9 ms·

TrueCrypt developer says no to license change for forking

102 points by chmars 12y ago

valarauca1 12y ago
It sounds like the developers found a critical flaw, and gave up. I'm not saying its purposely malicious government inserted, or just plan negligence. But from this response and how their website changed really makes me inclined to believe something is fundamentally broken in truecrypt.
- easytiger 12y ago
  I think its more likely the author is slightly unstable and has gotten pissed off at the public discussion around it
  - valarauca1 12y ago
    Eh in reality any decision or assumption is no more then us putting ourselves in the developers shoes based on the few communications that have took place. We likely won't know what happened for several years after, if we ever learn at all.
    - easytiger 12y ago
      I just find it hard to believe we can't work out who these people are. Impressive work on their part. bet the NSA do!
      - meapix 12y ago
        they might be nsa guys :) who knows.
  - Alupis 12y ago
    Or that people continue to bother him/her with bombarding emails, public cynical skepticism, baseless speculation, and more. How about we stop bothering the poor developer(s) and let them be. They have already contributed more to the world than most of us here - time for them to get the well deserved rest they seek.
    - thothamon 12y ago
      I'm happy to leave the dev alone. I don't really care about the dev one way or the other. What I don't like is to have some piece of infrastructure I've come to depend on yanked out suddenly, being mislead about the reasons, and being left with only onerous alternatives (rewrite the whole thing or stick with 7.1a indefinitely). That these two options are onerous is not speculation or simply some kind of bad attitude. It is a fact. Whether this action was deliberate or just incredibly clueless and negligent, treating TrueCrypt users this way is crappy, and I think it's OK to say so publicly. I'm grateful for the development of TrueCrypt. But that gratitude doesn't translate to a free pass for all subsequent terrible behavior afterward. If the dev's identity was known, he/she might take a lot more heat than a few harsh words. Considering the needless trouble he's putting people through, a strongly-worded letter of protest is a pretty mild reaction.
      - danielweber 12y ago
        It sounds like you should pay money for software. If no one is willing to sell you a support contract, don't use it.
        watwut 12y ago
        Well know cryptographers opinion on this topic: https://twitter.com/matthew_d_green/status/478956352237076480 https://twitter.com/matthew_d_green/status/47895635223707648... He tweeted: Most commercial encryption products are junk.
- deleted 12y ago
  [deleted]
- tptacek 12y ago
  Can I ask whether you have a background in encryption or in disk software sufficient to make such a determination authoritatively? Because I know several people that do have that background and none of them have come to this conclusion. It would be interesting to know why your interpretation should be taken more seriously than theirs. I put it this way --- bluntly, aggressively --- because there's a drive-by element to your comment; "critical flaw", "fundamentally broken", but absolutely no details whatsoever.
  - cwp 12y ago
    Did valarauca1 claim that anyone should defer to his crypto-expertise and detailed analysis? He basically said, "The behaviour of this developer makes me not want to trust his work." His assessment isn't definitive, but he seems to be aware of that; note the phrases "sounds like" and "makes me inclined to believe". And I'd say he has a point. Laying aside your expertise for a moment, and without going all the way to declaring it fundamentally broken, don't you think there's something a little fishy in all this?
    - danielweber 12y ago
      "There is something fishy" is true because projects don't normally shut down so suddenly. But a lot of TC has always been usual, from its license to the hidden identity of its developer[1]. For whatever reason, he[1]'s done with the project. Maybe the wife and kids are more interesting these days. Maybe he got offended at auditors being paid and not him. Maybe he feels a responsibility towards his users and since he cannot actively defend them he wants them to move inside someone else's castle. Maybe he died and his brother took over the account long enough to say "we're done" and his brother really doesn't want to talk about it no matter how weird you think it is that his brother doesn't want a bunch of people on the Internet on his lawn like they were on Satoshi's. It's like a bunch of blind cryptographers trying to describe an elephant. [1] Assuming a heterosexual singular male just for convention.
      - tptacek 12y ago
        A person experts involved in the TC audit have reason to believe is involved in the TC project sent an email, which I read, which said (paraphrased) "We started TC to get Windows disk encryption. Windows now has better disk encryption. We're done." I know that's shocking to OSS developers, but not everyone cares (at all) about Linux.
jrochkind1 12y ago
