Hacker News Reader

Comment by tptacek | Hacker News Reader

People involved in the TC audit project have talked to the developers. They developers do not have an ideological investment in Truecrypt. They're just developers. They built Truecrypt to scratch an itch, found that supporting it was a largely thankless task, and then watched their software get at least 80% obsoleted by modern operating systems.

They don't owe anyone on HN or anywhere else any kind of "ownership of statements" or explanation. The published some source code. They got sick of it. They've moved on. It's over.

I understand the urge people have to synthesize a soap opera narrative out of things on message boards --- that's fun, after all, and the alternative is boring. But that's all the conversation about the TC project abandonment really is: a synthesized soap opera.

View on HN

As I re-read your response it is seeming stranger and stranger. It seems you, too, are refusing to answer the straightforward question put forward. If no-one has asked the devs to explain this claim of potential vulnerabilities, so be it. But if everyone related to the project is recusing themselves from this question I think it's quite reasonable for observers to be interpreting that as a red flag.

(Also to clarify, when I said 'take ownership of this statement' I was referring to the earlier conjecture that the message was written by people other than the original developers.)

I appreciate your response, but I think also you are misrepresenting the events here. If the developers simply moved on that would be one thing, but what actually happened is they also made this claim:

   Using TrueCrypt is not secure as it may contain unfixed security issues.

I don't think the developers owe anyone anything, in terms of supporting this project or even justifying their decision not to support it. But they did make this claim, which they didn't need to, which casts the entire project in doubt. You're saying they are refusing to elaborate on this claim? Or has no-one asked them to? Because I think this thread is evidence enough that plenty of people want to know.

I don't see anything wrong with that quote. They're simply saying it's no longer being developed, and therefore security issues could arise in the future and go unfixed.

However, I still use TrueCrypt because I'm familiar with it, don't believe it has been compromised, and I trust a random pickpocket will be unable to break it.

You mean to say, "Move one everyone nothing to see here"?

The circumstances were fishy - in a way that says don't trust the software to anyone that has anything to hide.

More or less yes, that is what I think. If you don't want to trust Truecrypt, I certainly wouldn't argue that point. I don't use it either.

Reply on news.ycombinator.com