3 ms·

Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court.

by dewiz 12y ago

Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court. Furthermore, the author was secretly required to turn over his secret signing key to a secret third party. If you were the author, what would you do? Consider your options. One is that you could issue an update with a warning that the program is no longer secure. Even though the program really is, at this moment, secure. The only source code changes are to insert the warnings. But what the warnings are warning you about, but cannot just come out and say, is that the program will not be secure in the future because a third party now has the keys to sign authentic new insecure versions. This wouldn't be unlike Lavabit shutting down. The author is choosing to fall on his sword for the good of everyone.

molecule 12y ago
That strategy would be consistent w/ Peter Watts' The Scorched Earth Society: A Suicide Bomber's Guide to Online Privacy: http://boingboing.net/2014/05/27/peter-wattss-the-scorched-ea.html http://boingboing.net/2014/05/27/peter-wattss-the-scorched-e...
isp 12y ago
Continuing the thought experiment. By stating the "reason" you're shutting down is that your project is "no longer necessary", then (i) your userbase will rapidly infer that the reason is odd (e.g., https://news.ycombinator.com/item?id=7813799 https://news.ycombinator.com/item?id=7813799 ), while (ii) you can plausibly defend closing down with a straight face, in court if required ("Our raison d'être no longer applies. So obviously this was the perfect time to shutdown the project for totally this reason and not any others.") Additionally, by changing the TrueCrypt License from 3.0 to 3.1 (removing the clause requiring advertising truecrypt.org), you tacitly support TrueCrypt forks while simultaneously de-emphasising the now-compromised truecrypt.org.
- spacehome 12y ago
  This is without a doubt the most parsimonious explanation for all available evidence.
robszumski 12y ago
I bet the number of days they had to turn over the keys was very low (~48hrs), hence the ability to get the commits at the last minute before the deadline but still do a proper release process and building binaries for each platform.

by dewiz 12y ago

molecule 12y ago

That strategy would be consistent w/ Peter Watts' The Scorched Earth Society: A Suicide Bomber's Guide to Online Privacy: http://boingboing.net/2014/05/27/peter-wattss-the-scorched-ea.html http://boingboing.net/2014/05/27/peter-wattss-the-scorched-e...

isp 12y ago

Continuing the thought experiment. By stating the "reason" you're shutting down is that your project is "no longer necessary", then (i) your userbase will rapidly infer that the reason is odd (e.g., https://news.ycombinator.com/item?id=7813799 https://news.ycombinator.com/item?id=7813799 ), while (ii) you can plausibly defend closing down with a straight face, in court if required ("Our raison d'être no longer applies. So obviously this was the perfect time to shutdown the project for totally this reason and not any others.") Additionally, by changing the TrueCrypt License from 3.0 to 3.1 (removing the clause requiring advertising truecrypt.org), you tacitly support TrueCrypt forks while simultaneously de-emphasising the now-compromised truecrypt.org.

spacehome 12y ago
This is without a doubt the most parsimonious explanation for all available evidence.

robszumski 12y ago

I bet the number of days they had to turn over the keys was very low (~48hrs), hence the ability to get the commits at the last minute before the deadline but still do a proper release process and building binaries for each platform.