It's unclear to me if the licensing terms of TrueCrypt allow others to fork it even without the developer's permission, perhaps without the TrueCrypt name? Resources were invested by some to audit the code. The developer is uninterested in letting the code go on. I think the lesson is, don't invest significant resources in supporting a shared codebase, unless it's got a license that will let people continue to use/develop the codebase even without the original developer/owner's permission.
- ordinary 12y ago
  No, they don't. You're allowed to inspect the source code for any reason, but the license does not allow redistribution or modification. TrueCrypt is not open source or free software.
  - yebyen 12y ago
    I don't remember hearing that redistribution wasn't allowed, I'll admit I haven't read the license carefully, but what I understood was the original license forbade modifications through the advertising clause (making it incompatible with open-source licenses): If you take and modify the source, you must remove all references to the "TrueCrypt" name inside of the source code and program interface and not call it TrueCrypt. If you redistribute it unmodified, you must leave the "TrueCrypt" name intact. I don't have a source for the second term, but it would seem to be impossible to have an unmodified work that didn't call itself TrueCrypt -- by removing TrueCrypt branding, you fulfilled the terms of the first part, even if the functionality of the software was actually unchanged.
    - Dylan16807 12y ago
      So the license is non-free because it duplicates trademark law within itself? It's annoying how things with no real impact can ruin compatibility.
      - yebyen 12y ago
        This is a funny thing about FOSS licenses, and I guess a commonly known thing about the advertising clause as it relates to FOSS licensing. The wording in the GPL that causes this situation I believe is: "No additional restrictions may be placed on the redistribution of either the original work or a derivative work." The intent of the advertising clause is to assert and maintain control over the software in the hands of the creator/owner; this is fundamentally incompatible with FOSS ideology, where anyone can fork and edit, and the leadership of the project is "de-facto" as in the eyes of a community rather than "de-jure". That being said, it is annoying.
MichaelStubbs 12y ago
I can only assume that the person who posted this was "Matt" as signed off on the original email, but Matt who? Why should we trust this?
- Y0nash 12y ago
  Matthew Green https://twitter.com/matthew_d_green/status/478721271316758528 https://twitter.com/matthew_d_green/status/47872127131675852...
Jedd 12y ago
In 2006 or 2007 I was running a non-trivially sized project for a government agency, and we wanted to use TrueCrypt on every new machine we were rolling out. The default licensing arrangement certainly meant we were (legally) covered, but we sought out the author and offered a financial arrangement in terms of support (we weren't proposing an especially onerous arrangement, and were quite clear in our 'improvements we fund, we're happy to go back to GPL' and it was very much an early stage of negotiations from our perspective). Weirdly it was dismissed outright. Highly anecdotal, and the guy I had that contacted the TrueCrypt author may have given the wrong impression (unlikely), but since then I've always felt the project was in the 'slightly odd' category.
- jacquesm 12y ago
  Or maybe he just figured that taking money would mean that people would make assumptions about services rendered for that payment. Sometimes it is better to not be associated with certain sources of funding if you want to keep your reputation clean and not being the subject of 'sold out' claims even if that isn't the case.
  - Jedd 12y ago
    Sure, and while I can't recall the precise details of the correspondence, we were certainly very sensitive to that. I'm a long-term free software advocate, and the network admin that was talking to the TrueCrypt author(s) was similarly minded, so there was absolutely no question we were seeking to taint the licence, risk the independence, demand credit or attribution, or anything along those lines. Part of advocating free software in government agencies then (and probably also now) is that you are obliged to CYA in terms of having some mechanism by which you can demonstrate you can obtain support in the unlikely event of problems. It's a real pain in some cases (such as this), but in practice it's usually lip service at worst. We were under no illusions - we'd heavily tested the software, and knew it was fit for purpose (it was a Windows XP rollout, so pretty well trodden ground). We were confident we'd never have to contact them again, once we'd thrown them some cash.
  - pasbesoin 12y ago
