TrueCrypt suggesting migration to BitLocker? - <AUTHOR> http://truecrypt.sourceforge.net/ <comment><USER2> In order of likelihood:

        * Defaced site, timed to screw up a big announcement
        * Rogue content maintainer
        * Phase II of audit turned up something rather bad
          (edit: NO - see tptacek below)

edit: Variations on "developer forced to do this" (cf simmerian's comment):

        * Developer was big brother all along and they are shutting it down
        * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly)
        * Legally or otherwise compelled to compromise source code,
          dev complies and/or nukes project from orbit

The last alternative would be suggested in part by the strange content of the page, assuming it is legit from the developer: Normally I'd expect at _least_ something like "there's a major vuln that is unfixable and we'll disclose formally in a week/two, migrate now.".

<comment><USER3> After examining all the facts, I think it's most likely they just didn't want to develop it anymore:

        * PGP matches
        * Authenticode matches
        * SourceForge data was modified
        * DNS records were modified

And to top it off, let's put ourselves in the theoretical attacker's shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don't appear to contain any unexpected imports, so if this was a hack, it's a very stealthy and very boring one. The most they achieved would be uninteresting to most attackers. It would only really be an effective attack against people who had TrueCrypt volumes but not a current copy of TrueCrypt as there's no compelling reason for anyone to upgrade to 7.2 and certainly they'd be skeptical after this. Any attacker with the intelligence and patience for such an attack would surely realize how poor an execution this would be. A better attack would be "here, it's TrueCrypt 8, it has loads of EFI support and mad security, everyone should install it, it's the best!". There's simply no reason to shut it down like this, unless the attack is just an elaborate practical joke.

It's quite possible this came from 1 big developer hack, but considering how the release was done, with full source and everything for every supported platform... if it was a hack, it's a very, very good one. They've also decided to modify the license terms, perhaps bringing it into compatibility with more common FOSS licenses.

I think it's far more likely at this point that the devs, who had not updated their software in years, finally decided to call the project over and have marked it insecure because the codebase is now unmaintained and should be assumed insecure.

<comment><USER4> >>After examining all the facts, I think it's most likely they just didn't want to develop it anymore:

So they decided to end things with such an extremely juvenile behavior devaluating the years they have invested in this project even if not recently?

Unless the responsible one fell into clinical depression it's a pretty strange reason.

<comment><USER3> They haven't updated it for years.

I'd hardly call the behavior "juvenile" nor would i call it "devaluating". They've simply abandoned it and are offering alternatives.

<comment><USER5> I think suggesting BitLocker as a viable alternative to their work is "devaluing" their work. Who would trust BitLocker not to be vastly more compromised that TrueCrypt?

(Devaluating? sic? Or is that actually a word?)

<comment><USER3> You're right - few would trust it more. However, it is the closest viable alternative to TrueCrypt on the windows platform today.

</comment></comment></comment></comment></comment></comment><comment><USER6> Providing some details from SourceForge:

1\. We have had no contact with the TrueCrypt project team (and thus no complaints).

2\. We see no indicator of account compromise; current usage is consistent with past usage.

3\. Our recent SourceForge forced password change was triggered by infrastructure improvements not a compromise. FMI see [http://sourceforge.net/blog/forced-password- change/](http://sourceforge.net/blog/forced-password-change/)

Thank you,

The SourceForge Team firstname.lastname@example.com

<comment><USER7> 2\. We see no indicator of account compromise; current usage is consistent with past usage.

I'm calling BS. This site was disabled repeatedly for exceeding bandwidth today. I find it hard to believe traffic is as usual.

<comment><USER8> Actually, this is standard behavior for the SourceForge project web service. Bandwidth usage is capped to prevent folks from serving files from project web instead of the mirror network-backed download service. Staff saw the surge in traffic to the project web site, confirmed it wasn't file serving activity, and re-enabled the site.

</comment></comment></comment><comment><USER9> \- Signature is valid, so it's not a defacement. ( [http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev...](http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_development_has_ended_052814/chtl7jb) )

\- The version there works and does not seem to have a trojan, so probably not a regular hacker. ( [https://news.ycombinator.com/item?id=7813373](https://news.ycombinator.com/item?id=7813373) )

\- Instructs to migrate to dubious alternatives, so it's not a legit security effort.

