4 ms·

I cannot explain exactly why but something about this project rubs me the wrong way. So much time spent doing bureaucratic things, organizing, raising money.

I cannot explain exactly why but something about this project rubs me the wrong way. So much time spent doing bureaucratic things, organizing, raising money. Have meetings, setup a board. Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Seems to me most of the money goes towards hiring a for profit consulting company. Great way to drum up business I guess. Meanwhile: From the official TrueCrypt FAQ: Q: TrueCrypt is open-source, but has anybody actually reviewed the source code? A: Yes. In fact, the source code is constantly being reviewed by many independent researchers and users. We know this because many bugs and several security issues have been discovered by independent researchers (including some well-known ones) while reviewing the source code. So the reviews and audits have been going on for a long time by many individuals around the world. Anyone can do it. As far as I know, Linux has never been subjected to a formal audit. it has been gawked at by thousands and thousands of individuals. None of them read the whole thing for sure, but parts.

jbri 13y ago
If people want to support the TrueCrypt developers, there's a "Donate" button on the TrueCrypt website. People have instead chosen to give money to an initiative to have a thorough independent audit of the TrueCrypt code - it seems to me like it would be morally wrong to take their money and give it to the TrueCrypt developers instead. Presumably, if their preference was for that money to go to the TrueCrypt developers instead, they'd have skipped the middleman and donated directly. Perhaps someone should organize a similar initiative for the Linux source code?
justin66 13y ago
> Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. If the authors of TrueCrypt have a mechanism in place to bring money in from TrueCrypt, a successful security audit will only make that a lot more profitable. If they don't, they're obviously not worried about it, so who cares? > They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Sixty thousand bucks divided amongst multiple people is not hugely generous compensation.
mhogomchungu 13y ago
Some people are raising funds to review truecrypt code,meaning they will always be one step behind truecrypt and there are others who are working on truecrypt compatible implementations[1][2][3]. It is my opinion that some of this money will be better off if it went to supporting these independent projects that allows management of truecrypt formatted encrypted volumes without using truecrypt.It is possible to manage truecrypt volumes without using truecrypt binary from truecrypt people. [1] https://github.com/bwalex/tc-play/ https://github.com/bwalex/tc-play/ [2] http://code.google.com/p/cryptsetup/ http://code.google.com/p/cryptsetup/ [3] http://code.google.com/p/zulucrypt/ http://code.google.com/p/zulucrypt/
- tptacek 13y ago
  The money was donated to the Truecrypt audit project. It cannot go to other projects.
mschuster91 13y ago
> So much time spent doing bureaucratic things, organizing, raising money. Have meetings, setup a board. Well, if you're raising money and don't want to end up in jail for not doing it the right way, you have to spend a bit of time and money doing it the right way.
tptacek 13y ago
Linux has been repeatedly subject to formal audits that cover the entire system in various configurations. More money has been spent auditing Linux than will ever be spent auditing Truecrypt. You haven't heard about it, because the audits were done quietly. The Truecrypt audit, on the other hand, was organized by a cryptographer on behalf of and for the sole benefit of Truecrypt's users. If you'd like to trust your disk encryption to the same random selection of people who have looked at it in the past, rather than security domain experts, don't donate. Or, use some other package that hasn't and won't be audited. That's fine. For many of the rest of us, it's not OK to rely on un-vetted disk encryption, and paying people to write more of it without having the design and code assessed makes things worse, not better.
matthewdgreen 13y ago
As one of the people running this project, let me give a quick response that may help you feel better about it. I'm a technical person and, like you, my first inclination was to simply get on with it: we'd collect some money, then we'd start the audit. We quickly realized it wasn't _quite_ that simple. For one thing we received a whole lot of money, some of which was literally dumped into a personal bank account by IndieGogo. My collaborator on this project, Kenn White, pointed out that we might very well have to pay taxes on this money if we didn't do something to organize. That's a huge waste of our money /and/ yours. Hence the formation of OCAP as a non-profit and creation of a separate bank account. This has taken us some time, but it's worth it. It also requires that we keep track of donations and demonstrate that they were well spent, which is also a good thing. I should point out that all this work is a royal pain in the butt, and we are not being paid to do this work. We've funded the filing fees out of our own donations. Second, we wanted to establish a trustworthy board of technical advisors before we went and started spending the money. This has also been quite a bit of trouble, but it's certainly been worthwhile. The full list will be up on our site shortly, but briefly it includes: Bruce Schneier, Trevor Perrin, Marcia Hoffman, Moxie Marlinspike, Nate Lawson, Joseph Lorenzo Hall, Runa Sandvik, JP Aumasson and James Denaro. Thomas Ptacek has also been on this board, but decided to recuse himself while iSEC was being considered. I realize this is a large set of advisors, and getting consensus does take some time: but at the end of the day this audit is all about trust. The goal here is to make sure that everybody feels it was run honestly and in public. These are people we trust to call BS if we cut corners or do something shady. With respect to reviewing the code, I routinely come across bugs in open crypto projects that should have been detected by 'people gawking at the code'. It turns out that in certain areas -- crypto being one -- you need a hell of a lot of domain expertise to find and kill subtle bugs. The people with that kind of expertise often have other things to do. This audit is an opportunity for us to correct that, at least this one time, for one project. We hope it won't be the last.