    I would suggest that going to work for "the/this government", even on a contract basis, may and probably has all sorts of implications including perhaps a majority of which and the most concerning are not actually spelled out in the direct contract, itself. Just trying to evaluate what those might include could be a very extensive and unachievable exercise. I can imagine someone in a position like that of the TrueCrypt developers being loathe to enter into a scenario bringing with it such ramifications. Even setting aside any personal ideology, it has the appearance of a swamp in need of the obligatory sign, "Here Be Dragons". Just my blue sky speculation, but based upon a number of years of casual and outside observation of facts and anecdotes that make it into the sphere of public knowledge.
harshreality 12y ago
If the author is not willing to unmask him or herself, I'm not convinced courts would allow an author to maintain anonymity while suing you for copyright violation. Particularly given the specifics of this case: the copyrighted work being freely available, and the author publicly stating that it's abandoned.
- danielweber 12y ago
  You can certainly keep on using it, and the license probably allows you to modify it on our own for internal existing projects. So it will be around for a little while. But why try to keep the dead horse alive? TC is really weirdly written, as a GUI app that has a command-line stapled onto it, instead of the other way around. (Last time I built it for a headless machine, I still needed wxWidgets.) Especially with the specter, even unlikely, that some unknown person may possibly rise up to claim ownership of the project someday. We should understand TC because we're using it, but we should think about the next thing.
- tjaerv 12y ago
  http://commons.wikimedia.org/wiki/Commons:Anonymous_works http://commons.wikimedia.org/wiki/Commons:Anonymous_works
  - harshreality 12y ago
    Copyright violations only matter (legally speaking) if someone is willing and able to sue.
    - nitrogen 12y ago
      If you have the right to copyright under a pen name, should you not also have the right to sue without revealing your identity? A right that can't be exercised doesn't exist.
      - agwa 12y ago
        Rights can come in conflict with one another, and when this happens one has to yield. The public has the right to open court records, and defendants have the right to know who's suing them. These rights usually outweigh any right the plaintiff may have in suing anonymously. It is possible to sue anonymously in the U.S. (e.g. "Jane Roe" of Roe v. Wade was a pseudonym) but IANAL so I don't know by what standard this is determined or whether the TrueCrypt dev(s) would qualify.
SeanDav 12y ago
The TrueCrypt developer(s) may be under a government gag order and this may just be their way of letting us know without saying "The Government can crack TrueCrypt, it is not fit for purpose anymore" This may be another Lavabit situation.
- danielweber 12y ago
  Or aliens.
  - deleted 12y ago
    [deleted]
    - deleted 12y ago
      [deleted]
  - deleted 12y ago
    [deleted]
- tptacek 12y ago
  Apart from one Tor developer who, without presenting any details, claims there was a "warrant canary" from Truecrypt almost 10 years ago, can you cite a single crypto expert who believes that this is the case? Or are you just saying about Truecrypt what you could say about virtually any other privacy-relevant software on the Internet at any time?
  - tedunangst 12y ago
    But there's a secret message in Latin. How much more proof could you ask for?
- winfred 12y ago
  If that's the case (and it doesn't seem that unlikely to me), I think a thank you is in order. Thanks buddy!
Y0nash 12y ago
I can see 3 possible scenarios: 1) Gov gave him "An Offer He Can't Refuse". 2) It's not him. He is either dead or in prison. 3) He is an asshole or mentally unstable.
- danielweber 12y ago
  Yeah, he gave the world a bunch of work for free. Total asshole, man!!1 Fuck him right in the ear!! Srsly: TC always had a weird license and we accepted it because the rest of the product (seemed to) work so well. He doesn't owe anyone anything.
  - Y0nash 12y ago
    Without commercial intentions he gives something for free, yet he forbids others from using it however they want. He also gave a completely vague reply to all the requests and arguments.
    - pessimizer 12y ago
      Could anything be clearer than: "I don't feel that forking truecrypt would be a good idea,[...]. I believe that starting from scratch wouldn't require much more work than actually learning and understanding all of truecrypts current codebase." ?
      - Y0nash 12y ago
        And you consider this a proper answer? Have you actually read the whole email? My personal opinion remains the same, but maybe let's just agree to disagree?
        verbatim 12y ago
        It seems like a pretty good answer to me. If he feels that the code is bad enough that newcomers are unlikely to efficiently be able to work with it and not make it unsafe by making mistakes, he's probably correct.
merlish 12y ago
Being forced to start from scratch seems a real shame. TrueCrypt as it is, is a reasonably stable and mature piece of technology. Far better to swap out the broken/substandard bits than start solving a fundamentally hard problem all over again from step one. There is no guarantee that a rewrite would be better than the original. And it will take man-years worth of effort to get even to where TrueCrypt is right now.
- pessimizer 12y ago
