7 ms·

I just don't quite understand the panic about microsoft not supporting XP anymore. It's not like that was a surprise announcement or even that the deadline was

by wahsd 12y ago

I just don't quite understand the panic about microsoft not supporting XP anymore. It's not like that was a surprise announcement or even that the deadline was just met. It was April 8th....and TrueCrypt just now shut down in panic? ...Because XP support stopped??? WTF is going on? It's not even like support means anything, other than that they will no longer improve or fix it, i.e., there's still time to migrate away as XP degrades. It says nothing about whether XP is secure in and of itself. This whole incident is about as weird as weird gets. I saw a post that suggested it might be a canary, i.e., an event that must be interpreted as a certain action having taken place...a negative message....an absence of an indication that everything is ok. But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. You should put money on the fact that it really was someone associated with certain ever increasingly fascist governments of, likely the USA or Israel, that compromised TrueCrypt in a way that set off an "auto-destruct" sequence. It's probably a reaction to the Snowden compromise, with increased funding and efforts to regain domination that he exposed by becoming even more totalitarian through an "Operation Kristallnacht" sprint against civilian institutions.

codeulike 12y ago
* bitLocker??? Alone that suggestion smells like rotten fish * The Bitlocker recommendation does seem strange. But when you look around the Windows ecosystem, there isn't much else that could be recommended. What would you recommend Windows people use, other than Bitlocker?
- dublinben 12y ago
  TrueCrypt 7.1a is still safe to use. So is GPG.
  - phpnode 12y ago
    how do you conclude that any TrueCrypt version is secure in light of this disclosure?
    - blueskin_ 12y ago
      Because this happened to 7.2. Chances are, this is a warrant canary, and people will take the last known good 7.1 (i.e. the one that is being audited) and build their forks from there.
      - danielweber 12y ago
        1. 7.2 just disabled things. It didn't introduce a vulnerability. 2. Warrant canary makes no sense. There is nothing for a warrant to grab. 3. Forking is legally troublesome. Just because you can see the source doesn't mean you can distribute the source.
        blueskin_ 12y ago
        >1. 7.2 just disabled things. It didn't introduce a vulnerability. I had a look at the diff; I have neither the time nor crypto-specific skill to do an audit, but there are plenty of code changes that aren't warnings in there. >2. Warrant canary makes no sense. There is nothing for a warrant to grab. No, but they could have theoretically been asked to introduce a backdoor from a Lavabit-style order. >3. Forking is legally troublesome. Just because you can see the source doesn't mean you can distribute the source. Do you think that will stop people? Even if there is some legal issue, the Streisand Effect always overcomes it. So what if a TrueCrypt fork can't use Github because of that issue? Is the world suddenly lacking good hosting providers, perhaps in Switzerland or similar? Has everyone forgotten how to set up a public git repo themselves? Somehow, I think not. So what if many devs will probably have to contribute anonymously? With a product such as TrueCrypt, they probably should anyway.
        danielweber 12y ago
        been asked to introduce a backdoor from a Lavabit-style order This makes no sense. Lavabit was compelled to turn over evidence it told the government it had, which is straightforward law. There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that. If the developer's cat was kidnapped to force him to put in a backdoor, there is nothing "Lavabit-style" about that. You do hedge with the word "theoretically," but "theoretically" this could be a message from the aliens. Do you think that will stop people? It will stop the smart people, and you need smart people to work on it. Otherwise you would only be allowed to distribute it by illicit means, and you could never trust it. It would be as trustworthy as warez sites. Why even bother with that nonsense? Much saner to just build something new, having learned from TrueCrypt's experiences. For example, something that starts from the command-line and then has a GUI in top, instead of the reverse.
