3 ms·

Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think abo

by Sephr 12y ago

Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is signed with the same signing keys, can I legally use the new license in derivative software? The new license removes the following restrictions regarding attribution: - c. Phrase "Based on TrueCrypt, freely available at - http://www.truecrypt.org/" must be displayed by Your Product - (if technically feasible) and contained in its - documentation. Alternatively, if This Product or its portion - You included in Your Product constitutes only a minor - portion of Your Product, phrase "Portions of this product - are based in part on TrueCrypt, freely available at - http://www.truecrypt.org/" may be displayed instead. In each - of the cases mentioned above in this paragraph, - "http://www.truecrypt.org/" must be a hyperlink (if - technically feasible) pointing to http://www.truecrypt.org/ - and You may freely choose the location within the user - interface (if there is any) of Your Product (e.g., an - "About" window, etc.) and the way in which Your Product will - display the respective phrase.

greyfade 12y ago
Only if the derivative software is based on this 7.2 release, which, given its authenticity is in question, is in violation of the prior license version.
laurent123456 12y ago
Interesting, especially since the author(s) are anonymous and not working off public repositories, it will be very hard, if not impossible, for them to prove that they did not release this software.
- tacotime 12y ago
  If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.
Alupis 12y ago
If, and only if, this is a legitament change done by a majority copyright holder(s) and/or project owner.
- Sephr 12y ago
  Of course, but when all you have to verify that a change is by the copyright holder/project owner is a signature, the whole situation becomes very murky. The only authenticity test that I can think of is to actively distribute a fork of TrueCrypt using the new license and wait to get sued. If you get sued by the copyright holder (who would have to come out of anonymity to sue), then you can be sure that the new license was unauthorized. Not the safest way to test authenticity, but it should work.
nullc 12y ago
hurrah, they removed the obnoxious advertising clause.
- runn1ng 12y ago
  ....but only with the 7.2 version that isn't actually encrypting anything.

by Sephr 12y ago

greyfade 12y ago

Only if the derivative software is based on this 7.2 release, which, given its authenticity is in question, is in violation of the prior license version.

laurent123456 12y ago

Interesting, especially since the author(s) are anonymous and not working off public repositories, it will be very hard, if not impossible, for them to prove that they did not release this software.

tacotime 12y ago
If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.

Alupis 12y ago

If, and only if, this is a legitament change done by a majority copyright holder(s) and/or project owner.

Sephr 12y ago
Of course, but when all you have to verify that a change is by the copyright holder/project owner is a signature, the whole situation becomes very murky. The only authenticity test that I can think of is to actively distribute a fork of TrueCrypt using the new license and wait to get sued. If you get sued by the copyright holder (who would have to come out of anonymity to sue), then you can be sure that the new license was unauthorized. Not the safest way to test authenticity, but it should work.

nullc 12y ago

hurrah, they removed the obnoxious advertising clause.

runn1ng 12y ago
....but only with the 7.2 version that isn't actually encrypting anything.