4 ms·

It is sad to see the state still making freedom of information requests so difficult and using copyright as a flimsy excuse to hinder citizens to share the info

It is sad to see the state still making freedom of information requests so difficult and using copyright as a flimsy excuse to hinder citizens to share the information when they finally manage to get it out of them. I find it especially sad to see something like this held back by an entity that claims to want to protect security in information technology and doubly so since this information would be relevant to the developers and many state entities that use the software and its successor. The BSI is sadly often toothless when it comes to actually enforcing security standards on federal entities but to see them not even trying to educate on such matters, when they clearly know better, squanders a lot of trust one may have in them.

chmod775 7y ago
> since this information would be relevant to the developers and many state entities that use the software and its successor. The BSI actually did communicate the findings of the report to the TrueCrypt developers in 2010, which the developers ignored: > The results were communicated to the Truecrypt foundation, however the Truecrypt developers didn't consider them to be relevant. BSI furthermore says that the results were not intended to be published. (From page 2 of the article)
- Grumbledour 7y ago
  Yes, but they neglected to tell the veracrypt developers once truecrypt stopped being developed. Though they also do know many municipalities using both applications. They should have told the veracrypt developers and advised the municipalities to switch to the newer version. And the whole argument about the information being outdated by then when both are clearly in use seems negligent of their duties.
  - Avamander 7y ago
    Those municipalities should dump Vera and TrueCrypt containers, under eIDAS they should really be using .asice for interoperability.
  - chmod775 7y ago
    Veracrypt didn't exist back then and Truecrypt would only be 'deprecated' five years later. This was in 2010. Personally I would've given up after a few months of trying to get a vulnerability fixed. Can't really blame them this got buried after five years.
michaelt 7y ago
When the developers of a product pay for a third-party security assessment, the results are usually confidential - after all, who'd pay to have their product publicly badmouthed? Perhaps BSI was merely attempting to provide such a service for free.
- chmod775 7y ago
  > Perhaps BSI was merely attempting to provide such a service for free. Yup. That's something they do. They also do stuff like checking/scanning publicly accessible servers in Germany for outdated software/vulnerabilities and you'll get an e-mail if they find something (this is automated). In this case there's the added dimension of the government using Truecrypt in some places at the time, so they had an interest in it being secure.
atlanta90210 7y ago
Jail any government worker who hinders an open records request - like Georgia is trying to do today: https://www.ajc.com/news/local-govt--politics/trial-start-monday-georgia-first-ever-public-records-case/FgMZZLTgBt7RwdhtbgosiP/ https://www.ajc.com/news/local-govt--politics/trial-start-mo...
emn13 7y ago
Open-records requests can be a huge amount of work, even if the records aren't secret - it's common for requesters to have an axe to grind, so you might want to know what that is (and whether you should be honoring the request, and whether that's actually optional, all of which isn't necessarily trivial); and it typically means you need to review all those documents - and understand them. Even if the examination is just cursory, although I have no firsthand experience, I can well imagine that for technical documents that were secret in a secretive organization this is going to be a time consuming process nobody really wants to do. As such, I don't think it's weird or even really all that sad when a request hits some speedbumps. It's kind of inevitable; it's work, it's specialized, it's not all too rewarding for the institution, it's thankless for the specific employee... It's a testament to the solidity of bureaucratic institutions that it gets done at all. Frankly, this all sounds like the process worked about as perfectly as you can expect - they actually got the data, all of it, and they could distribute it literally, too. It would be nice if it were easier to achieve transparency; but the flipside is that overzealous transparency laws can be abused too; at least here in the Netherlands there have been several cases where... creative... citizens decided to cash in on the fines imposed for non-compliance with such requests by spamming (iirc) municipalities with requests which had been phrased to be hard to deal with quickly, and hundreds of which submitted simultaneously. I believe the law has changed, but even so - requests like this aren't free. Somebody else is paying; and that's fine - but to expect them to furthermore go above and beyond and push for excellent service and quick turnaround is perhaps a little unreasonable.

chmod775 7y ago

> since this information would be relevant to the developers and many state entities that use the software and its successor. The BSI actually did communicate the findings of the report to the TrueCrypt developers in 2010, which the developers ignored: > The results were communicated to the Truecrypt foundation, however the Truecrypt developers didn't consider them to be relevant. BSI furthermore says that the results were not intended to be published. (From page 2 of the article)

Grumbledour 7y ago
Yes, but they neglected to tell the veracrypt developers once truecrypt stopped being developed. Though they also do know many municipalities using both applications. They should have told the veracrypt developers and advised the municipalities to switch to the newer version. And the whole argument about the information being outdated by then when both are clearly in use seems negligent of their duties.
- Avamander 7y ago
  Those municipalities should dump Vera and TrueCrypt containers, under eIDAS they should really be using .asice for interoperability.
- chmod775 7y ago
  Veracrypt didn't exist back then and Truecrypt would only be 'deprecated' five years later. This was in 2010. Personally I would've given up after a few months of trying to get a vulnerability fixed. Can't really blame them this got buried after five years.

michaelt 7y ago

When the developers of a product pay for a third-party security assessment, the results are usually confidential - after all, who'd pay to have their product publicly badmouthed? Perhaps BSI was merely attempting to provide such a service for free.

chmod775 7y ago
> Perhaps BSI was merely attempting to provide such a service for free. Yup. That's something they do. They also do stuff like checking/scanning publicly accessible servers in Germany for outdated software/vulnerabilities and you'll get an e-mail if they find something (this is automated). In this case there's the added dimension of the government using Truecrypt in some places at the time, so they had an interest in it being secure.

atlanta90210 7y ago

Jail any government worker who hinders an open records request - like Georgia is trying to do today: https://www.ajc.com/news/local-govt--politics/trial-start-monday-georgia-first-ever-public-records-case/FgMZZLTgBt7RwdhtbgosiP/ https://www.ajc.com/news/local-govt--politics/trial-start-mo...

emn13 7y ago

Open-records requests can be a huge amount of work, even if the records aren't secret - it's common for requesters to have an axe to grind, so you might want to know what that is (and whether you should be honoring the request, and whether that's actually optional, all of which isn't necessarily trivial); and it typically means you need to review all those documents - and understand them. Even if the examination is just cursory, although I have no firsthand experience, I can well imagine that for technical documents that were secret in a secretive organization this is going to be a time consuming process nobody really wants to do. As such, I don't think it's weird or even really all that sad when a request hits some speedbumps. It's kind of inevitable; it's work, it's specialized, it's not all too rewarding for the institution, it's thankless for the specific employee... It's a testament to the solidity of bureaucratic institutions that it gets done at all. Frankly, this all sounds like the process worked about as perfectly as you can expect - they actually got the data, all of it, and they could distribute it literally, too. It would be nice if it were easier to achieve transparency; but the flipside is that overzealous transparency laws can be abused too; at least here in the Netherlands there have been several cases where... creative... citizens decided to cash in on the fines imposed for non-compliance with such requests by spamming (iirc) municipalities with requests which had been phrased to be hard to deal with quickly, and hundreds of which submitted simultaneously. I believe the law has changed, but even so - requests like this aren't free. Somebody else is paying; and that's fine - but to expect them to furthermore go above and beyond and push for excellent service and quick turnaround is perhaps a little unreasonable.