3 ms·

This guy had dubious ethics right from the start by offering most users a free version with weak encryption just so they can pay for the premium version. The ex

by mtgx 8y ago

This guy had dubious ethics right from the start by offering most users a free version with weak encryption just so they can pay for the premium version. The export control excuse is bogus as by then DJB had already won the lawsuit against the U.S. government over this issue. So all in all, I could see it coming that he would be offering the source code on the silver platter to the NSA after reading the first couple of paragraphs from the post. I also like how he calls that guy a "dumb criminal" for not buying his military-grade encrypted software, as if he hadn't already admitted that he was giving the source code for the full version to the NSA anyway. In other words, he didn't just break the trust of the free users, but also of those paying him to keep their conversations private. This is why I said he had dubious ethics.

jawns 8y ago
I don't see why it's any different than a photo-editing app that applies a watermark to the free version. It's intended to let people give the software a try, and if it seems to meet their needs, they buy the actual product. As for sharing the source code with the NSA, I think you have a better argument there. That said, it's kind of like helping someone install a secure lock on their door to keep out criminals, yet being willing to share a master key with police if it's a matter of life and death.
- web007 8y ago
  It's not a master key, it's a blueprint of the lock with no combination or exact pin layout.
- deleted 8y ago
  [deleted]
- Mithorium 8y ago
  not the master key, the schematics to the lock maybe. Assuming no bugs, I don't see how the source code could help in any way, they may as well have downloaded the source code for openssl. He also didn't bother to verify whether it was a matter of life or death, he just immediately assumed he was helping break into a file containing the deactivation code for a bomb or something, who knows what the NSA was actually doing.
dabernathy89 8y ago
> offering most users a free version with weak encryption just so they can pay for the premium version As long as that wasn't a hidden fact from the users, I don't see the issue.
- michaelmrose 8y ago
  People are stupid. Seat belts that appeared to work but didn't actually keep you safe would be illegal even if labeled.
  - jhall1468 8y ago
    You die if your seatbelt doesn't work and companies charge for seat belts. You don't die if your encryption is weak and you aren't paying for it. But otherwise, super useful analogy.
    - ddalex 8y ago
      > You don't die if your encryption is weak This really depends on the business you're in.
      - pavritch 8y ago
        The laws were different back then. The State Dept changed the rules a decade or more ago, I forget when, and AES 256 has been the default cipher ever since. Encryption is listed as a munition. I would have gone to jail if I put anything greater than 40-bit encryption on the shareware sites. Look what happened with Phil Z with PGP.
        michaelmrose 8y ago
        The law was changed a year before your story takes place.
imglorp 8y ago
Furthermore, if the government calls someone a criminal, their target may well be a dissident, journalist, whistleblower, etc. Things aren's so black and white any more.
SimonPStevens 8y ago
Good security isn't based on keeping source code secret. There is plenty of the most secure encryption software that is open source. I don't really see any ethical issue in handing over the source code.
- pavritch 8y ago
  Exactly. TrueCrypt was the big open source product at the time. A great product used by many hundreds of thousands of people -- I know, because I used to track their progress.

by mtgx 8y ago

jawns 8y ago

I don't see why it's any different than a photo-editing app that applies a watermark to the free version. It's intended to let people give the software a try, and if it seems to meet their needs, they buy the actual product. As for sharing the source code with the NSA, I think you have a better argument there. That said, it's kind of like helping someone install a secure lock on their door to keep out criminals, yet being willing to share a master key with police if it's a matter of life and death.

web007 8y ago
It's not a master key, it's a blueprint of the lock with no combination or exact pin layout.
deleted 8y ago
[deleted]
Mithorium 8y ago
not the master key, the schematics to the lock maybe. Assuming no bugs, I don't see how the source code could help in any way, they may as well have downloaded the source code for openssl. He also didn't bother to verify whether it was a matter of life or death, he just immediately assumed he was helping break into a file containing the deactivation code for a bomb or something, who knows what the NSA was actually doing.

dabernathy89 8y ago

> offering most users a free version with weak encryption just so they can pay for the premium version As long as that wasn't a hidden fact from the users, I don't see the issue.

michaelmrose 8y ago
People are stupid. Seat belts that appeared to work but didn't actually keep you safe would be illegal even if labeled.
- jhall1468 8y ago
  You die if your seatbelt doesn't work and companies charge for seat belts. You don't die if your encryption is weak and you aren't paying for it. But otherwise, super useful analogy.
  - ddalex 8y ago
    > You don't die if your encryption is weak This really depends on the business you're in.
    - pavritch 8y ago
      The laws were different back then. The State Dept changed the rules a decade or more ago, I forget when, and AES 256 has been the default cipher ever since. Encryption is listed as a munition. I would have gone to jail if I put anything greater than 40-bit encryption on the shareware sites. Look what happened with Phil Z with PGP.
      - michaelmrose 8y ago
        The law was changed a year before your story takes place.

imglorp 8y ago

Furthermore, if the government calls someone a criminal, their target may well be a dissident, journalist, whistleblower, etc. Things aren's so black and white any more.

SimonPStevens 8y ago

Good security isn't based on keeping source code secret. There is plenty of the most secure encryption software that is open source. I don't really see any ethical issue in handing over the source code.

pavritch 8y ago
Exactly. TrueCrypt was the big open source product at the time. A great product used by many hundreds of thousands of people -- I know, because I used to track their progress.