14 ms·

I think the interesting lesson from this is less about crypto, more about free-software projects and how to grow them. The Truecrypt developers supposedly left

by tedks 12y ago

I think the interesting lesson from this is less about crypto, more about free-software projects and how to grow them. The Truecrypt developers supposedly left because it wasn't interesting/fun for them anymore. I believe that. Funding this audit required ~$65k in donations, probably more than the Truecrypt project ever saw. If you were the developer of a project that you knew was solid, and you knew had no backdoors, how would you feel about people essentially maligning you being able to generate more cash than you've ever seen for your side project? That'd make me want to quit too. At the end of the day, which is more preferable -- a TrueCrypt that was never audited professionally, or a TrueCrypt with active developers? How can we ensure security in open-source software without driving the developers away in the future? I think one way would be to match every single audit donation with a donation to the upstream developers. If it's worth spending a dollar to audit software, it's worth spending a dollar to keep that project alive and show the developer you care. It would have taken twice as long to get the audit funded, but maybe then the developer wouldn't have been hounded away. Personally, though, I think this audit was a colossal waste of time and resources. All it told us was something every truecrypt user was assuming already, and it cost us all Truecrypt. What guarantee is there any of the new developers are going to be as trustworthy as the original developers, or as skilled?

tptacek 12y ago
The Truecrypt Audit Project did not "cost you Truecrypt". The primary reason the project was abandoned was that it's a 3rd party package that implements something every operating system now implements for itself, better than Truecrypt could. There is a mythology among Linux Truecrypt users that the whole project was an effort to create a cross-platform encrypted disk scheme to free users from the tyrannical yoke of I don't know LUKS, but I've seen zero evidence that such a goal was particularly important to actual TC developers.
- sfk 12y ago
  This fact must have been known to Matt Green et al.! Why did they waste 65k on an evidently obsolete project? Also, (as far as I know) all public evidence for your assertion is a purported email from one of the devs to Matt Green. He might just have been polite in that mail...
  - tptacek 12y ago
    Both Matt Green and I donated to the project. The reason: thousands of people actually use Truecrypt, and it's important to know how safe their data actually was. I'm amused by the idea that the actual words of the TC developers are less credible than whatever random thoughts are bubbling around a message board. But, HN, what are you gonna do.
    - sfk 12y ago
      That's not what the donation page says: https://www.fundfill.com/fund/TrueCryptAudited https://www.fundfill.com/fund/TrueCryptAudited There's no hint that the audit is for historic purposes. As for your second paragraph, I already said that the TC developer might just have been polite in that mail. Technical people are often not able to stand up for themselves, especially if it comes to money.
      - tptacek 12y ago
        I'm pretty sure I can safely speak for the TC audit project on this point.
- gcv 12y ago
  TrueCrypt has portable volume images. It's nice to make a container on Mac OS and give it to a Windows user and know it will mount as a filesystem or drive.
  - tptacek 12y ago
    This is an abuse of FDE. If you're moving archives from one OS to another, use userland file-level encryption. There are a bunch of reasons for this: you'll get better crypto primitives, you get cryptographic integrity protection (XTS can't offer that), and the crypto code you'll be using will be simpler and thus easier to audit.
    - TheLoneWolfling 12y ago
      Can you give an example of a file encrypter / decryptor that has a portable version and is cross-platform? Also, file encryption / decryption fails massively for some things. What I want is something that implements a filesystem. As otherwise things with many files get... annoying. Not to mention less secure. If there's a better way to do this then let me know.
      - minopret 12y ago
        You can use 7zip to archive, compress, and AES-256 encrypt. You can also use GnuPG or openssl to encrypt a file or a disk image. Lately I took a look at actual filesystems for cross-platform use. I didn't find a great one, but depending on which OS you want to burden with an extra driver, pretty good ones include exFAT, NTFS, and UDF specifically version 2.01. Like you, I am curious whether better answers are available.
        TheLoneWolfling 12y ago
        Again, those don't work for filesystem purposes. One of the nice things about TC is that it not only is cross-platform, but that it functions as an mountable directory across all of them.
      - 12y ago
- paralelogram 12y ago
  Most Windows 7 versions (Starter, Home Basic, Home Premium and Professional) don't support full disk encryption.
  - tptacek 12y ago
    Upgrade, or switch. Doesn't every version of Win8 support it?
    - pbsd 12y ago
      No.
      - tptacek 12y ago
        You're referring to Bitlocker, right? Don't they do something different, like iOS Data Protection, for non-Pro?
        pbsd 12y ago
        Yes, Bitlocker. There is something called "Device Encryption" in every edition, but it has some rather unusual hardware requirements (TPM and connected standby).
- krylon 12y ago
