a higher probability of failure with one of them (i.e., emailing across platforms and/or implementations). GnuPG shouldn't need to urge against anything, since clear text signatures are completely appropriate for other tasks.