4 ms·

To clarify, these audits aren't a choice, they are a contractual obligation as part of receiving grant funding from OTF. Projects are allowed some flexibility

by moxie 13y ago

To clarify, these audits aren't a choice, they are a contractual obligation as part of receiving grant funding from OTF. Projects are allowed some flexibility in terms of when they schedule it, but it has to be done. I think it's a great idea. Also, during the period of time when TextSecure received audits from firms as part of an OTF grant, publishing the results was not an option that was contractually available to us. It's not something we "decided."

kaeporan 13y ago
Since I am familiar with the process, I know for a fact that OTF asks every project whether they'd like to publish their audits, including TextSecure. That being said, what is stopping you from publishing the audits today?
- tptacek 13y ago
  They do that now. Dan's OTF post suggests that it wasn't always that straightforward, because the auditors had a proprietary interest in their reports.
  - kaeporan 13y ago
    Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to the opportunity for the honest evaluation of encryption software and the establishment of a realistic perception of encryption software. It also misleads users.
    - fit2rule 13y ago
      >What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? Its embarrassing, duh.
      - tptacek 13y ago
        For who, TextSecure or the auditors? Both are possibilities, one slightly more likely than the other. Auditors hate having reports published with no major findings.
        kaeporan 13y ago
        Why isn't Moxie replying? Publishing an audit, with or without vulnerabilities, surely is beneficial to TextSecure. I don't understand their reticence to publish audits. We know OTF has commissioned at least two audits for them, but not a word has been heard about them. In fact, OTF has actually complained about their projects choosing not to publish audits: https://www.opentechfund.org/article/bringing-openness-security https://www.opentechfund.org/article/bringing-openness-secur...
        tptacek 13y ago
        This is the sixth time you've "asked" in this thread about TextSecure's audit. Cryptocat has literally never implemented a crypto feature of any sort, from random number generation all the way through user authentication, without some terrible vulnerability. TextSecure, on the other hand, is the subject of a total of zero published crypto vulnerabilities. Whatever Moxie's reasons for not having published their audit, I'm sure they're valid. Either way, no amount of innuendo about TextSecure is going to change the ground truth about your own project. There might be no person on the Internet more poorly positioned to cast aspersions on other people's projects than you. Please stop.
        kaeporan 13y ago
        To be clear, I'm not trying to cast aspersions. As I've already stated, TextSecure is a great project that I strongly recommend. I'm trying to have a serious discussion regarding transparency of audits. I feel your reaction is overly aggressive and not genuinely constructive.

by moxie 13y ago

kaeporan 13y ago

Since I am familiar with the process, I know for a fact that OTF asks every project whether they'd like to publish their audits, including TextSecure. That being said, what is stopping you from publishing the audits today?

tptacek 13y ago
They do that now. Dan's OTF post suggests that it wasn't always that straightforward, because the auditors had a proprietary interest in their reports.
- kaeporan 13y ago
  Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to the opportunity for the honest evaluation of encryption software and the establishment of a realistic perception of encryption software. It also misleads users.
  - fit2rule 13y ago
    >What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? Its embarrassing, duh.
    - tptacek 13y ago
      For who, TextSecure or the auditors? Both are possibilities, one slightly more likely than the other. Auditors hate having reports published with no major findings.
      - kaeporan 13y ago
        Why isn't Moxie replying? Publishing an audit, with or without vulnerabilities, surely is beneficial to TextSecure. I don't understand their reticence to publish audits. We know OTF has commissioned at least two audits for them, but not a word has been heard about them. In fact, OTF has actually complained about their projects choosing not to publish audits: https://www.opentechfund.org/article/bringing-openness-security https://www.opentechfund.org/article/bringing-openness-secur...
        tptacek 13y ago
        This is the sixth time you've "asked" in this thread about TextSecure's audit. Cryptocat has literally never implemented a crypto feature of any sort, from random number generation all the way through user authentication, without some terrible vulnerability. TextSecure, on the other hand, is the subject of a total of zero published crypto vulnerabilities. Whatever Moxie's reasons for not having published their audit, I'm sure they're valid. Either way, no amount of innuendo about TextSecure is going to change the ground truth about your own project. There might be no person on the Internet more poorly positioned to cast aspersions on other people's projects than you. Please stop.
        kaeporan 13y ago
        To be clear, I'm not trying to cast aspersions. As I've already stated, TextSecure is a great project that I strongly recommend. I'm trying to have a serious discussion regarding transparency of audits. I feel your reaction is overly aggressive and not genuinely constructive.