  Alas, TrueCrypt was/is the only free solution that allows you to encrypt a USB flash drive (or create an encrytped container file on it) and thus exchange data between, a Mac, a Windows machine, and a Linux machine[1]. Maybe the number of people who need/want that is small compared to the number of people who want some form of whole disk encryption, but if you are one of those people, you are pretty much screwed without TrueCrypt. It would be relly nice if there was some common container format you could mount natively on these operating systems without the need for 3rd party software. I think I remember reading about LUKS supporting TrueCrypt's container format - but that, of course, only works on Linux. And frankly, I don't see Apple and Microsoft either supporting the TrueCrypt container format natively or getting together to define a new one. Plus, BitLocker is not available on Vista Business and Windows 7 Pro. So if you don't want to use Windows 8, again, you are kind of screwed. [1] At least it was/is the only software that I know of which allows you to do that. If there are alternatives, I would very much like to hear about them!
  - jessaustin 12y ago
    ...exchange data between, a Mac, a Windows machine, and a Linux machine. Just use PGP, probably the gpg [0] software. You can set it up so that each machine knows the others' public keys, or you can take a shortcut and copy the same private key to all your machines. Encrypt and decrypt as you like. This is "hacker" advice, however; gpg is not a consumer-oriented tool. You'll have to read some documentation and keep your wits about you. But that was true of TC as well, wasn't it? [0] https://www.gnupg.org/ https://www.gnupg.org/
    - krylon 12y ago
      I am aware of PGP, and yes, one could do that, but... a) While I am not afraid of reading docuzmentation, TrueCrypt has always struck me as being really, really simple to use. b) The whole point of an encrypted filesystem is that cleartext data never hits the disk/flash drive/whatever. Of course you can prepare your data, encrypt it with gpg, transmit it in whatever way you choose, then decrypt it. But then you have on-disk plain text data, which in some cases is just not desirable. Just to be clear, I appreciate your suggestion, and in many cases it is entirely sufficient. But for me, right now, TrueCrypt hits kind of a sweet spot in terms of portablity, convenience and security.
- tedks 12y ago
  Based on the other comments you've made in this thread, it seems like you wouldn't have recommended anyone to use Truecrypt even when talk of auditing it started. Why fund an audit then? Why beat this particular dead horse? Can you imagine being that open source developer, putting hours of your (incredibly valuable, if you're a talented crypto dev) time into a project that gets relentlessly shit on, later raising more money to hunt through backdoors than you've ever seen for it? How would you that make you feel? How would you feel when you thought about working on the code? When you thought about fixing bugs reported by people who were paid to look for them by people who openly distrust you? That isn't a rhetorical question. I'd like you to imagine the situation the Truecrypt devs were in, try to empathize with them, and tell us about it. I'm not trying to say Truecrypt should never have been audited, or that open-source projects in general should never be audited. But I do think this particular case was badly handled, and I don't think that's such a horrible thing to say. Things are mishandled all the time. We can always learn from our mistakes. Let's learn from this experience and make the next cross-platform crypto tool better for everyone.
  - tptacek 12y ago
    Badly handled... how? Truecrypt got audited, like so many open source projects say they want to get audited, by top-caliber vuln researchers, and they didn't have to pay a dime. Instead, people who cared about the audit footed the bill. I'm really having a hard time seeing the problem here.
    - tedks 12y ago
      Could you answer my question about how you would feel (what emotions you would experience) in a similar circumstance?
      - tptacek 12y ago
        I would feel like my project got audited by top-caliber vulnerability researchers and I didn't have to pay a dime to make that happen. "Happy" is how I would feel, I guess. Now can you answer my question?
freehunter 12y ago
The developers could have easily gotten this money for themselves. All they had to do was say "pay us to hire someone for code audit and we will do it" or even "pay us and we'll open source it". For whatever reasons the TrueCrypt developers chose not to do that, those are their own reasons. But when it comes to issues of security, you don't make assumptions and you don't trust without verifying. If, like you are implying, the developers took offense to that and quit out of spite, that's no one's fault but their own. So no, you can't blame the people who wanted or performed the audit. The audit did not "cost us" TrueCrypt in any way.
- tedks 12y ago
  Truecrypt was always open-source, the source was at least always visible if it wasn't an OSS-approved license. Truecrypt's primary installation base was Windows. Where's the audit for that? I don't think the developer quit out of spite. I think they quit because they felt underappreciated, overwhelmed with un-fun requests related to the audit, and were very rudely awakened to the fact that it's easier for a project that implies Truecrypt is backdoored to raise money than for Truecrypt to raise money.
  - freehunter 12y ago
    You can audit Windows. Microsoft will give you the source code. http://www.microsoft.com/en-us/sharedsource/default.aspx http://www.microsoft.com/en-us/sharedsource/default.aspx
loteck 12y ago
I think this audit was a colossal waste of time and resources Said every entity that has ever been audited in the history of time. Of course you assume your partners' accounting books are legit, and you assume your vendors' IT controls are tight, and you assume your encryption software isn't backdoored. There is no guaranteed relation between your assumptions and reality until someone qualified checks it out.