\- License change, precise instructions and decrypt-only version indicate it's not a completely rushed press release. (license change: [https://github.com/warewolf/truecrypt/compare/master...7.2#d...](https://github.com/warewolf/truecrypt/compare/master...7.2#diff- dc5cde275269b574b34b1204b9221cb2L1) )

\- On the other hand the Linux instruction is a joke, so it's not completely well thought either. ( [http://truecrypt.sourceforge.net/OtherPlatforms.html](http://truecrypt.sourceforge.net/OtherPlatforms.html) )

\- The security audit was so far ok, so it's not a sudden vulnerability discovered there. ( [https://twitter.com/matthew_d_green/status/47174183672207360...](https://twitter.com/matthew_d_green/status/471741836722073600) )

\- No details whatsoever other than a " _may_ contain unfixed security issues", so it might be an automated release (doesn't know what happened) or gagged reaction (can't say what happened).

\- Source code includes unrelated changes, so it probably comes from a developer. ( [https://news.ycombinator.com/item?id=7812674](https://news.ycombinator.com/item?id=7812674) )

If I had to wager a crazy bet, I would go with newly developed Dead- Man's-Switch gone wrong.

Edit: someone on Reddit has an interesting view that it may be a halfhearted attempt at complying with an NSA request ( [http://www.reddit.com/r/sysadmin/comments/26pxol/truecrypt_i...](http://www.reddit.com/r/sysadmin/comments/26pxol/truecrypt_is_dead/chte8r2) ).

<comment><USER9> _infosecslave_ said in a dead comment:

        [...] you have to consider the fact that Truecrypt project
        was started before FDE was popular, maybe their goal all
        this time was to popularize such encryption. With XPs
        demise that goal would have been achieved as every
        current Windows version comes with Bitlocker.

Your comment is dead but makes a lot of sense, especially in light of the message on the website:

        The development of TrueCrypt was ended in 5/2014 after
        Microsoft terminated support of Windows XP.

I don't agree Bitlocker is a sensible alternative, but this piece does fit the puzzle.

<comment><USER10> "..as every current Windows version comes with Bitlocker."

It's only available in Ultimate and Enterprise Vista/Win7 and Pro/Enterprise versions of Win8. Lots of machines ship(ped) with only Win7 Home Premium or vanilla Win8.

</comment></comment></comment><comment><USER11> Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court. Furthermore, the author was secretly required to turn over his secret signing key to a secret third party. If you were the author, what would you do? Consider your options. One is that you could issue an update with a warning that the program is no longer secure. Even though the program really is, at this moment, secure. The only source code changes are to insert the warnings. But what the warnings are warning you about, but cannot just come out and say, is that the program will not be secure in the future because a third party now has the keys to sign authentic new insecure versions. This wouldn't be unlike Lavabit shutting down. The author is choosing to fall on his sword for the good of everyone.

<comment><USER12> Continuing the thought experiment. By stating the "reason" you're shutting down is that your project is "no longer necessary", then (i) your userbase will rapidly infer that the reason is odd (e.g., [https://news.ycombinator.com/item?id=7813799](https://news.ycombinator.com/item?id=7813799) ), while (ii) you can plausibly defend closing down with a straight face, in court if required ("Our raison d'être no longer applies. So obviously this was the perfect time to shutdown the project for totally this reason and not any others.") Additionally, by changing the TrueCrypt License from 3.0 to 3.1 (removing the clause requiring advertising truecrypt.org), you tacitly support TrueCrypt forks while simultaneously de-emphasising the now-compromised truecrypt.org.

<comment><USER13> This is without a doubt the most parsimonious explanation for all available evidence.

</comment></comment></comment><comment><USER14> Interestingly enough, they also changed the TrueCrypt license.

        -TrueCrypt License Version 3.0
        +TrueCrypt License Version 3.1

This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is signed with the same signing keys, can I legally use the new license in derivative software?

The new license removes the following restrictions regarding attribution:

        -    c. Phrase "Based on TrueCrypt, freely available at
        -    http://www.truecrypt.org/" must be displayed by Your Product
        -    (if technically feasible) and contained in its
        -    documentation. Alternatively, if This Product or its portion
        -    You included in Your Product constitutes only a minor
        -    portion of Your Product, phrase "Portions of this product
        -    are based in part on TrueCrypt, freely available at
        -    http://www.truecrypt.org/" may be displayed instead. In each
        -    of the cases mentioned above in this paragraph,
        -    "http://www.truecrypt.org/" must be a hyperlink (if
        -    technically feasible) pointing to http://www.truecrypt.org/
        -    and You may freely choose the location within the user
        -    interface (if there is any) of Your Product (e.g., an
        -    "About" window, etc.) and the way in which Your Product will
        -    display the respective phrase.