  It's not always easier to swap out broken/substandard bits than to start over again with the original as a reference. In the opinion of this particular Truecrypt developer, in this particular case it would not be.
Spoom 12y ago
So fork it anyway and call it something else. According to the license[1], this is permitted. 1. https://www.ohloh.net/licenses/TrueCrypt_Collective_License https://www.ohloh.net/licenses/TrueCrypt_Collective_License (see section III)
- deleted 12y ago
  [deleted]
- tobias3 12y ago
  Yes, the title should not say "TrueCrypt developer says no to license change for forking" but "TrueCrypt developer says no to license change for forking with the same name and removing copyleft"
morsch 12y ago
Typically using source code as a direct reference would mark the product as a derived work. You need an appropriate free license to do it. I wonder if this written premission is enough to remove the taint.
danbruc 12y ago
I used to think that - at least sometimes - redeveloping something from scratch is a good idea but in the last couple of years I realized that this rarely if ever the case. The problem is that you will introduce a lot of new bugs and reintroduce bugs that got fixed long ago. There is no good reason to believe that you can develop a piece of software without making hundreds of the common small mistakes that just happen - off by one, switched sign, missing null checks, you name it. And even if you have to deal with one of the worst code bases you have ever seen, the developers will already have spent countless hours wiping out such problems. Starting from scratch not only means getting rid of bad code, it also means throwing a lot of useful work overboard. So if I have to deal with The-Worst-Code-Base-Ever™ I create a new project and copy the code into the new project file by file in the order you would develop from scratch and clean it up before moving on to the next file. Improve the naming, split large functions, extract common code, unify similar code, look for and fix bugs, improve algorithms, comment out code that references code not yet in the new project or code not yet used and when there is a good opportunity improve the architecture - given that you already understand the code base well enough. It takes time, you touch some files a hundred times and move around bits and pieces seemingly forever, but I am pretty confident the result is better than rewriting everything from scratch. All this might be not such a good idea without good tool support, but if moving and renaming things or changing function signatures project wide is just a matter of seconds, there is real value in doing it incrementally instead of trying to do and get it right all at once.
- illumen 12y ago
  Starting with tests is usually a better first step. Mostly functional tests are easiest to write. If you can find parts to replace into separate services, that is best. So you can slowly migrate the system, whilst gaining the benefits quickly for the new code. That way, if the project takes a year, bug fixes can happen in the new code. Also features can be added to the new code. Also, if after a year and the old system is still being used, then valid questions may be asked about what use the new system is. YMWNV
lasermike026 12y ago
No fork? Clone.
bollockitis 12y ago
I generally don't advocate complete rewrites, but it seems to be the best option in this scenario. Why is everyone so opposed to doing this? I don't mean that rhetorically. I truly don't understand. I don't want to downplay the difficulty of such a project, but I regularly see brilliant developers here at HN and elsewhere scrambling to create something meaningful. Here's an excellent opportunity to build something that would have widespread use, with both cultural and political impact, yet there seems to be a lot of reluctance to actually take on such a project. Instead, we keep speculating about anonymous developers who have made it clear that they're done and want nothing to do with it anymore. We even have permission to use TrueCrypt for reference. Seems like an awesome opportunity for developers smart enough to do it.
- na85 12y ago
  Agree. Unfortunately it seems to me that people on this site would rather create yet another jsframework.js or Flappy Bird As A Service as opposed to something like NewCrypt. Pretty standard for the Hacker News crowd in my experience.
  - tacotime 12y ago
    Oh my god, can you get me in the FBaaS beta?
  - LaikaF 12y ago
    I think there is different level of difficulty between the two things you just described. And I'm pretty sure crypto is hard to work with and get right, and one mistake removes the purpose of software.
    - na85 12y ago
      Of course it's a different level of difficulty. People seem to overwhelmingly prefer to work on easy, shallow projects as opposed to hard, meaningful ones.
      - 12y ago
JoshTriplett 12y ago
There's an Open Source implementation for Linux at https://github.com/bwalex/tc-play https://github.com/bwalex/tc-play ; perhaps that would serve as a better starting point.
deleted 12y ago
[deleted]
drunkcatsdgaf 12y ago
LibreCrypt around the corner
- tptacek 12y ago
  That would be unlikely, since OpenBSD doesn't use Truecrypt.