- tedks 12y ago
  Be honest here. Would you have bet money that Truecrypt was backdoored? I don't think many people would have. Because they didn't really believe it. They thought an audit would be a "good assurance," but I really doubt many of them considered donating the money to Truecrypt, and the relative value of each.
  - tptacek 12y ago
    Or they're people like me, who don't want to encourage people to use Truecrypt, but do want to help ensure that the people who did use it know how safe they are.
    - tedks 12y ago
      But why? What does it get you? An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in depth. It doesn't actually tell anyone that they're more or less safe. And why Truecrypt? Why not any other crypto program? Why not one that was maintained and had a future? Wouldn't it be more worth it to donate that money to ensure that the people who use GPG know how safe they are? Or OpenSSL? I think the real reason why Truecrypt got so much attention is that it A.) ran on windows + had visible source and thus was possible to be audited, and B.) had anonymous devs shrouded in interesting secrecy. If Truecrypt was linux-only and was developed by Jorge Schmorge in his off-time from Startuply, it wouldn't have gotten any burning desires to audit it. Can you explain more what convinced you to spend time and money on this? What makes this more valuable than 70 Watsi patients? Also, could you respond to my comment here: https://news.ycombinator.com/item?id=9312559 https://news.ycombinator.com/item?id=9312559
java-man 12y ago
Still, one valid point: there seems to be no third option regarding the development of software: either it's a commercial model which favors closed source and tight IP controls, or it's an open source and generally unpaid development model. Is a third option even possible? Micropayments? Reputation?
- freehunter 12y ago
  There is a third option that meets the two in the middle. Red Hat was one of the first to successfully employ it: develop an open source product but sell support, and for some of their software, require a license if you want to use all of the features.
  - java-man 12y ago
    I would argue this combination is not sustainable. Eventually a project will be gobbled up by a commercial entity (FoundationDB) or become stagnant once the original developers leave. I am not trying to poo poo open source development model, or decry evils of commercialism. I think we can all benefit from finding an alternative.
    - Kalium 12y ago
      We're all listening if you want to propose one. Just... I at least have the caveat in mind that insisting that an alternative could be better is not the same as proposing an alternative. Or even proof that an alternative exists. Micropayments have really only seen success for things with very broad userbases (like musicians on Patreon). Right now what we've got is essentially patronage.
    - freehunter 12y ago
      Red Hat has been going strong for 22 years and they had an IPO in 1999, then managed to survive the dot com crash. Their stock is doing pretty well. Canonical is doing okay with Ubuntu, despite the product being given away. Sourcefire is doing well, even though Snort is free and open source. Mozilla is still trucking along last I heard. So you can argue that it's unsustainable, in the way that you can argue that the moon is made of cheese. It's just not true. Besides, FoundationDB wasn't open source, was it? It was just free of charge, which isn't a business model at all.
cocoablazing 12y ago
To me, it appears that your argument presumes something that you believe to be false. Do you believe the devs left because of losing interest, or because of the funding of the audit, or both? Do you have a reference for the devs leaving because of anger over the funding?
- tedks 12y ago
  I had a source for the devs leaving because it was no longer fun anymore that I can't find because of buggy HN features. Are you implying that "the devs lost interest" is mutually exclusive from "the devs were facing burnout from dealing with a hostile community"? To me, the latter is causal to the former, but you might disagree.
  - java-man 12y ago
    I think, in this context, it's not important _why_ developers leave - it's inevitable. In a commercial setting, there is financial motivation for a company to hire and train new developers, but in the case of an open source project this may not be the case. How do we motivate people to fix or continue development of open source projects? Is it possible at all?
    - tedks 12y ago
      >How do we motivate people to fix or continue development of open source projects? Is it possible at all? Hm. Maybe it is impossible to motivate people to continue development of open-source projects. There are very few long-lived open-source projects, and very little open-source code. You're probably right that motivating people by anything other than cold, hard cash is impossible -- after all, what do people want in life besides money?
      - LLWM 12y ago
        Sex. You know what you have to do.
late2part 12y ago
"The Truecrypt developers supposedly left because it wasn't interesting/fun for them anymore." I thought the Truecrypt developers quit because the US Government forced them to surrender their private keys.
- uxp 12y ago
  The Truecrypt developers left for an unspecified reason. Anyone claiming otherwise is speculating.
- LLWM 12y ago
  I thought Jews did 9/11
- swhipple 12y ago
  You're thinking of Lavabit, not TrueCrypt.
  - e12e 12y ago
    No, there has been speculations/allegations/rumours regarding TrueCrypt and developer's keys. GPG keys used for signing releases, if I remember correctly. But as another comment here mentions, that is also (afaik, too) just hear-say, speculation and could very well be made up (well intentioned or otherwise).