<comment><USER15> Interesting, especially since the author(s) are anonymous and not working off public repositories, it will be very hard, if not impossible, for them to prove that they did _not_ release this software.

<comment><USER16> If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.

</comment></comment></comment><comment><USER17> Is it possible that this is the result of a "dead man's switch" (DMS) set by the developer(s)? Perhaps a (continually updated) process was set up so that TrueCrypt would shut itself down if the developer were unable to prove he or she was still actively maintaining the software.

I can see a couple of scenarios where this would be wise:

A) The developer passes away, leaving nobody else to maintain TrueCrypt. Zero- day 1234 is discovered which compromises TrueCrypt. The DMS activates, depreciating the software and advising users to migrate to another alternative (why BitLocker, I have no idea).

B) The developer(s) is(are) coerced into compromising TrueCrypt in some way. As a part of the coercion, the developer(s) is(are) unable to demonstrate proof of life to the DMS, so the system nukes itself.

<comment><USER18> the page specifically mentions that it's ending support in may because ms is dropping xp support, though

<comment><USER17> Not quite, though. The page says _" The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP."_ We can infer that the two are connected, but it would be equally valid to say "The development of TrueCrypt was ended in 5/2014 after Snowden interviewed with NBC."

The reason I make this distinction is because continuing from a cautious/paranoid perspective, the DMS might not say "WARNING! Dead Man's Switch Activated! If you are reading this, I may have been compromised, and am no longer available to maintain TrueCrypt." It's possible that the landing page simply references a relatively innocuous event in the cyber security world to plausibly discontinue the software. The best evidence I have for this is the fact that TrueCrypt didn't shut down precisely when XP support was dropped. (In fact, according to [http://www.microsoft.com/en- us/windows/enterprise/end-of-sup...](http://www.microsoft.com/en- us/windows/enterprise/end-of-support.aspx) official support ended in April, not May like the landing page states.)

</comment></comment></comment><comment><USER19> A very interesting comment from netsec: [http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev...](http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_development_has_ended_052814/chtgqg7)

This is very strange. I have another theory since I don't believe in coincidences. We don't know the real author of TrueCrypt. I think someone found his identity (cough NSA) and made him an offer like lavabit.com received. This time probably with security classification so he can't talk about that. HOWEVER, if we take a look on diff of his code, we can see two interesting things:

        messages about TrueCrypt not being secure
        and the second thing he changed everywhere U.S. text to United States

Do you think that somoene who is closing a project would pay attention to doing such thing? I don't think so. I think that he tried to point a real reason of closing his project by that. I won't be surprised when truecrypt fork appears in TOR network soon...

<comment><USER20> There was a lot of unrelated changes, this release was most likely just cut off their development branch.

<comment><USER16> The point is that a search and replace from "U.S." to "United States" is an _unusual_ change. I have not seen evidence of this firsthand yet so I am just taking Moral_ on his word but if that is the case and there are a number of occurrences then it is certainly an interesting thing for the author to think to change.

</comment></comment></comment><comment><USER21> I just came across this on Twitter: [https://github.com/warewolf/truecrypt/compare/master...7.2](https://github.com/warewolf/truecrypt/compare/master...7.2)

This is supposedly the commit for the 7.2 release. Just looks like a bunch of code replaced with the app aborting as insecure.

I'm not sure how legit this is, the repository was just created a few minutes ago. Apparently there is a new binary release that goes along with this, though.

[I've created a fork here just in case the original goes down: [https://github.com/timothyarmstrong/truecrypt/compare/master...](https://github.com/timothyarmstrong/truecrypt/compare/master...7.2)]

<comment><USER22> Notice the added functions like IsNonSysPartitionOnSysDrive and ResolveAmbiguousSelection, and all the unrelated minor changes like the comment line in Common/Volumes.h. Looks a lot like they based it on current pre-release development code.

</comment></comment><comment><USER23> Sourceforge seems to have recently updated their password hashing algorithm, so that might hint at the cause of a compromise. Here's the body of the email sent to me on the 22nd:

      Greetings,

      To make sure we're following current best practices for security, we've
      made some changes to how we're storing user passwords. As a result, the
      next time you go to login to your SourceForge.net account, you will be
      prompted to change your password. Once this is done, your password will be
      stored more securely. We recommend that you do this at your earliest
      convenience by visiting the SourceForge website and logging in.

