7 ms·

Conjecture: TrueCrypt was developed by mainly by one person. This person did write TrueCrypt to encrypt his WinXP Laptop/PC, but does not need it anymore now, b

by tobias3 12y ago

Conjecture: TrueCrypt was developed by mainly by one person. This person did write TrueCrypt to encrypt his WinXP Laptop/PC, but does not need it anymore now, because he can now use Bitlocker. TrueCrypt is a consumer facing Open Source project. Those rarely have a large developer community and seldom get patches. Most successful ones are backed by corporate interests (Firefox, Eclipse, VirtualBox, ...). Having no need of TrueCrypt himself, no other developer in the community to whom he could entrust the project and faced with drudgery the like he probably also has at his job (except he gets payed there), he probably did not want to continue developing and improving TrueCrypt (e.g. EFI support). At this point. Since it is a critical security product there is no other option then to warn of all users. If there is a fork, it has to earn its reputation first. I view truecrypt.ch as a bad development, since a) TrueCrypt is trademarked by the developer and b) the TrueCrypt license explicitly says that you cannot fork the project without renaming it to something other than TrueCrypt. See https://www.grc.com/misc/truecrypt/truecrypt.htm https://www.grc.com/misc/truecrypt/truecrypt.htm "And then the TrueCrypt developers were heard from . . ."

nhayden 12y ago
My issue with the fork is the two guys who threw together the site to get "FIRST!!" dibs don't actually seem like developers capable or willing to continue the fork themselves. They just want credit for the work they want others to do for them.
JohnTHaller 12y ago
It is worth being clear that TrueCrypt is not an 'Open Source project'. The source is available, but it is under a proprietary license designed to discourage forks and reuse and allowing the original authors to sue you. The one-off TrueCrypt license means that TrueCrypt code can not be utilized under any OSI-recognized open source licenses as it is incompatible with them. The FSF, Ubuntu, etc all agree that TrueCrypt can't be considered open source. The source is available, but it's difficult for you to use it other than to analyze it.
- Netcob 12y ago
  I'm not an expert, but I thought there was a distinction between what's meant by "Open Source" and "Free Software". The way I understand it: Open Source: You can analyze the source code and build it yourself - which is great if you don't trust anyone to give you binaries from what you analyzed. Usually at least free as in "free beer". Free Software: Open source software which gives you lots of permissions via its license, while making sure you get to keep these permissions. Usually free as in "free speech" (in addition to "free beer"). TrueCrypt not being free as in speech is a bummer, but being able to inspect the code and build it yourself is a critical advantage, especially when it comes to cryptography. I have a hard time imagining BitLocker not having any backdoors built in. At the very least it'll have some kind of weak random number generator or whatever, making sure that with the right algorithm you get to crack it within a few minutes or so.
  - scribu 12y ago
    From Wikipedia [1]: "In production and development, open source as a development model promotes a) universal access via free license to a product's design or blueprint, and b) universal redistribution of that design or blueprint, including subsequent improvements to it by anyone" So no, "open source" doesn't just mean being able to read the source code; it also means being able to modify and redistribute it, just like "free software". The difference between the two terms isn't very meaningful in practical terms, IMHO. [1] http://en.wikipedia.org/wiki/Open_source http://en.wikipedia.org/wiki/Open_source
    - Tyr42 12y ago
      No, there is a meaningful difference [1]. Free (as in freedom) Software guarantees that the end user can always get, modify, and redistribute the source, by requiring any use of the source code to be under the same license. In short, copyleft. For example [2], since linksys modified and extended GPL'd code (the linux kernel) in creating the WRT54G wireless router, they had to release their work under the GPL too, which is how to OpenWrt project was created. The term Open Source applies to projects with more permissive licenses, such as the MIT license, where there is not obligation to release your modified version of the source to the end user. [1]: https://www.gnu.org/philosophy/free-software-for-freedom.html https://www.gnu.org/philosophy/free-software-for-freedom.htm... [2]: http://en.wikipedia.org/wiki/OpenWrt#History http://en.wikipedia.org/wiki/OpenWrt#History
u124556 12y ago
Who is going to complain if someone uses TrueCrypt's name? Can anonymous people retain copy rights over their work?
- rbobby 12y ago
  Given that copyright automatically attaches in a lot of countries... then yes anonymous people retain copyright over their work. However an anonymous person could not do anything about enforcing their copyright without losing their anonymity. You can't sue someone anonymously (you as the plaintiff), you can't DCMA anonymously, etc etc.
- webmaven 12y ago
  Yes, they can. Enforcing those rights is more difficult if you wish to remain anonymous, but still possible.
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
- harshreality 12y ago
  Is there a case anyone can point to where an anonymous plaintiff has sued someone over intellectual property authored anonymously?
  - SEJeff 12y ago
    In the United States, the 6th amendment, known as the "Confrontation Clause" is supposed to guarantee the right to see / know the accuser. It is literally baked into the constitution, otherwise anonymous trolls would be suing with no real recourse against them. I think anyone who thinks the answer to your question is yes is misinformed. http://en.m.wikipedia.org/wiki/Confrontation_Clause http://en.m.wikipedia.org/wiki/Confrontation_Clause
tptacek 12y ago
A person who the Truecrypt Audit Project has some evidence is the actual Truecrypt developer, in an email I've seen (because I'm working with the project), more or less confirmed this story. In particular: many people on HN seem to think that Linux Truecrypt is the most important product of the Truecrypt project, but the developers don't see it that way; they started the project for Windows, and Windows has good FDE now.
- sirsar 12y ago
  > Windows has good FDE now. Only for those running Ultimate or Enterprise edition. What's everyone else supposed to use?
  - deleted 12y ago
    [deleted]
  - w0rm 12y ago
    Well if encryption is that important you either buy a version of Windows which has FDE or you buy some other proprietary software which can do FDE. You can just keep using TrueCrypt until you need to upgrade Windows and get BitLocker supported edition.
  - wyager 12y ago
    > What's everyone else supposed to use? At the risk of sounding snarky, Linux? If you're not using Ultimate or Enterprise, you're probably not a business, so you probably don't have any business-critical applications that need to be run in Windows, so you can probably just use Linux for anything that needs to be kept encrypted.
    - sirsar 12y ago
      Switching to Linux is a conceptual and time-consuming burden that the average consumer will not deal with. Widespread adoption of encryption can only be achieved by making it as simple as possible.
      - 12y ago
imaginenore 12y ago
That "explanation" doesn't make any sense. BitLocker is not open source and is pretty much guaranteed to have a backdoor considering Snowden's leaks about Microsoft and NSA.
jordigh 12y ago
Truecrypt is not open source if its license is ever enforced. It forbids commercial distribution. This does not fit the open source definition, which means a lot more than merely "the source is visible". http://jordi.inversethought.com/blog/5-things-we-have-forgotten-about-open-source/ http://jordi.inversethought.com/blog/5-things-we-have-forgot...
- huhtenberg 12y ago
  It is open source, alright. You mean that it's not free in the FSF's definition of the term and that it indeed is.
  - jordigh 12y ago
    Please read my link. It is not open source in the sense of OSI's definition, who were the first ones to ever define open source. Furthermore, they trademark the term "open source", and they have even asked that you do not call truecrypt open source: it is not all appropriate for [TrueCrypt] to describe itself as "open source." This use of the term "open source" to describe something under a license that's not only unapproved by OSI but known to be subject to issues is unacceptable. (from http://www.infoworld.com/d/open-source-software/truecrypt-or-false-would-be-open-source-project-must-clean-its-act-230862 http://www.infoworld.com/d/open-source-software/truecrypt-or... )
    - huhtenberg 12y ago
      Will all due respect to OSI and its trademarks, a software with the source code that is open to the public is quite naturally described as "open source". Just by a simply virtue of dictionary definition of two words involved. I'm all for pedantry, but it's quite misplaced here.
      - jordigh 12y ago
        No. Please read my link. It is not naturally described as such, because nobody described it naturally as such before OSI came along. The dictionary definitions in this case lead you to the wrong conclusion about the meaning, just like at least one dictionary definition of "free" can lead to the wrong conclusion about what free software means. I am being pedantic about this because I want people to value the principles that open source is supposed to be about. I don't want people to forget what open source really means.

