6 ms·

"[Matthew] Green last year helped spearhead dual crowdfunding efforts to raise money for a full-scale, professional security audit of the software." "'I think

by panarky 12y ago

"[Matthew] Green last year helped spearhead dual crowdfunding efforts to raise money for a full-scale, professional security audit of the software." "'I think the TrueCrypt team did this,' Green said in a phone interview. 'They decided to quit and this is their signature way of doing it.'" "I’m a little worried that the fact we were doing an audit of the crypto might have made them decide to call it quits.”

higherpurpose 12y ago
I think that's why they are quitting. They didn't want the audit to find something. But it's just a speculation like any other.
- Spearchucker 12y ago
  I doubt that's the reason - Greene says that the audit is going ahead. The other fact that makes this unlikely is that Green's team has the source, so his team can poke around all it likes anyway. Ergo quitting is no guarantee that something won't be found.
  - unfamiliar 12y ago
    But quitting and hence most likely ending the project will substantially increase the chance that Green decides spending the rest of the money auditing it is a waste of cash.
- throwaway99812 12y ago
  It's more likely that they were angry that the audit got a lot of funds and they didn't. In OSS often the people who do the original work get nothing and all the money goes to pundits, packagers, and consultants.
  - louthy 12y ago
    If that were true, and they were so sure of the quality of their code then they'd keep going, wait for the all clear and say: "Look, we've been doing this for 10 years, our system is now independently audited, will you please support us..." I suspect that would have brought in a few dollars in the current climate.
    - yebyen 12y ago
      If the system works fine, and the auditors are paid and they have certified that the system works, where is the need for any more financial support? I agree that the work should be recognized, but there is no need to pay to support work that has already been completed, as anyone who's ever applied for a research grant already knows.
    - danielweber 12y ago
      That might make sense in a world of perfectly rational unemotional robots. In the real world, if you worked for years trying to make people safe, and you felt (correctly or not) that you were being disrespected while others were being respected for picking at your nits, you might say "fine, fuck you all, have fun," too. To be clear, I don't know what's going on. A "rage quit" is the most likely scenario IMHO, but this is all very weird. EDIT: On reflection, a rage quit fits my priors, which say "there's no such thing as free-as-in-beer[1] software." So you and I should both be a little skeptical when I find it the likely explanation. [1] It does exists, but it's the exception, and each project where it works has its own particular quirks that make it work. The successful ones typically rely on someone having a particular and unusual mental setup that doesn't mind free loaders. Stallman and de Raadt develop software for their own use, and the rest of us can use it, too.
      - comex 12y ago
        Off-topic, but considering the sheer amount of stuff on GitHub, I'm not sure it's about free loaders - whether or not it's useful, the fact that so much code is published demonstrates that many people are okay with it being used by others.
    - michaelmike 12y ago
  - chmars 12y ago
    Just that there are no known 'people who do the original work' in the case of TrueCrypt.
  - zipdog 12y ago
    Not just OSS, though, if you read the history of new products or discoveries the same pattern regularly occurs.
dsl 12y ago
That is nonsense. The TrueCrypt developers turned over code and assisted in the initial audit. iSEC found no serious issues. Granted they only evaluated the bootloader under the first contract, but if you were going to slip in a backdoor or if a serious crypto bypass would be possible it would have likely been there.
- chmars 12y ago
  Which TrueCrypt developers? AFAIK we don't know them yet … and why was it necessary to turn over code for an alleged open source project? iSEC has not found serious issues but that was only phase 1 of the audit.
  - danielweber 12y ago
    It wasn't "Open Source™." The source, however, was available, and you could compile it yourself if you wished. (It was somewhat unusual to compile on Linux, since it started as a Windows GUI project and was then ported to Linux.)
  - dsl 12y ago
    The project was in contact with TrueCrypt developers (someone who could sign messages using the release keys, and provide images of the build machine that is nearly impossible to reproduce). They reviewed the bootloader which is one of the most complex parts and touched all the crypto and found no serious issues. That suggests that the rest of the mundane code is probably in pretty good shape. Of course it is not a guarantee that things are perfect, but it suggests that the developers a) knew what they were doing b) had no issues with an external audit.
hamburglar 12y ago
If the audit made them call it quits, then having them cough up the source and abandon the project for someone else to pick up is the perfect outcome.
- lurkinggrue 12y ago
  We already have the source.
  - hamburglar 12y ago
    We didn't before, though, did we? Or am I mistaken about that?
    - e40 12y ago
      The source tarball was always available for download on truecrypt.org.

by panarky 12y ago

higherpurpose 12y ago

I think that's why they are quitting. They didn't want the audit to find something. But it's just a speculation like any other.

