Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt must not die

truecrypt.ch

Post reply on HN
Print view View original

51–60 of 103 posts

Re: TrueCrypt must not die

#51

Post by thefreeman »

aliakbarkhan wrote: post #17
nhayden wrote: post #7

This looks like a bootstrap site that was thrown together in an hour by two guys with twitter accounts and $10 for a domain name. I really doubt they're going to be doing any dev work.

Why does the amount of effort on the site matter? I don't understand how that tells you anything about the project or its likely outcome.

well the fact that they are asking for a copy of the original site isn't a good start.

The original dev's made it clear they don't want people to continue with the TrueCrypt name. If they were really interested in continuing the project for the sake of security they would have chosen a different name.

Re: TrueCrypt must not die

#54

Post by chmars »

buddylw wrote: post #10

Also, it appears someone finally got a hold of a Truecrypt dev. The project was just shut down from lack of interest. No drama about auditing or, crazy NSA conspiracies after all: https://twitter.com/stevebarnhart/status/472203503478509568 Edit: That tweet was deleted for some reason, but the rest of the thread is still there: https://twitter.com/stevebarnhart/status/472192457145597952

I have much doubt about that since BitLocker is certainly not good enough:

https://twitter.com/stevebarnhart/status/472195239005147136

And why not just writing that you no longer feel motivated to continue the further development of your software? It is very common after all …

Re: TrueCrypt must not die

#55

Post by SoftwareMaven »

Alupis wrote: post #33
Sir_Cmpwn wrote: post #31

Earlier quoted context omitted.

Of all the subsets of the software development world, crypto is the one to be taken most seriously. TrueCrypt was always developed in the shadows, and the recent controversy takes the nails they've set and hammers them firmly into the coffin. Audits aren't perfect.

It's code. There are no secrets. Problems come up when nobody reads the code. Right now, there's an awful lot of people reading this code (Given the strange warning's posted on the TC site).

That's a fine attitude for normal code, but crypto is a whole different ball game. Linux security was significantly reduced at one point because somebody changed int i to int i=0, something most developers would thing is a positive. Side channel attacks are extremely easy to create and extremely hard to find. And, unfortunately, the "many eyes" thing doesn't work here because it requires experienced, knowledgable eyes, and there aren't enough of those, and they are usually busy getting paid, researching how to break software or building their own stuff.

Re: TrueCrypt must not die

#56

Post by WatchDog »

JohnTHaller wrote: post #9
ronjouch wrote: post #6

Earlier quoted context omitted.

Looking at the license simplifications part of TrueCrypt 7.2 [1], it may be allowed. [1] https://github.com/warewolf/truecrypt/compare/master...7.2#d...

TrueCrypt 7.1a - the one with the actual functionality - wasn't released under this license. It was released under the earlier one. And I don't think it allows for this version or later ala GPL. I'm not sure of this, though.

Well could you not simply take 7.2 and patch it back to something resembling 7.1a, thus keeping both the license and the functionality?

Re: TrueCrypt must not die

#57

Post by dendory »

callahad wrote: post #4

I don't believe the TrueCrypt license allows this kind of redistribution, does it? Then again, with anonymous developers and unknown jurisdiction, it may be moot.

They are redistributing the original unmodified source, so it shouldn't go against the 'derivation' requirement..

Re: TrueCrypt must not die

#58

Post by dendory »

voltagex_ wrote: post #2

The signatures and binaries are not served over HTTPS. It would be prudent to compare them to other sources.

Actually it would be good if the webmaster behind this reboot got SSL set up. Especially if this is going to be the new most authoritative download source.

Re: TrueCrypt must not die

#59

Post by TuxLyn »

thefreeman wrote: post #51
aliakbarkhan wrote: post #17

Earlier quoted context omitted.

Why does the amount of effort on the site matter? I don't understand how that tells you anything about the project or its likely outcome.

well the fact that they are asking for a copy of the original site isn't a good start. The original dev's made it clear they don't want people to continue with the TrueCrypt name. If they were really interested in continuing the project for the sake of security they would have chosen a different name.

Original site archived here > http://archive.today/www.truecrypt.org

Re: TrueCrypt must not die

#60

Post by mkuhn »

tptacek wrote: post #19

It would be nice if the people who pick up and run with the "reboot" of Truecrypt's project management had a background in cryptography. Do these people?

The domain is registered to Joseph Doekbrijder [1] who does seem to be working in the area. You might be much more knowledgeable about were to look for his crypto background than I am.

[1] http://www.linkedin.com/pub/joseph-doekbrijder/2b/384/43a

Post reply on HN