by tedks 12y ago

tptacek 12y ago

The Truecrypt Audit Project did not "cost you Truecrypt". The primary reason the project was abandoned was that it's a 3rd party package that implements something every operating system now implements for itself, better than Truecrypt could. There is a mythology among Linux Truecrypt users that the whole project was an effort to create a cross-platform encrypted disk scheme to free users from the tyrannical yoke of I don't know LUKS, but I've seen zero evidence that such a goal was particularly important to actual TC developers.

sfk 12y ago
This fact must have been known to Matt Green et al.! Why did they waste 65k on an evidently obsolete project? Also, (as far as I know) all public evidence for your assertion is a purported email from one of the devs to Matt Green. He might just have been polite in that mail...
- tptacek 12y ago
  Both Matt Green and I donated to the project. The reason: thousands of people actually use Truecrypt, and it's important to know how safe their data actually was. I'm amused by the idea that the actual words of the TC developers are less credible than whatever random thoughts are bubbling around a message board. But, HN, what are you gonna do.
  - sfk 12y ago
    That's not what the donation page says: https://www.fundfill.com/fund/TrueCryptAudited https://www.fundfill.com/fund/TrueCryptAudited There's no hint that the audit is for historic purposes. As for your second paragraph, I already said that the TC developer might just have been polite in that mail. Technical people are often not able to stand up for themselves, especially if it comes to money.
    - tptacek 12y ago
      I'm pretty sure I can safely speak for the TC audit project on this point.
gcv 12y ago
TrueCrypt has portable volume images. It's nice to make a container on Mac OS and give it to a Windows user and know it will mount as a filesystem or drive.
- tptacek 12y ago
  This is an abuse of FDE. If you're moving archives from one OS to another, use userland file-level encryption. There are a bunch of reasons for this: you'll get better crypto primitives, you get cryptographic integrity protection (XTS can't offer that), and the crypto code you'll be using will be simpler and thus easier to audit.
  - TheLoneWolfling 12y ago
    Can you give an example of a file encrypter / decryptor that has a portable version and is cross-platform? Also, file encryption / decryption fails massively for some things. What I want is something that implements a filesystem. As otherwise things with many files get... annoying. Not to mention less secure. If there's a better way to do this then let me know.
    - minopret 12y ago
      You can use 7zip to archive, compress, and AES-256 encrypt. You can also use GnuPG or openssl to encrypt a file or a disk image. Lately I took a look at actual filesystems for cross-platform use. I didn't find a great one, but depending on which OS you want to burden with an extra driver, pretty good ones include exFAT, NTFS, and UDF specifically version 2.01. Like you, I am curious whether better answers are available.
      - TheLoneWolfling 12y ago
        Again, those don't work for filesystem purposes. One of the nice things about TC is that it not only is cross-platform, but that it functions as an mountable directory across all of them.
    - 12y ago
paralelogram 12y ago
Most Windows 7 versions (Starter, Home Basic, Home Premium and Professional) don't support full disk encryption.
- tptacek 12y ago
  Upgrade, or switch. Doesn't every version of Win8 support it?
  - pbsd 12y ago
    No.
    - tptacek 12y ago
      You're referring to Bitlocker, right? Don't they do something different, like iOS Data Protection, for non-Pro?
      - pbsd 12y ago
        Yes, Bitlocker. There is something called "Device Encryption" in every edition, but it has some rather unusual hardware requirements (TPM and connected standby).
krylon 12y ago
