Hacker News Reader

Comment by rahuldottech | Hacker News Reader

IIRC, FUSE is also required for VeraCrypt to function. So now the source code of this library (module? whatever) that's used by popular encryption software won't be available for public scrutiny. Amazing.

The author is, of course, completely within their rights to stop publishing the source code of their software, but this is a real pity.

The way to go would be for members of the FOSS community to fork the last version of the source code that was published and continue development, but I don't know who (if anyone) will step up and take responsibility.

This also leads to fragmentation, were now you have two popular forks of the same thing which may not be compatible with each other. Sigh.

View on HN

You make it sound like there's a tonne of FOSS community on-hand just waiting for the chance to step in and create a popular fork that will lead to fragmentation, when he's effectively been the sole maintainer since 2012 [1].

It's far more likely there will no future well maintained OSS forks, he'll continue developing it as a closed-source product, allowing end-users to install it for free but any company who wants access to his future source code and improvements can compensate him for it. This is a far better outcome than it turning it into abandonware where that will stop working in future macOS versions.

> software won't be available for public scrutiny.

It's a popular cliche to think all OSS projects have healthy development communities and many eyes pouring over it, but as he's the only person contributing fixes, the only way the product was going to improve is if he spends more time working on it which is more likely to happen if he can get sponsored to continue working on it.

None of your fears are likely to come to pass and the health of the project would be far worse off if he abandoned it.

[1] https://github.com/osxfuse/osxfuse/graphs/contributors

1. I'm sorry if I make it sound like that, definitely not my intention. I recognize that there's a serious lack of volunteers and contributors in the FOSS ecosystem.

2. When it comes to FOSS encryption software, it is important that it's audited every-so-often. Relying on closed-source frameworks makes that impossible. All FOSS software may not be scrutinized, but it's a definite advantage that it can be, when the need arises.

Has FUSE for macos ever been audited?

Not publicly[1] but it could be on given day. Closed source code can't be.

[1] Google presumably audited it when they used a fork.

So probably not then.

The potential for audit is powerful on its own.

Do you remember the shareware days? Installing something you wanted meant getting a bunch of browser toolbars etc.

The potential for forking is also powerful.

As the article notes this is pretty unlikely because distributing .kexts require Apple certification.

VeraCrypt is for Windows. This is a FUSE implementation for macOS.

You are mistaken. VeraCrypt supports Windows, macOS, GNU/Linux and FreeBSD. On macOS, it requires FUSE.

VeraCrypt is not limited to Windows, v it runs fine on macOS

Reply on news.ycombinator.com