The NSA called me after midnight and requested my source code (2018)

For sure. I don't think it's about that, though.

Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled to a fault (or who at least do a good job acting as if they were).

Let's imagine Linus Torvalds or Greg Kroah-Hartman in this same situation. Linux source is available, so let's say they were asked to ensure that a certain patch to a cryptographic API was not accepted before a certain window. Maybe the crypto API maintainers were on the call as well saying that they were on board with the plan (apologies to those people, I don't know you and mean no offense). I like to think that they would:

1. Turn down the NSA.

2. Attempt to get the word out about what they had been asked.

3. Find new crypto maintainers.

And yes, it's entirely possible that this is not at all how it would go down. Maybe they would be very cooperative. I don't know any of these people personally. But what I do know is that they have not, as of yet, made a blog post about that time when the NSA did ask them to betray an unspecified user and how they did everything they asked without resistance.

I don't think I'm being idealistic here. Software and encryption are global endeavors. People who blindly believe that the enemies of their state are also their enemies, or even that obedience to local laws is a moral imperative, should not write crypto software. Or at least, I hope they make their beliefs known like this guy did so that I can avoid their software.

I have bad news. That’s how it usually is.

My favorite nugget from the comments:

  "I hope you’re keeping that mug in an opaque Faraday cage, well grounded."

A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; apparently someone had dialled into the uVAX by mistake or wardialling, figured it was a real DoD machine, had reported the security breach and had gotten all sorts of gears moving.

He wound up the sermon by telling me whoever had called him from the relevant department at military intelligence had chuckled and told him they kind of found it funny - but could he please get hold of me and tell me to stop doing it immediately, or else have my landline terminated?