by tobias3 12y ago

nhayden 12y ago

My issue with the fork is the two guys who threw together the site to get "FIRST!!" dibs don't actually seem like developers capable or willing to continue the fork themselves. They just want credit for the work they want others to do for them.

JohnTHaller 12y ago

It is worth being clear that TrueCrypt is not an 'Open Source project'. The source is available, but it is under a proprietary license designed to discourage forks and reuse and allowing the original authors to sue you. The one-off TrueCrypt license means that TrueCrypt code can not be utilized under any OSI-recognized open source licenses as it is incompatible with them. The FSF, Ubuntu, etc all agree that TrueCrypt can't be considered open source. The source is available, but it's difficult for you to use it other than to analyze it.

Netcob 12y ago
I'm not an expert, but I thought there was a distinction between what's meant by "Open Source" and "Free Software". The way I understand it: Open Source: You can analyze the source code and build it yourself - which is great if you don't trust anyone to give you binaries from what you analyzed. Usually at least free as in "free beer". Free Software: Open source software which gives you lots of permissions via its license, while making sure you get to keep these permissions. Usually free as in "free speech" (in addition to "free beer"). TrueCrypt not being free as in speech is a bummer, but being able to inspect the code and build it yourself is a critical advantage, especially when it comes to cryptography. I have a hard time imagining BitLocker not having any backdoors built in. At the very least it'll have some kind of weak random number generator or whatever, making sure that with the right algorithm you get to crack it within a few minutes or so.
- scribu 12y ago
  From Wikipedia [1]: "In production and development, open source as a development model promotes a) universal access via free license to a product's design or blueprint, and b) universal redistribution of that design or blueprint, including subsequent improvements to it by anyone" So no, "open source" doesn't just mean being able to read the source code; it also means being able to modify and redistribute it, just like "free software". The difference between the two terms isn't very meaningful in practical terms, IMHO. [1] http://en.wikipedia.org/wiki/Open_source http://en.wikipedia.org/wiki/Open_source
  - Tyr42 12y ago
    No, there is a meaningful difference [1]. Free (as in freedom) Software guarantees that the end user can always get, modify, and redistribute the source, by requiring any use of the source code to be under the same license. In short, copyleft. For example [2], since linksys modified and extended GPL'd code (the linux kernel) in creating the WRT54G wireless router, they had to release their work under the GPL too, which is how to OpenWrt project was created. The term Open Source applies to projects with more permissive licenses, such as the MIT license, where there is not obligation to release your modified version of the source to the end user. [1]: https://www.gnu.org/philosophy/free-software-for-freedom.html https://www.gnu.org/philosophy/free-software-for-freedom.htm... [2]: http://en.wikipedia.org/wiki/OpenWrt#History http://en.wikipedia.org/wiki/OpenWrt#History