      And, as always, be vigilant about password security. Use a secure password,
      never include your password in an email, and don't click on links for
      unsolicited password resets.

      If you have any concerns about this, please contact SourceForge support at
      firstname.lastname@example.com

      Best regards,
      SourceForge Team

      </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
      SourceForge.net has made this mailing to you as a registered user of
      the SourceForge.net site to convey important information regarding
      your SourceForge.net account or your use of SourceForge.net services.

      We make a small number of directed mailings to registered users each
      year regarding their account or data, to help preserve the security of
      their account or prevent loss of data or service access.

      If you have concerns about this mailing please contact our Support
      team per: http://sourceforge.net/support

<comment><USER24> Sourceforge's representative says it's unrelated: [https://news.ycombinator.com/item?id=7813121](https://news.ycombinator.com/item?id=7813121)

</comment></comment><comment><USER25> This is creepy as hell.

No mention of _why_ it's supposed to be not secure - it's an open source project so it would be easy to point to a specific vulnerability. All of this shortly after passing audit. There are detailed steps towards switching to supposedly secure closed-source solutions by companies known to be working closely with the NSA.

Also, since when do open source projects suddenly decide they are not as good enough as a closed-source alternative and then stop the project? Are we in danger of seeing a similar message on the homepage of LibreOffice and OpenOffice, declaring that you should switch to Microsoft Office?

I can't even begin to imagine a valid scenario in which something like this would be put up by the developers, with no pressure other than some fatal security flaw about which they just really don't want to talk.

<comment><USER26> It doesn't matter why. If "we are now insecure" then the last thing you say is, "so please download these new versions, used only to decrypt your old files and nothing else." No we won't tell you what, if anything, was wrong, so you can make an informed decision.

<comment><USER27> The motivation would be so that if you had a TrueCrypt archive lying around on a drive that you find in 5 years time, it would be possible to decrypt it - but they don't want to allow encryption because they won't be continuing development, and so fixing future bugs will not be possible.

<comment><USER28> If that's the motivation then in 5 years' time, who's to say the new version will work as well (assuming that it also won't be updated)? That doesn't make any sense.

<comment><USER27> They're saying that one should not continue to use orphaned software (when it's so security critical). So they're stopping the distribution of the encryption part of it, and continuing to distribute the part of the software that decrypts the code. This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you.

At the same time, the developer clearly doesn't want people to be encrypting new archives with it, so have removed that functionality.

Removing the software in total would have lead to many mirror sites springing up, most with unproved providence (and a great opportunity for exploits). This method allows an official version to still exist (unmaintained, but still compatible with the current archives), whilst severely restricting new usages (by strongly warning against it and requiring using the dubious mirrors to obtain the software).

<comment><USER28> > This means that if (in five years) you find an archive that you can't open > without TrueCrypt (and you uninstalled it etc) you'll still be easily able > to find a signed version that will decrypt it for you.

That still doesn't seem to answer the point. The differences between 7.1* and the questionable 7.2 are exclusively limited to what was ripped out. In 5 years, 7.1 and 7.2 will likely work precisely the same in terms of decryption. If a glibc update or similar breaks 7.1, it'll likely break 7.2.

Perhaps I wasn't clear enough in my first comment, but fundamentally it seems like a silly argument to make to suggest that distributing a new release for some measure of future proofing readability is necessary. Outside "don't use this, it's broken," I can't really see "this will still work in 5 years' time" as a valid reason.

</comment></comment></comment></comment></comment></comment><comment><USER29> I tried sending a message to their contact email PGP-encrypted to their public key, asking them for a PGP-signed confirmation. And it came back:

550 5.1.1 <email@example.com>: Recipient address rejected: User unknown in local

If they got hacked, it's not just their sourceforge account.

</comment><comment><USER30> I'll leave others more knowledgeable in such things to comment on the legitimacy of this, but one practical thing I'll note: the assertion on the site that Windows Vista/7/8 has support for encrypted disks is only half true. Quoting from Wikipedia [1] "BitLocker is available in the Enterprise and Ultimate editions of Windows Vista and Windows 7. It is also available in the Pro and Enterprise editions of Windows 8."

Since a lot of domestic users will be using Home or Home Premium versions of Windows, and as one of those users who uses Truecrypt for full disk encryption, this does not leave us with as easy a migration path as this site now suggests.