102 points by chmars 12y ago

It sounds like the developers found a critical flaw, and gave up. I'm not saying its purposely malicious government inserted, or just plan negligence. But from this response and how their website changed really makes me inclined to believe something is fundamentally broken in truecrypt.

easytiger 12y ago
I think its more likely the author is slightly unstable and has gotten pissed off at the public discussion around it
- valarauca1 12y ago
  Eh in reality any decision or assumption is no more then us putting ourselves in the developers shoes based on the few communications that have took place. We likely won't know what happened for several years after, if we ever learn at all.
  - easytiger 12y ago
    I just find it hard to believe we can't work out who these people are. Impressive work on their part. bet the NSA do!
    - meapix 12y ago
      they might be nsa guys :) who knows.
- Alupis 12y ago
  Or that people continue to bother him/her with bombarding emails, public cynical skepticism, baseless speculation, and more. How about we stop bothering the poor developer(s) and let them be. They have already contributed more to the world than most of us here - time for them to get the well deserved rest they seek.
  - thothamon 12y ago
    I'm happy to leave the dev alone. I don't really care about the dev one way or the other. What I don't like is to have some piece of infrastructure I've come to depend on yanked out suddenly, being mislead about the reasons, and being left with only onerous alternatives (rewrite the whole thing or stick with 7.1a indefinitely). That these two options are onerous is not speculation or simply some kind of bad attitude. It is a fact. Whether this action was deliberate or just incredibly clueless and negligent, treating TrueCrypt users this way is crappy, and I think it's OK to say so publicly. I'm grateful for the development of TrueCrypt. But that gratitude doesn't translate to a free pass for all subsequent terrible behavior afterward. If the dev's identity was known, he/she might take a lot more heat than a few harsh words. Considering the needless trouble he's putting people through, a strongly-worded letter of protest is a pretty mild reaction.
    - danielweber 12y ago
      It sounds like you should pay money for software. If no one is willing to sell you a support contract, don't use it.
      - watwut 12y ago
        Well know cryptographers opinion on this topic: https://twitter.com/matthew_d_green/status/478956352237076480 https://twitter.com/matthew_d_green/status/47895635223707648... He tweeted: Most commercial encryption products are junk.
deleted 12y ago
[deleted]
tptacek 12y ago
Can I ask whether you have a background in encryption or in disk software sufficient to make such a determination authoritatively? Because I know several people that do have that background and none of them have come to this conclusion. It would be interesting to know why your interpretation should be taken more seriously than theirs. I put it this way --- bluntly, aggressively --- because there's a drive-by element to your comment; "critical flaw", "fundamentally broken", but absolutely no details whatsoever.
- cwp 12y ago
  Did valarauca1 claim that anyone should defer to his crypto-expertise and detailed analysis? He basically said, "The behaviour of this developer makes me not want to trust his work." His assessment isn't definitive, but he seems to be aware of that; note the phrases "sounds like" and "makes me inclined to believe". And I'd say he has a point. Laying aside your expertise for a moment, and without going all the way to declaring it fundamentally broken, don't you think there's something a little fishy in all this?
  - danielweber 12y ago
    "There is something fishy" is true because projects don't normally shut down so suddenly. But a lot of TC has always been usual, from its license to the hidden identity of its developer[1]. For whatever reason, he[1]'s done with the project. Maybe the wife and kids are more interesting these days. Maybe he got offended at auditors being paid and not him. Maybe he feels a responsibility towards his users and since he cannot actively defend them he wants them to move inside someone else's castle. Maybe he died and his brother took over the account long enough to say "we're done" and his brother really doesn't want to talk about it no matter how weird you think it is that his brother doesn't want a bunch of people on the Internet on his lawn like they were on Satoshi's. It's like a bunch of blind cryptographers trying to describe an elephant. [1] Assuming a heterosexual singular male just for convention.
    - tptacek 12y ago
      A person experts involved in the TC audit have reason to believe is involved in the TC project sent an email, which I read, which said (paraphrased) "We started TC to get Windows disk encryption. Windows now has better disk encryption. We're done." I know that's shocking to OSS developers, but not everyone cares (at all) about Linux.

