|
Posted by Ari on November 28, 2008, 8:22 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Truecrypt is an excellent program BUT...
>
> 1) You have no idea who the developers are (they remain pseudonymous)
>
> 2) Very few people compile the Windows binaries from source; it is
> exceedingly difficult to generate binaries from source that match the
> binaries provided by Truecrypt (due to compiler options, etc.)
>
> 3) There are NO (zip, nada, zilch) published detailed reviews of the
> source code. Availability of open-source *doesn't* mean that reviews
> actually get done!
>
> 4) Truecrypt has ruthlessley suppressed all earlier versions (from
> wayback, sourceforge, oldapps, etc.) even though they were supposedly
> open-source (thus making incremental review impossible). This is
> ominous!
>
> 5) There is no public mechanism for submission and review of bug
> reports, etc. Any bug database, etc. is CLOSED! to the public, with only
> a "bug report form" available that goes into a black hole unacknowledged.
>
> 6) The Truecrypt forums are run in an exceedingly autocratic and
> unfriendly way, with many posts arbitrarily removed. Many topics (not
> just the ones in the posting guidelines) are "off limits." Moreover, the
> forums sometimes close unexplained for long periods (a month or more) and
> reemerge with many posts purged. The moderators make it very difficult
> for posters to contact each other directly.
>
> 7) The license for Truecrypt is NOT open source (e.g., doesn't meet OSI
> criteria) and is quite restrictive.
>
> There are a number of rationales presented in defence of the above points
> by the developers (e.g., centralized control, quality, reputation, etc.)
> but they are all, IMHO, very weak in contrast to the opposing views.
>
> In short, there is NO substantive public evidence that Truecrypt's source
> code has been the subject of thorough review, nor is there any reason to
> rely on the credentials of the developers (since they remain anonymous).
> In that absence, using Truecrypt is an act of blind faith every bit as
> much (or more!) than using a closed-source encryption program.
>
> Regards,
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map