[1] [https://en.wikipedia.org/wiki/BitLocker_Drive_Encryption](https://en.wikipedia.org/wiki/BitLocker_Drive_Encryption)

<comment><USER31> It's worth pointing out that it doesn't leave people with a _free_ migration path, but it is absolutely easy. Windows 7 and 8 both support "anytime upgrade" functionality, where you can pretty trivially upgrade from Home/Home Premium to a higher-level edition of Windows without needing to reinstall anything or move data--just as long as you pay for the more expensive edition.

<comment><USER32> Also there are 3rd party (paid and free) FDE tools available.

</comment></comment></comment><comment><USER33> The advice for Linux is "Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation."

So... just any of them, then? Sure, ok.

<comment><USER34> [https://wiki.archlinux.org/index.php/Disk_encryption#Compari...](https://wiki.archlinux.org/index.php/Disk_encryption#Comparison_table)

This might help.

<comment><USER35> I think the point was just that the advice given was so vague, that it seems suspicious that this is _actually_ an official communication.

</comment></comment></comment><comment><USER36> Wikipedia entry was edited and reversed with similar message: [https://en.wikipedia.org/w/index.php?title=TrueCrypt&action=...](https://en.wikipedia.org/w/index.php?title=TrueCrypt&action=history)

By "Truecrypt-end" user: [https://en.wikipedia.org/wiki/Special:Contributions/Truecryp...](https://en.wikipedia.org/wiki/Special:Contributions/Truecrypt- end)

</comment><comment> UVB-76 8 hours ago on the IndieGoGo TrueCrypt Audit page [1]

> p.s. We hope to have some _big_ announcements this week, so stay tuned.

[1] [https://www.indiegogo.com/projects/the-truecrypt- audit#activ...](https://www.indiegogo.com/projects/the-truecrypt- audit#activity)

<comment> UVB-76 Although Kenn White, who wrote that message, has no idea what's going on [1]

> .@FiloSottile @matthew_d_green no idea. It's doing a 301 perm to a static pg > @ SF, now blocked. Possibly compromised. pic.twitter.com/g5tSFUuXzu

[1] [https://twitter.com/kennwhite/status/471740840478797824](https://twitter.com/kennwhite/status/471740840478797824)

<comment><USER35> He's responded specifically about the message:

      .@Costly no idea. The announcement was about a
      new Open Crypto Audit Project initiative, not TC.

[https://twitter.com/kennwhite/status/471741290552782849](https://twitter.com/kennwhite/status/471741290552782849)

</comment></comment></comment><comment><USER37> i just wanted to say thanks to the truecrypt devs for a decade of largely unthanked and criticised work that, as far as i can tell, has been impressively reliable.

[kinda disappointed that, despite arriving so late to this thread, no-one seems to have said this.]

</comment><comment><USER38> Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: _" One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993."_

Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 _after Microsoft terminated support of Windows XP._ "

Could it be that the original developer is somehow unable to update the build process to work on newer OSes, or unwilling to do so? Maybe they don't trust any VC++ released after 1993, and that version is probably not going to work on Windows 7 or 8.

[1] [http://www.infoworld.com/t/encryption/sloppy-secure-open- sou...](http://www.infoworld.com/t/encryption/sloppy-secure-open-source- truecrypt-passes-audit-240478)

<comment><USER39> I would be absolutely shocked if there was some reason any VC++ lib would not install on any modern Windows OS.

Microsoft has many faults, but backwards compatibility is not one of them.

I doubt this would be the reason. (Also, TrueCrypt runs on OSX and Linux too, so a build environment dependent on Windows-only seems odd).

<comment><USER40> The version of MSVC needed is 1.52c, which was 16-bit, and was the last version able to create 16-bit binaries. It was likely needed for building the bootloader. (Why this couldn't be moved over to a FOSS compiler, I don't know.)

</comment></comment></comment><comment><USER41> > WARNING: Using TrueCrypt is not secure as it may contain unfixed security > issues

I see many readers here and on Twitter who interpret that as "TrueCrypt has security issues". That's not what it says. It says that it might be insecure. That does not make too much sense right now, but considering this webpage would be meant to stay up, unchanged, for years, that makes a lot more sense: security problems may be found, and will not have been fixed in the version on the page.

So, it's a deprecation warning, not a security issue warning.

<comment><USER42> For security software, deprecation is effectively a security issue since there are no plans for fixing future bugs.

</comment></comment><comment><USER43> Well - this comes as a pretty big surprise.

Is this real? Is there a known vulnerability that catalyzed this? Money from Microsoft? Threats?