Alas, TrueCrypt was/is the only free solution that allows you to encrypt a USB flash drive (or create an encrytped container file on it) and thus exchange data between, a Mac, a Windows machine, and a Linux machine[1]. Maybe the number of people who need/want that is small compared to the number of people who want some form of whole disk encryption, but if you are one of those people, you are pretty much screwed without TrueCrypt. It would be relly nice if there was some common container format you could mount natively on these operating systems without the need for 3rd party software. I think I remember reading about LUKS supporting TrueCrypt's container format - but that, of course, only works on Linux. And frankly, I don't see Apple and Microsoft either supporting the TrueCrypt container format natively or getting together to define a new one. Plus, BitLocker is not available on Vista Business and Windows 7 Pro. So if you don't want to use Windows 8, again, you are kind of screwed. [1] At least it was/is the only software that I know of which allows you to do that. If there are alternatives, I would very much like to hear about them!
- jessaustin 12y ago
  ...exchange data between, a Mac, a Windows machine, and a Linux machine. Just use PGP, probably the gpg [0] software. You can set it up so that each machine knows the others' public keys, or you can take a shortcut and copy the same private key to all your machines. Encrypt and decrypt as you like. This is "hacker" advice, however; gpg is not a consumer-oriented tool. You'll have to read some documentation and keep your wits about you. But that was true of TC as well, wasn't it? [0] https://www.gnupg.org/ https://www.gnupg.org/
  - krylon 12y ago
    I am aware of PGP, and yes, one could do that, but... a) While I am not afraid of reading docuzmentation, TrueCrypt has always struck me as being really, really simple to use. b) The whole point of an encrypted filesystem is that cleartext data never hits the disk/flash drive/whatever. Of course you can prepare your data, encrypt it with gpg, transmit it in whatever way you choose, then decrypt it. But then you have on-disk plain text data, which in some cases is just not desirable. Just to be clear, I appreciate your suggestion, and in many cases it is entirely sufficient. But for me, right now, TrueCrypt hits kind of a sweet spot in terms of portablity, convenience and security.
tedks 12y ago
Based on the other comments you've made in this thread, it seems like you wouldn't have recommended anyone to use Truecrypt even when talk of auditing it started. Why fund an audit then? Why beat this particular dead horse? Can you imagine being that open source developer, putting hours of your (incredibly valuable, if you're a talented crypto dev) time into a project that gets relentlessly shit on, later raising more money to hunt through backdoors than you've ever seen for it? How would you that make you feel? How would you feel when you thought about working on the code? When you thought about fixing bugs reported by people who were paid to look for them by people who openly distrust you? That isn't a rhetorical question. I'd like you to imagine the situation the Truecrypt devs were in, try to empathize with them, and tell us about it. I'm not trying to say Truecrypt should never have been audited, or that open-source projects in general should never be audited. But I do think this particular case was badly handled, and I don't think that's such a horrible thing to say. Things are mishandled all the time. We can always learn from our mistakes. Let's learn from this experience and make the next cross-platform crypto tool better for everyone.
- tptacek 12y ago
  Badly handled... how? Truecrypt got audited, like so many open source projects say they want to get audited, by top-caliber vuln researchers, and they didn't have to pay a dime. Instead, people who cared about the audit footed the bill. I'm really having a hard time seeing the problem here.
  - tedks 12y ago
    Could you answer my question about how you would feel (what emotions you would experience) in a similar circumstance?
    - tptacek 12y ago
      I would feel like my project got audited by top-caliber vulnerability researchers and I didn't have to pay a dime to make that happen. "Happy" is how I would feel, I guess. Now can you answer my question?

