As one of the people running this project, let me give a quick response that may help you feel better about it. I'm a technical person and, like you, my first

As one of the people running this project, let me give a quick response that may help you feel better about it. I'm a technical person and, like you, my first inclination was to simply get on with it: we'd collect some money, then we'd start the audit. We quickly realized it wasn't _quite_ that simple. For one thing we received a whole lot of money, some of which was literally dumped into a personal bank account by IndieGogo. My collaborator on this project, Kenn White, pointed out that we might very well have to pay taxes on this money if we didn't do something to organize. That's a huge waste of our money /and/ yours. Hence the formation of OCAP as a non-profit and creation of a separate bank account. This has taken us some time, but it's worth it. It also requires that we keep track of donations and demonstrate that they were well spent, which is also a good thing. I should point out that all this work is a royal pain in the butt, and we are not being paid to do this work. We've funded the filing fees out of our own donations. Second, we wanted to establish a trustworthy board of technical advisors before we went and started spending the money. This has also been quite a bit of trouble, but it's certainly been worthwhile. The full list will be up on our site shortly, but briefly it includes: Bruce Schneier, Trevor Perrin, Marcia Hoffman, Moxie Marlinspike, Nate Lawson, Joseph Lorenzo Hall, Runa Sandvik, JP Aumasson and James Denaro. Thomas Ptacek has also been on this board, but decided to recuse himself while iSEC was being considered. I realize this is a large set of advisors, and getting consensus does take some time: but at the end of the day this audit is all about trust. The goal here is to make sure that everybody feels it was run honestly and in public. These are people we trust to call BS if we cut corners or do something shady. With respect to reviewing the code, I routinely come across bugs in open crypto projects that should have been detected by 'people gawking at the code'. It turns out that in certain areas -- crypto being one -- you need a hell of a lot of domain expertise to find and kill subtle bugs. The people with that kind of expertise often have other things to do. This audit is an opportunity for us to correct that, at least this one time, for one project. We hope it won't be the last.