4 ms·

I think this audit was a colossal waste of time and resources Said every entity that has ever been audited in the history of time. Of course you assume your p

by loteck 12y ago

I think this audit was a colossal waste of time and resources Said every entity that has ever been audited in the history of time. Of course you assume your partners' accounting books are legit, and you assume your vendors' IT controls are tight, and you assume your encryption software isn't backdoored. There is no guaranteed relation between your assumptions and reality until someone qualified checks it out.

tedks 12y ago
Be honest here. Would you have bet money that Truecrypt was backdoored? I don't think many people would have. Because they didn't really believe it. They thought an audit would be a "good assurance," but I really doubt many of them considered donating the money to Truecrypt, and the relative value of each.
- tptacek 12y ago
  Or they're people like me, who don't want to encourage people to use Truecrypt, but do want to help ensure that the people who did use it know how safe they are.
  - tedks 12y ago
    But why? What does it get you? An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in depth. It doesn't actually tell anyone that they're more or less safe. And why Truecrypt? Why not any other crypto program? Why not one that was maintained and had a future? Wouldn't it be more worth it to donate that money to ensure that the people who use GPG know how safe they are? Or OpenSSL? I think the real reason why Truecrypt got so much attention is that it A.) ran on windows + had visible source and thus was possible to be audited, and B.) had anonymous devs shrouded in interesting secrecy. If Truecrypt was linux-only and was developed by Jorge Schmorge in his off-time from Startuply, it wouldn't have gotten any burning desires to audit it. Can you explain more what convinced you to spend time and money on this? What makes this more valuable than 70 Watsi patients? Also, could you respond to my comment here: https://news.ycombinator.com/item?id=9312559 https://news.ycombinator.com/item?id=9312559
    - tptacek 12y ago
      By this logic, all my money should go to Watsi patients. I don't think the Truecrypt audit was the most important thing to allocate my resources towards, but it was worthy of the resources I allocated to it.
      - tedks 12y ago
        That's not necessarily true -- I think you could very convincingly argue that a secure Truecrypt is more valuable than some number of Watsi patients. What if Truecrypt allows a journalist to expose some corruption that saves or benefits some equivalent number of lives? By allocating resources you are implicitly deciding that the target of your allocation is the most important thing to allocate your resources towards. I don't see how this could not be the case.

by loteck 12y ago

tedks 12y ago

Be honest here. Would you have bet money that Truecrypt was backdoored? I don't think many people would have. Because they didn't really believe it. They thought an audit would be a "good assurance," but I really doubt many of them considered donating the money to Truecrypt, and the relative value of each.

tptacek 12y ago
Or they're people like me, who don't want to encourage people to use Truecrypt, but do want to help ensure that the people who did use it know how safe they are.
- tedks 12y ago
  But why? What does it get you? An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in depth. It doesn't actually tell anyone that they're more or less safe. And why Truecrypt? Why not any other crypto program? Why not one that was maintained and had a future? Wouldn't it be more worth it to donate that money to ensure that the people who use GPG know how safe they are? Or OpenSSL? I think the real reason why Truecrypt got so much attention is that it A.) ran on windows + had visible source and thus was possible to be audited, and B.) had anonymous devs shrouded in interesting secrecy. If Truecrypt was linux-only and was developed by Jorge Schmorge in his off-time from Startuply, it wouldn't have gotten any burning desires to audit it. Can you explain more what convinced you to spend time and money on this? What makes this more valuable than 70 Watsi patients? Also, could you respond to my comment here: https://news.ycombinator.com/item?id=9312559 https://news.ycombinator.com/item?id=9312559
  - tptacek 12y ago
    By this logic, all my money should go to Watsi patients. I don't think the Truecrypt audit was the most important thing to allocate my resources towards, but it was worthy of the resources I allocated to it.
    - tedks 12y ago
      That's not necessarily true -- I think you could very convincingly argue that a secure Truecrypt is more valuable than some number of Watsi patients. What if Truecrypt allows a journalist to expose some corruption that saves or benefits some equivalent number of lives? By allocating resources you are implicitly deciding that the target of your allocation is the most important thing to allocate your resources towards. I don't see how this could not be the case.