freehunter 12y ago

The developers could have easily gotten this money for themselves. All they had to do was say "pay us to hire someone for code audit and we will do it" or even "pay us and we'll open source it". For whatever reasons the TrueCrypt developers chose not to do that, those are their own reasons. But when it comes to issues of security, you don't make assumptions and you don't trust without verifying. If, like you are implying, the developers took offense to that and quit out of spite, that's no one's fault but their own. So no, you can't blame the people who wanted or performed the audit. The audit did not "cost us" TrueCrypt in any way.

tedks 12y ago
Truecrypt was always open-source, the source was at least always visible if it wasn't an OSS-approved license. Truecrypt's primary installation base was Windows. Where's the audit for that? I don't think the developer quit out of spite. I think they quit because they felt underappreciated, overwhelmed with un-fun requests related to the audit, and were very rudely awakened to the fact that it's easier for a project that implies Truecrypt is backdoored to raise money than for Truecrypt to raise money.
- freehunter 12y ago
  You can audit Windows. Microsoft will give you the source code. http://www.microsoft.com/en-us/sharedsource/default.aspx http://www.microsoft.com/en-us/sharedsource/default.aspx

loteck 12y ago

I think this audit was a colossal waste of time and resources Said every entity that has ever been audited in the history of time. Of course you assume your partners' accounting books are legit, and you assume your vendors' IT controls are tight, and you assume your encryption software isn't backdoored. There is no guaranteed relation between your assumptions and reality until someone qualified checks it out.

tedks 12y ago
Be honest here. Would you have bet money that Truecrypt was backdoored? I don't think many people would have. Because they didn't really believe it. They thought an audit would be a "good assurance," but I really doubt many of them considered donating the money to Truecrypt, and the relative value of each.
- tptacek 12y ago
  Or they're people like me, who don't want to encourage people to use Truecrypt, but do want to help ensure that the people who did use it know how safe they are.
  - tedks 12y ago
    But why? What does it get you? An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in depth. It doesn't actually tell anyone that they're more or less safe. And why Truecrypt? Why not any other crypto program? Why not one that was maintained and had a future? Wouldn't it be more worth it to donate that money to ensure that the people who use GPG know how safe they are? Or OpenSSL? I think the real reason why Truecrypt got so much attention is that it A.) ran on windows + had visible source and thus was possible to be audited, and B.) had anonymous devs shrouded in interesting secrecy. If Truecrypt was linux-only and was developed by Jorge Schmorge in his off-time from Startuply, it wouldn't have gotten any burning desires to audit it. Can you explain more what convinced you to spend time and money on this? What makes this more valuable than 70 Watsi patients? Also, could you respond to my comment here: https://news.ycombinator.com/item?id=9312559 https://news.ycombinator.com/item?id=9312559