jrochkind1 12y ago

It's unclear to me if the licensing terms of TrueCrypt allow others to fork it even without the developer's permission, perhaps without the TrueCrypt name? Resources were invested by some to audit the code. The developer is uninterested in letting the code go on. I think the lesson is, don't invest significant resources in supporting a shared codebase, unless it's got a license that will let people continue to use/develop the codebase even without the original developer/owner's permission.

ordinary 12y ago
No, they don't. You're allowed to inspect the source code for any reason, but the license does not allow redistribution or modification. TrueCrypt is not open source or free software.
- yebyen 12y ago
  I don't remember hearing that redistribution wasn't allowed, I'll admit I haven't read the license carefully, but what I understood was the original license forbade modifications through the advertising clause (making it incompatible with open-source licenses): If you take and modify the source, you must remove all references to the "TrueCrypt" name inside of the source code and program interface and not call it TrueCrypt. If you redistribute it unmodified, you must leave the "TrueCrypt" name intact. I don't have a source for the second term, but it would seem to be impossible to have an unmodified work that didn't call itself TrueCrypt -- by removing TrueCrypt branding, you fulfilled the terms of the first part, even if the functionality of the software was actually unchanged.
  - Dylan16807 12y ago
    So the license is non-free because it duplicates trademark law within itself? It's annoying how things with no real impact can ruin compatibility.
    - yebyen 12y ago
      This is a funny thing about FOSS licenses, and I guess a commonly known thing about the advertising clause as it relates to FOSS licensing. The wording in the GPL that causes this situation I believe is: "No additional restrictions may be placed on the redistribution of either the original work or a derivative work." The intent of the advertising clause is to assert and maintain control over the software in the hands of the creator/owner; this is fundamentally incompatible with FOSS ideology, where anyone can fork and edit, and the leadership of the project is "de-facto" as in the eyes of a community rather than "de-jure". That being said, it is annoying.

MichaelStubbs 12y ago

I can only assume that the person who posted this was "Matt" as signed off on the original email, but Matt who? Why should we trust this?

Y0nash 12y ago
Matthew Green https://twitter.com/matthew_d_green/status/478721271316758528 https://twitter.com/matthew_d_green/status/47872127131675852...

Jedd 12y ago

In 2006 or 2007 I was running a non-trivially sized project for a government agency, and we wanted to use TrueCrypt on every new machine we were rolling out. The default licensing arrangement certainly meant we were (legally) covered, but we sought out the author and offered a financial arrangement in terms of support (we weren't proposing an especially onerous arrangement, and were quite clear in our 'improvements we fund, we're happy to go back to GPL' and it was very much an early stage of negotiations from our perspective). Weirdly it was dismissed outright. Highly anecdotal, and the guy I had that contacted the TrueCrypt author may have given the wrong impression (unlikely), but since then I've always felt the project was in the 'slightly odd' category.

jacquesm 12y ago
Or maybe he just figured that taking money would mean that people would make assumptions about services rendered for that payment. Sometimes it is better to not be associated with certain sources of funding if you want to keep your reputation clean and not being the subject of 'sold out' claims even if that isn't the case.
- Jedd 12y ago
  Sure, and while I can't recall the precise details of the correspondence, we were certainly very sensitive to that. I'm a long-term free software advocate, and the network admin that was talking to the TrueCrypt author(s) was similarly minded, so there was absolutely no question we were seeking to taint the licence, risk the independence, demand credit or attribution, or anything along those lines. Part of advocating free software in government agencies then (and probably also now) is that you are obliged to CYA in terms of having some mechanism by which you can demonstrate you can obtain support in the unlikely event of problems. It's a real pain in some cases (such as this), but in practice it's usually lip service at worst. We were under no illusions - we'd heavily tested the software, and knew it was fit for purpose (it was a Windows XP rollout, so pretty well trodden ground). We were confident we'd never have to contact them again, once we'd thrown them some cash.
- pasbesoin 12y ago
  I would suggest that going to work for "the/this government", even on a contract basis, may and probably has all sorts of implications including perhaps a majority of which and the most concerning are not actually spelled out in the direct contract, itself. Just trying to evaluate what those might include could be a very extensive and unachievable exercise. I can imagine someone in a position like that of the TrueCrypt developers being loathe to enter into a scenario bringing with it such ramifications. Even setting aside any personal ideology, it has the appearance of a swamp in need of the obligatory sign, "Here Be Dragons". Just my blue sky speculation, but based upon a number of years of casual and outside observation of facts and anecdotes that make it into the sphere of public knowledge.