jbri 13y ago

If people want to support the TrueCrypt developers, there's a "Donate" button on the TrueCrypt website. People have instead chosen to give money to an initiative to have a thorough independent audit of the TrueCrypt code - it seems to me like it would be morally wrong to take their money and give it to the TrueCrypt developers instead. Presumably, if their preference was for that money to go to the TrueCrypt developers instead, they'd have skipped the middleman and donated directly. Perhaps someone should organize a similar initiative for the Linux source code?

justin66 13y ago

> Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. If the authors of TrueCrypt have a mechanism in place to bring money in from TrueCrypt, a successful security audit will only make that a lot more profitable. If they don't, they're obviously not worried about it, so who cares? > They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Sixty thousand bucks divided amongst multiple people is not hugely generous compensation.

mhogomchungu 13y ago

Some people are raising funds to review truecrypt code,meaning they will always be one step behind truecrypt and there are others who are working on truecrypt compatible implementations[1][2][3]. It is my opinion that some of this money will be better off if it went to supporting these independent projects that allows management of truecrypt formatted encrypted volumes without using truecrypt.It is possible to manage truecrypt volumes without using truecrypt binary from truecrypt people. [1] https://github.com/bwalex/tc-play/ https://github.com/bwalex/tc-play/ [2] http://code.google.com/p/cryptsetup/ http://code.google.com/p/cryptsetup/ [3] http://code.google.com/p/zulucrypt/ http://code.google.com/p/zulucrypt/

tptacek 13y ago
The money was donated to the Truecrypt audit project. It cannot go to other projects.

mschuster91 13y ago

> So much time spent doing bureaucratic things, organizing, raising money. Have meetings, setup a board. Well, if you're raising money and don't want to end up in jail for not doing it the right way, you have to spend a bit of time and money doing it the right way.

tptacek 13y ago

Linux has been repeatedly subject to formal audits that cover the entire system in various configurations. More money has been spent auditing Linux than will ever be spent auditing Truecrypt. You haven't heard about it, because the audits were done quietly. The Truecrypt audit, on the other hand, was organized by a cryptographer on behalf of and for the sole benefit of Truecrypt's users. If you'd like to trust your disk encryption to the same random selection of people who have looked at it in the past, rather than security domain experts, don't donate. Or, use some other package that hasn't and won't be audited. That's fine. For many of the rest of us, it's not OK to rely on un-vetted disk encryption, and paying people to write more of it without having the design and code assessed makes things worse, not better.

matthewdgreen 13y ago

As one of the people running this project, let me give a quick response that may help you feel better about it. I'm a technical person and, like you, my first inclination was to simply get on with it: we'd collect some money, then we'd start the audit. We quickly realized it wasn't _quite_ that simple. For one thing we received a whole lot of money, some of which was literally dumped into a personal bank account by IndieGogo. My collaborator on this project, Kenn White, pointed out that we might very well have to pay taxes on this money if we didn't do something to organize. That's a huge waste of our money /and/ yours. Hence the formation of OCAP as a non-profit and creation of a separate bank account. This has taken us some time, but it's worth it. It also requires that we keep track of donations and demonstrate that they were well spent, which is also a good thing. I should point out that all this work is a royal pain in the butt, and we are not being paid to do this work. We've funded the filing fees out of our own donations. Second, we wanted to establish a trustworthy board of technical advisors before we went and started spending the money. This has also been quite a bit of trouble, but it's certainly been worthwhile. The full list will be up on our site shortly, but briefly it includes: Bruce Schneier, Trevor Perrin, Marcia Hoffman, Moxie Marlinspike, Nate Lawson, Joseph Lorenzo Hall, Runa Sandvik, JP Aumasson and James Denaro. Thomas Ptacek has also been on this board, but decided to recuse himself while iSEC was being considered. I realize this is a large set of advisors, and getting consensus does take some time: but at the end of the day this audit is all about trust. The goal here is to make sure that everybody feels it was run honestly and in public. These are people we trust to call BS if we cut corners or do something shady. With respect to reviewing the code, I routinely come across bugs in open crypto projects that should have been detected by 'people gawking at the code'. It turns out that in certain areas -- crypto being one -- you need a hell of a lot of domain expertise to find and kill subtle bugs. The people with that kind of expertise often have other things to do. This audit is an opportunity for us to correct that, at least this one time, for one project. We hope it won't be the last.