- easytiger 12y ago
  I find it interesting that it is only Microsoft Windows users really affected by this. What does that tell you about it as an ecosystem/platform?
  - codeulike 12y ago
    It tells me all kinds of things that we've all known since the 90s.
    - easytiger 12y ago
      Having tried windows 8 recently i find it appalling how little it has changed. Even aesthetically it is diabolically a failure. There is no consistency and nothing makes sense. The removal of progress bars from system update functions is UX stupidity and having to reboot after every minor change is just embarrassing.
deleted 12y ago
[deleted]
nisa 12y ago
Just another theory but consider that the TrueCrypt team was always anonymous and considering that their licence is somewhat prohibitive for a open-source project it's not totally bonkers to assume that some agency or big coorporation developed TrueCrypt in secret and made it public to gain widespread assurance that there are no bugs in the code. Maybe they migrated away from XP and have assurance that Bitlocker is safe for them or switched to something entirely different and have no interest or funding for development it anymore...
blueskin_ 12y ago
>But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. That's the canary. Not only is bitlocker backdoored, and most TrueCrypt users would know that, but they also say it is available on all windows versions, which is eminently not the case.
- outworlder 12y ago
  Isn't a canary something that is 'removed', not 'added'? As in, the canary warns by being absent.
  - Zancarius 12y ago
    Not in this case [1], or rather, not always. And if you consider where the term arose (canaries in mines), it's really an issue of state more than it is absence. If the state of the canary changes it's cause for alarm. In this situation, warrant canaries (or maybe an NSL canary as the case might be) is a subtle indication that everything is no longer in a known-good state and something has been compromised. Although given some of the comments by danielweber, I'm increasingly less inclined to believe this was a canary. Developers throwing in the towel might be a more plausible situation, no matter how disappointing that may be. [1] http://en.wikipedia.org/wiki/Warrant_canary http://en.wikipedia.org/wiki/Warrant_canary
tripzilch 12y ago
Another theory is that some component of the development environment to compile TrueCrypt requires XP. Remember the guy that tried to compile the TC source to match the binary? https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie... He needed to get some older version of Visual Studio and a very specific combination of service packs and updates in order to get to matching (nearly) the entire binary. Could it be that the devs really wanted to keep developing in XP because some part of their dev chain required it, but with support being discontinued they of course couldn't run XP and consider that computer "secure" to develop on? Obviously, if this theory has some grain of truth to it, it can only be part of the explanation for the TrueCrypt weirdness that's been going on today. If I had to bet on it, I would say it's most likely they got Lavabitten. But then still, the XP remark seems like a very odd choice if it's intended to function as a canary of sorts.
- Lx1oG-AWb6h_ZG0 12y ago
  > Another theory is that some component of the development environment to compile TrueCrypt requires XP This seems unlikely: the screenshots in your link clearly show the source could be built on Windows 7. The trouble Xavier mentions is with the updates to VS2008 SP1, not Windows service packs.
- Bootvis 12y ago
  I don't think that the EOL of XP has much do with it because they could simple air gap their Windows XP installation to continue development in a secure fashion. Unless, of course, something more shadowy is going on.
sliverstorm 12y ago
It's not a panic about XP. The presented reasoning is: - XP is the only widely used version of Windows with no built-in FDE - XP is finally, truly, EOL So TrueCrypt no longer needs to exist. (I'm not arguing that- that is what the message is saying)