harshreality 12y ago

If the author is not willing to unmask him or herself, I'm not convinced courts would allow an author to maintain anonymity while suing you for copyright violation. Particularly given the specifics of this case: the copyrighted work being freely available, and the author publicly stating that it's abandoned.

danielweber 12y ago
You can certainly keep on using it, and the license probably allows you to modify it on our own for internal existing projects. So it will be around for a little while. But why try to keep the dead horse alive? TC is really weirdly written, as a GUI app that has a command-line stapled onto it, instead of the other way around. (Last time I built it for a headless machine, I still needed wxWidgets.) Especially with the specter, even unlikely, that some unknown person may possibly rise up to claim ownership of the project someday. We should understand TC because we're using it, but we should think about the next thing.
tjaerv 12y ago
http://commons.wikimedia.org/wiki/Commons:Anonymous_works http://commons.wikimedia.org/wiki/Commons:Anonymous_works
- harshreality 12y ago
  Copyright violations only matter (legally speaking) if someone is willing and able to sue.
  - nitrogen 12y ago
    If you have the right to copyright under a pen name, should you not also have the right to sue without revealing your identity? A right that can't be exercised doesn't exist.
    - agwa 12y ago
      Rights can come in conflict with one another, and when this happens one has to yield. The public has the right to open court records, and defendants have the right to know who's suing them. These rights usually outweigh any right the plaintiff may have in suing anonymously. It is possible to sue anonymously in the U.S. (e.g. "Jane Roe" of Roe v. Wade was a pseudonym) but IANAL so I don't know by what standard this is determined or whether the TrueCrypt dev(s) would qualify.

SeanDav 12y ago

The TrueCrypt developer(s) may be under a government gag order and this may just be their way of letting us know without saying "The Government can crack TrueCrypt, it is not fit for purpose anymore" This may be another Lavabit situation.

danielweber 12y ago
Or aliens.
- deleted 12y ago
  [deleted]
  - deleted 12y ago
    [deleted]
- deleted 12y ago
  [deleted]
tptacek 12y ago
Apart from one Tor developer who, without presenting any details, claims there was a "warrant canary" from Truecrypt almost 10 years ago, can you cite a single crypto expert who believes that this is the case? Or are you just saying about Truecrypt what you could say about virtually any other privacy-relevant software on the Internet at any time?
- tedunangst 12y ago
  But there's a secret message in Latin. How much more proof could you ask for?
winfred 12y ago
If that's the case (and it doesn't seem that unlikely to me), I think a thank you is in order. Thanks buddy!

Y0nash 12y ago

I can see 3 possible scenarios: 1) Gov gave him "An Offer He Can't Refuse". 2) It's not him. He is either dead or in prison. 3) He is an asshole or mentally unstable.

danielweber 12y ago
Yeah, he gave the world a bunch of work for free. Total asshole, man!!1 Fuck him right in the ear!! Srsly: TC always had a weird license and we accepted it because the rest of the product (seemed to) work so well. He doesn't owe anyone anything.
- Y0nash 12y ago
  Without commercial intentions he gives something for free, yet he forbids others from using it however they want. He also gave a completely vague reply to all the requests and arguments.
  - pessimizer 12y ago
    Could anything be clearer than: "I don't feel that forking truecrypt would be a good idea,[...]. I believe that starting from scratch wouldn't require much more work than actually learning and understanding all of truecrypts current codebase." ?
    - Y0nash 12y ago
      And you consider this a proper answer? Have you actually read the whole email? My personal opinion remains the same, but maybe let's just agree to disagree?
      - verbatim 12y ago
        It seems like a pretty good answer to me. If he feels that the code is bad enough that newcomers are unlikely to efficiently be able to work with it and not make it unsafe by making mistakes, he's probably correct.

merlish 12y ago

Being forced to start from scratch seems a real shame. TrueCrypt as it is, is a reasonably stable and mature piece of technology. Far better to swap out the broken/substandard bits than start solving a fundamentally hard problem all over again from step one. There is no guarantee that a rewrite would be better than the original. And it will take man-years worth of effort to get even to where TrueCrypt is right now.

pessimizer 12y ago
It's not always easier to swap out broken/substandard bits than to start over again with the original as a reference. In the opinion of this particular Truecrypt developer, in this particular case it would not be.