java-man 12y ago

Still, one valid point: there seems to be no third option regarding the development of software: either it's a commercial model which favors closed source and tight IP controls, or it's an open source and generally unpaid development model. Is a third option even possible? Micropayments? Reputation?

freehunter 12y ago
There is a third option that meets the two in the middle. Red Hat was one of the first to successfully employ it: develop an open source product but sell support, and for some of their software, require a license if you want to use all of the features.
- java-man 12y ago
  I would argue this combination is not sustainable. Eventually a project will be gobbled up by a commercial entity (FoundationDB) or become stagnant once the original developers leave. I am not trying to poo poo open source development model, or decry evils of commercialism. I think we can all benefit from finding an alternative.
  - Kalium 12y ago
    We're all listening if you want to propose one. Just... I at least have the caveat in mind that insisting that an alternative could be better is not the same as proposing an alternative. Or even proof that an alternative exists. Micropayments have really only seen success for things with very broad userbases (like musicians on Patreon). Right now what we've got is essentially patronage.
  - freehunter 12y ago
    Red Hat has been going strong for 22 years and they had an IPO in 1999, then managed to survive the dot com crash. Their stock is doing pretty well. Canonical is doing okay with Ubuntu, despite the product being given away. Sourcefire is doing well, even though Snort is free and open source. Mozilla is still trucking along last I heard. So you can argue that it's unsustainable, in the way that you can argue that the moon is made of cheese. It's just not true. Besides, FoundationDB wasn't open source, was it? It was just free of charge, which isn't a business model at all.

cocoablazing 12y ago

To me, it appears that your argument presumes something that you believe to be false. Do you believe the devs left because of losing interest, or because of the funding of the audit, or both? Do you have a reference for the devs leaving because of anger over the funding?

tedks 12y ago
I had a source for the devs leaving because it was no longer fun anymore that I can't find because of buggy HN features. Are you implying that "the devs lost interest" is mutually exclusive from "the devs were facing burnout from dealing with a hostile community"? To me, the latter is causal to the former, but you might disagree.
- java-man 12y ago
  I think, in this context, it's not important _why_ developers leave - it's inevitable. In a commercial setting, there is financial motivation for a company to hire and train new developers, but in the case of an open source project this may not be the case. How do we motivate people to fix or continue development of open source projects? Is it possible at all?
  - tedks 12y ago
    >How do we motivate people to fix or continue development of open source projects? Is it possible at all? Hm. Maybe it is impossible to motivate people to continue development of open-source projects. There are very few long-lived open-source projects, and very little open-source code. You're probably right that motivating people by anything other than cold, hard cash is impossible -- after all, what do people want in life besides money?
    - LLWM 12y ago
      Sex. You know what you have to do.

late2part 12y ago

"The Truecrypt developers supposedly left because it wasn't interesting/fun for them anymore." I thought the Truecrypt developers quit because the US Government forced them to surrender their private keys.

uxp 12y ago
The Truecrypt developers left for an unspecified reason. Anyone claiming otherwise is speculating.
LLWM 12y ago
I thought Jews did 9/11
swhipple 12y ago
You're thinking of Lavabit, not TrueCrypt.
- e12e 12y ago
  No, there has been speculations/allegations/rumours regarding TrueCrypt and developer's keys. GPG keys used for signing releases, if I remember correctly. But as another comment here mentions, that is also (afaik, too) just hear-say, speculation and could very well be made up (well intentioned or otherwise).