by wahsd 12y ago

codeulike 12y ago

* bitLocker??? Alone that suggestion smells like rotten fish * The Bitlocker recommendation does seem strange. But when you look around the Windows ecosystem, there isn't much else that could be recommended. What would you recommend Windows people use, other than Bitlocker?

dublinben 12y ago
TrueCrypt 7.1a is still safe to use. So is GPG.
- phpnode 12y ago
  how do you conclude that any TrueCrypt version is secure in light of this disclosure?
  - blueskin_ 12y ago
    Because this happened to 7.2. Chances are, this is a warrant canary, and people will take the last known good 7.1 (i.e. the one that is being audited) and build their forks from there.
    - danielweber 12y ago
      1. 7.2 just disabled things. It didn't introduce a vulnerability. 2. Warrant canary makes no sense. There is nothing for a warrant to grab. 3. Forking is legally troublesome. Just because you can see the source doesn't mean you can distribute the source.
      - blueskin_ 12y ago
        >1. 7.2 just disabled things. It didn't introduce a vulnerability. I had a look at the diff; I have neither the time nor crypto-specific skill to do an audit, but there are plenty of code changes that aren't warnings in there. >2. Warrant canary makes no sense. There is nothing for a warrant to grab. No, but they could have theoretically been asked to introduce a backdoor from a Lavabit-style order. >3. Forking is legally troublesome. Just because you can see the source doesn't mean you can distribute the source. Do you think that will stop people? Even if there is some legal issue, the Streisand Effect always overcomes it. So what if a TrueCrypt fork can't use Github because of that issue? Is the world suddenly lacking good hosting providers, perhaps in Switzerland or similar? Has everyone forgotten how to set up a public git repo themselves? Somehow, I think not. So what if many devs will probably have to contribute anonymously? With a product such as TrueCrypt, they probably should anyway.
        danielweber 12y ago
        been asked to introduce a backdoor from a Lavabit-style order This makes no sense. Lavabit was compelled to turn over evidence it told the government it had, which is straightforward law. There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that. If the developer's cat was kidnapped to force him to put in a backdoor, there is nothing "Lavabit-style" about that. You do hedge with the word "theoretically," but "theoretically" this could be a message from the aliens. Do you think that will stop people? It will stop the smart people, and you need smart people to work on it. Otherwise you would only be allowed to distribute it by illicit means, and you could never trust it. It would be as trustworthy as warez sites. Why even bother with that nonsense? Much saner to just build something new, having learned from TrueCrypt's experiences. For example, something that starts from the command-line and then has a GUI in top, instead of the reverse.
easytiger 12y ago
I find it interesting that it is only Microsoft Windows users really affected by this. What does that tell you about it as an ecosystem/platform?
- codeulike 12y ago
  It tells me all kinds of things that we've all known since the 90s.
  - easytiger 12y ago
    Having tried windows 8 recently i find it appalling how little it has changed. Even aesthetically it is diabolically a failure. There is no consistency and nothing makes sense. The removal of progress bars from system update functions is UX stupidity and having to reboot after every minor change is just embarrassing.

deleted 12y ago

[deleted]

nisa 12y ago

Just another theory but consider that the TrueCrypt team was always anonymous and considering that their licence is somewhat prohibitive for a open-source project it's not totally bonkers to assume that some agency or big coorporation developed TrueCrypt in secret and made it public to gain widespread assurance that there are no bugs in the code. Maybe they migrated away from XP and have assurance that Bitlocker is safe for them or switched to something entirely different and have no interest or funding for development it anymore...

blueskin_ 12y ago

>But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. That's the canary. Not only is bitlocker backdoored, and most TrueCrypt users would know that, but they also say it is available on all windows versions, which is eminently not the case.

outworlder 12y ago
Isn't a canary something that is 'removed', not 'added'? As in, the canary warns by being absent.
- Zancarius 12y ago
  Not in this case [1], or rather, not always. And if you consider where the term arose (canaries in mines), it's really an issue of state more than it is absence. If the state of the canary changes it's cause for alarm. In this situation, warrant canaries (or maybe an NSL canary as the case might be) is a subtle indication that everything is no longer in a known-good state and something has been compromised. Although given some of the comments by danielweber, I'm increasingly less inclined to believe this was a canary. Developers throwing in the towel might be a more plausible situation, no matter how disappointing that may be. [1] http://en.wikipedia.org/wiki/Warrant_canary http://en.wikipedia.org/wiki/Warrant_canary

tripzilch 12y ago

Another theory is that some component of the development environment to compile TrueCrypt requires XP. Remember the guy that tried to compile the TC source to match the binary? https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie... He needed to get some older version of Visual Studio and a very specific combination of service packs and updates in order to get to matching (nearly) the entire binary. Could it be that the devs really wanted to keep developing in XP because some part of their dev chain required it, but with support being discontinued they of course couldn't run XP and consider that computer "secure" to develop on? Obviously, if this theory has some grain of truth to it, it can only be part of the explanation for the TrueCrypt weirdness that's been going on today. If I had to bet on it, I would say it's most likely they got Lavabitten. But then still, the XP remark seems like a very odd choice if it's intended to function as a canary of sorts.

Lx1oG-AWb6h_ZG0 12y ago
> Another theory is that some component of the development environment to compile TrueCrypt requires XP This seems unlikely: the screenshots in your link clearly show the source could be built on Windows 7. The trouble Xavier mentions is with the updates to VS2008 SP1, not Windows service packs.
Bootvis 12y ago
I don't think that the EOL of XP has much do with it because they could simple air gap their Windows XP installation to continue development in a secure fashion. Unless, of course, something more shadowy is going on.

sliverstorm 12y ago

It's not a panic about XP. The presented reasoning is: - XP is the only widely used version of Windows with no built-in FDE - XP is finally, truly, EOL So TrueCrypt no longer needs to exist. (I'm not arguing that- that is what the message is saying)