u124556 12y ago

Who is going to complain if someone uses TrueCrypt's name? Can anonymous people retain copy rights over their work?

rbobby 12y ago
Given that copyright automatically attaches in a lot of countries... then yes anonymous people retain copyright over their work. However an anonymous person could not do anything about enforcing their copyright without losing their anonymity. You can't sue someone anonymously (you as the plaintiff), you can't DCMA anonymously, etc etc.
webmaven 12y ago
Yes, they can. Enforcing those rights is more difficult if you wish to remain anonymous, but still possible.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
harshreality 12y ago
Is there a case anyone can point to where an anonymous plaintiff has sued someone over intellectual property authored anonymously?
- SEJeff 12y ago
  In the United States, the 6th amendment, known as the "Confrontation Clause" is supposed to guarantee the right to see / know the accuser. It is literally baked into the constitution, otherwise anonymous trolls would be suing with no real recourse against them. I think anyone who thinks the answer to your question is yes is misinformed. http://en.m.wikipedia.org/wiki/Confrontation_Clause http://en.m.wikipedia.org/wiki/Confrontation_Clause

tptacek 12y ago

A person who the Truecrypt Audit Project has some evidence is the actual Truecrypt developer, in an email I've seen (because I'm working with the project), more or less confirmed this story. In particular: many people on HN seem to think that Linux Truecrypt is the most important product of the Truecrypt project, but the developers don't see it that way; they started the project for Windows, and Windows has good FDE now.

sirsar 12y ago
> Windows has good FDE now. Only for those running Ultimate or Enterprise edition. What's everyone else supposed to use?
- deleted 12y ago
  [deleted]
- w0rm 12y ago
  Well if encryption is that important you either buy a version of Windows which has FDE or you buy some other proprietary software which can do FDE. You can just keep using TrueCrypt until you need to upgrade Windows and get BitLocker supported edition.
- wyager 12y ago
  > What's everyone else supposed to use? At the risk of sounding snarky, Linux? If you're not using Ultimate or Enterprise, you're probably not a business, so you probably don't have any business-critical applications that need to be run in Windows, so you can probably just use Linux for anything that needs to be kept encrypted.
  - sirsar 12y ago
    Switching to Linux is a conceptual and time-consuming burden that the average consumer will not deal with. Widespread adoption of encryption can only be achieved by making it as simple as possible.
    - 12y ago

imaginenore 12y ago

That "explanation" doesn't make any sense. BitLocker is not open source and is pretty much guaranteed to have a backdoor considering Snowden's leaks about Microsoft and NSA.

jordigh 12y ago

Truecrypt is not open source if its license is ever enforced. It forbids commercial distribution. This does not fit the open source definition, which means a lot more than merely "the source is visible". http://jordi.inversethought.com/blog/5-things-we-have-forgotten-about-open-source/ http://jordi.inversethought.com/blog/5-things-we-have-forgot...

huhtenberg 12y ago
It is open source, alright. You mean that it's not free in the FSF's definition of the term and that it indeed is.
- jordigh 12y ago
  Please read my link. It is not open source in the sense of OSI's definition, who were the first ones to ever define open source. Furthermore, they trademark the term "open source", and they have even asked that you do not call truecrypt open source: it is not all appropriate for [TrueCrypt] to describe itself as "open source." This use of the term "open source" to describe something under a license that's not only unapproved by OSI but known to be subject to issues is unacceptable. (from http://www.infoworld.com/d/open-source-software/truecrypt-or-false-would-be-open-source-project-must-clean-its-act-230862 http://www.infoworld.com/d/open-source-software/truecrypt-or... )
  - huhtenberg 12y ago
    Will all due respect to OSI and its trademarks, a software with the source code that is open to the public is quite naturally described as "open source". Just by a simply virtue of dictionary definition of two words involved. I'm all for pedantry, but it's quite misplaced here.
    - jordigh 12y ago
      No. Please read my link. It is not naturally described as such, because nobody described it naturally as such before OSI came along. The dictionary definitions in this case lead you to the wrong conclusion about the meaning, just like at least one dictionary definition of "free" can lead to the wrong conclusion about what free software means. I am being pedantic about this because I want people to value the principles that open source is supposed to be about. I don't want people to forget what open source really means.