Spoom 12y ago

So fork it anyway and call it something else. According to the license[1], this is permitted. 1. https://www.ohloh.net/licenses/TrueCrypt_Collective_License https://www.ohloh.net/licenses/TrueCrypt_Collective_License (see section III)

deleted 12y ago
[deleted]
tobias3 12y ago
Yes, the title should not say "TrueCrypt developer says no to license change for forking" but "TrueCrypt developer says no to license change for forking with the same name and removing copyleft"

morsch 12y ago

Typically using source code as a direct reference would mark the product as a derived work. You need an appropriate free license to do it. I wonder if this written premission is enough to remove the taint.

danbruc 12y ago

I used to think that - at least sometimes - redeveloping something from scratch is a good idea but in the last couple of years I realized that this rarely if ever the case. The problem is that you will introduce a lot of new bugs and reintroduce bugs that got fixed long ago. There is no good reason to believe that you can develop a piece of software without making hundreds of the common small mistakes that just happen - off by one, switched sign, missing null checks, you name it. And even if you have to deal with one of the worst code bases you have ever seen, the developers will already have spent countless hours wiping out such problems. Starting from scratch not only means getting rid of bad code, it also means throwing a lot of useful work overboard. So if I have to deal with The-Worst-Code-Base-Ever™ I create a new project and copy the code into the new project file by file in the order you would develop from scratch and clean it up before moving on to the next file. Improve the naming, split large functions, extract common code, unify similar code, look for and fix bugs, improve algorithms, comment out code that references code not yet in the new project or code not yet used and when there is a good opportunity improve the architecture - given that you already understand the code base well enough. It takes time, you touch some files a hundred times and move around bits and pieces seemingly forever, but I am pretty confident the result is better than rewriting everything from scratch. All this might be not such a good idea without good tool support, but if moving and renaming things or changing function signatures project wide is just a matter of seconds, there is real value in doing it incrementally instead of trying to do and get it right all at once.

illumen 12y ago
Starting with tests is usually a better first step. Mostly functional tests are easiest to write. If you can find parts to replace into separate services, that is best. So you can slowly migrate the system, whilst gaining the benefits quickly for the new code. That way, if the project takes a year, bug fixes can happen in the new code. Also features can be added to the new code. Also, if after a year and the old system is still being used, then valid questions may be asked about what use the new system is. YMWNV

lasermike026 12y ago

No fork? Clone.

bollockitis 12y ago

I generally don't advocate complete rewrites, but it seems to be the best option in this scenario. Why is everyone so opposed to doing this? I don't mean that rhetorically. I truly don't understand. I don't want to downplay the difficulty of such a project, but I regularly see brilliant developers here at HN and elsewhere scrambling to create something meaningful. Here's an excellent opportunity to build something that would have widespread use, with both cultural and political impact, yet there seems to be a lot of reluctance to actually take on such a project. Instead, we keep speculating about anonymous developers who have made it clear that they're done and want nothing to do with it anymore. We even have permission to use TrueCrypt for reference. Seems like an awesome opportunity for developers smart enough to do it.

na85 12y ago
Agree. Unfortunately it seems to me that people on this site would rather create yet another jsframework.js or Flappy Bird As A Service as opposed to something like NewCrypt. Pretty standard for the Hacker News crowd in my experience.
- tacotime 12y ago
  Oh my god, can you get me in the FBaaS beta?
- LaikaF 12y ago
  I think there is different level of difficulty between the two things you just described. And I'm pretty sure crypto is hard to work with and get right, and one mistake removes the purpose of software.
  - na85 12y ago
    Of course it's a different level of difficulty. People seem to overwhelmingly prefer to work on easy, shallow projects as opposed to hard, meaningful ones.
    - 12y ago

JoshTriplett 12y ago

There's an Open Source implementation for Linux at https://github.com/bwalex/tc-play https://github.com/bwalex/tc-play ; perhaps that would serve as a better starting point.

deleted 12y ago

[deleted]

drunkcatsdgaf 12y ago

LibreCrypt around the corner

tptacek 12y ago
That would be unlikely, since OpenBSD doesn't use Truecrypt.