3 ms·

Considering the licensing, its likely that the developers wanted to keep development to themselves, and never turn it over to someone else. If the ragequit theo

by skolor 12y ago

Considering the licensing, its likely that the developers wanted to keep development to themselves, and never turn it over to someone else. If the ragequit theory is correct, its fairly reasonable for them to remove the previous versions to make a fork slightly more difficult, especially since it would be an illegitimate fork.

zvrba 12y ago
It doesn't add up. You can't (easily) enforce licensing while remaining anonymous, so why bother with removing the earlier versions? If ragequitting, why bother with making a new release instead of just removing _everything_ and changing the webpage? (Presumably, you already have a copy of the SW if you have encrypted volumes.) Also, note "you _should_ migrate data". Could this imply that cold storage is not secure?
- skolor 12y ago
  The kind of person I can see maintaining Truecrypt for a decade I can also see making this decision. They're upset and are completely done with the project. They take down all the old versions, knowing that the licensing means they're largely useless for purposes of forking (unless you want to violate the licensing, which causes questions to the validity of the fork). Despite their frustration with the project, they still deeply care about crypto and keeping their users secure, so they publish some brief recommendations on alternatives, and release a read-only version of their software to support it. There are any number of possible vulnerabilities that could exist. Its definitely a plausible possibility. I could fairly easily believe that they were contacted by a researcher who was about to publish a major AES flaw, or one of the other algorithms in use. There's a number of relatively plausible theories. I wouldn't be surprised if we don't find out for 20 years what the actual reason for this was, when the developer is on their deathbed.

by skolor 12y ago

zvrba 12y ago

It doesn't add up. You can't (easily) enforce licensing while remaining anonymous, so why bother with removing the earlier versions? If ragequitting, why bother with making a new release instead of just removing _everything_ and changing the webpage? (Presumably, you already have a copy of the SW if you have encrypted volumes.) Also, note "you _should_ migrate data". Could this imply that cold storage is not secure?

skolor 12y ago
The kind of person I can see maintaining Truecrypt for a decade I can also see making this decision. They're upset and are completely done with the project. They take down all the old versions, knowing that the licensing means they're largely useless for purposes of forking (unless you want to violate the licensing, which causes questions to the validity of the fork). Despite their frustration with the project, they still deeply care about crypto and keeping their users secure, so they publish some brief recommendations on alternatives, and release a read-only version of their software to support it. There are any number of possible vulnerabilities that could exist. Its definitely a plausible possibility. I could fairly easily believe that they were contacted by a researcher who was about to publish a major AES flaw, or one of the other algorithms in use. There's a number of relatively plausible theories. I wouldn't be surprised if we don't find out for 20 years what the actual reason for this was, when the developer is on their deathbed.