Spearchucker 12y ago
I doubt that's the reason - Greene says that the audit is going ahead. The other fact that makes this unlikely is that Green's team has the source, so his team can poke around all it likes anyway. Ergo quitting is no guarantee that something won't be found.
- unfamiliar 12y ago
  But quitting and hence most likely ending the project will substantially increase the chance that Green decides spending the rest of the money auditing it is a waste of cash.
throwaway99812 12y ago
It's more likely that they were angry that the audit got a lot of funds and they didn't. In OSS often the people who do the original work get nothing and all the money goes to pundits, packagers, and consultants.
- louthy 12y ago
  If that were true, and they were so sure of the quality of their code then they'd keep going, wait for the all clear and say: "Look, we've been doing this for 10 years, our system is now independently audited, will you please support us..." I suspect that would have brought in a few dollars in the current climate.
  - yebyen 12y ago
    If the system works fine, and the auditors are paid and they have certified that the system works, where is the need for any more financial support? I agree that the work should be recognized, but there is no need to pay to support work that has already been completed, as anyone who's ever applied for a research grant already knows.
  - danielweber 12y ago
    That might make sense in a world of perfectly rational unemotional robots. In the real world, if you worked for years trying to make people safe, and you felt (correctly or not) that you were being disrespected while others were being respected for picking at your nits, you might say "fine, fuck you all, have fun," too. To be clear, I don't know what's going on. A "rage quit" is the most likely scenario IMHO, but this is all very weird. EDIT: On reflection, a rage quit fits my priors, which say "there's no such thing as free-as-in-beer[1] software." So you and I should both be a little skeptical when I find it the likely explanation. [1] It does exists, but it's the exception, and each project where it works has its own particular quirks that make it work. The successful ones typically rely on someone having a particular and unusual mental setup that doesn't mind free loaders. Stallman and de Raadt develop software for their own use, and the rest of us can use it, too.
    - comex 12y ago
      Off-topic, but considering the sheer amount of stuff on GitHub, I'm not sure it's about free loaders - whether or not it's useful, the fact that so much code is published demonstrates that many people are okay with it being used by others.
  - michaelmike 12y ago
- chmars 12y ago
  Just that there are no known 'people who do the original work' in the case of TrueCrypt.
- zipdog 12y ago
  Not just OSS, though, if you read the history of new products or discoveries the same pattern regularly occurs.

dsl 12y ago

That is nonsense. The TrueCrypt developers turned over code and assisted in the initial audit. iSEC found no serious issues. Granted they only evaluated the bootloader under the first contract, but if you were going to slip in a backdoor or if a serious crypto bypass would be possible it would have likely been there.

chmars 12y ago
Which TrueCrypt developers? AFAIK we don't know them yet … and why was it necessary to turn over code for an alleged open source project? iSEC has not found serious issues but that was only phase 1 of the audit.
- danielweber 12y ago
  It wasn't "Open Source™." The source, however, was available, and you could compile it yourself if you wished. (It was somewhat unusual to compile on Linux, since it started as a Windows GUI project and was then ported to Linux.)
- dsl 12y ago
  The project was in contact with TrueCrypt developers (someone who could sign messages using the release keys, and provide images of the build machine that is nearly impossible to reproduce). They reviewed the bootloader which is one of the most complex parts and touched all the crypto and found no serious issues. That suggests that the rest of the mundane code is probably in pretty good shape. Of course it is not a guarantee that things are perfect, but it suggests that the developers a) knew what they were doing b) had no issues with an external audit.

hamburglar 12y ago

If the audit made them call it quits, then having them cough up the source and abandon the project for someone else to pick up is the perfect outcome.

lurkinggrue 12y ago
We already have the source.
- hamburglar 12y ago
  We didn't before, though, did we? Or am I mistaken about that?
  - e40 12y ago
    The source tarball was always available for download on truecrypt.org.