I'm not buying into conspiracy theories, but it does seem pretty out of place.

<comment><USER44> The binaries are properly GPG-signed with the same key as the previous binaries, check for yourself. [They] either compromised their private key too or the actual developer(s) did this. Be it voluntarily or by force of secret three-character agencies / a massive pay check.

<comment><USER34> Maybe something like the Lavabit scenario where they rather close the shop than sell their users out. On the other hand, proposing Bitlocker as an alternative would be rather suspect in that case.

<comment><USER45> Well, the thing is though, it's not that they were hosting users' data. It's not like they would be forced to provide the contents of users' communication.

I suppose they could be approached by someone to plant backdoor into the software, but I wonder if that can be done without someone noticing it...

<comment><USER46> If they put a backdor on the binaries, but not source, lots of people will be compromissed, and for a really long time nobody may notice.

EDIT: I normaly don't care. But this time I'd be glad if who downmoded this post explained why.

</comment></comment></comment></comment></comment><comment><USER47> Call me paranoid but this just looks like really good evidence that Truecrypt was secure.

<comment><USER48> ...or that BitLocker isn't.

<comment><USER49> I know everyone likes to bash MS around here but is there any actual proof of Bitlocker's insecurity that is more recent than 2008? If you look at wikipedia it seems like the only known real vulnerability requires someone with physical access to boot via USB into another OS within a few minutes of turning the computer off. When is this a real risk for anyone? I am not a security expert but unless you are doing things shady enough to get raided by the FBI, it seems like Bitlocker is pretty secure. The same problem occurs in other encryption programs on Linux and OSX. Also, it may not be open source like what we want, but MS lets its partners and enterprise customers audit the code subject to an NDA.

[http://en.wikipedia.org/wiki/BitLocker_Drive_Encryption#Secu...](http://en.wikipedia.org/wiki/BitLocker_Drive_Encryption#Security_concerns)

<comment><USER50> It's really not that hard to imagine scenarios where this might happen. Simply leaving your notebook unattended after a shutdown might leave you compromised. Besides, government agencies in other countries might have a slightly different view on what constitutes "shady behaviour" (think regime critics).

</comment></comment></comment></comment><comment><USER51> Best advice is for everyone to sit tight and not do anything for at least 24 hours. You'll be saving yourself a world of heartburn.

</comment><comment><USER52> According to this [http://dnshistory.org/dns- records/truecrypt.org](http://dnshistory.org/dns-records/truecrypt.org) the A record for www.truecrypt.org hasn't changed (still resolves to 188.8.131.52). So not a DNS hijack.

</comment><comment><USER53> This doesn't pass the smell test. Either there was some underlying political reason for this migration or someone hijacked the DNS.

Anyone know who the main committers/project leads are so we could reach out for comment/clarification?

</comment><comment><USER54> Well, if red Times New Roman on a Sourceforge page says so...

<comment><USER55> [http://truecrypt.org/](http://truecrypt.org/) redirects there, too.

<comment><USER56> Tom has a point, though. The nature of the message (abandoning truecrypt rather than fixing it simply because XP is end-of-lifed?) and the unwillingness to fix it rather than post a dire message about its insecurity and recommend migrating to other solutions that don't have hidden volume functionality -- it suggests it's either very poorly handled, or a fake message.

It might be more likely that a dev got hacked, compromising the signing key, sourceforge project, and truecrypt.org site.

<comment><USER54> We don't know much about the TC developers, do we? It's also possible that they're just really cavalier about this stuff, and that this is their response to the TC audit process ("stop bothering us about it and use something that's maintained").

<comment><USER56> True. Security announcements have been botched in the past, for all sorts of reasons, not that you have any experience with that, of course. But what does XP being EOL'd have to do with _anything_? That and the blithe recommendation to use other solutions, even though they don't have hidden volume functionality which is a main selling point of TC, is what changed my mind, from thinking this is probably a legit mishandled disclosure, to thinking it's probably fake.

On the other hand, as pointed out in other subthreads, if the devs are tired of maintaining it, this could be a legit, unappreciated-developer version of a temper tantrum. Nobody seems to know (yet).

<comment><USER57> > But what does XP being EOL'd have to do with anything?

Every version of Windows after XP has a native disk encryption utility. TrueCrypt was built to bring full disk encryption to Windows, which didn't exist at the time - this is the developers way of saying "you don't need us anymore, Windows now does what we did"

<comment><USER58> Not every version... In case of Vista and 7 only Enterprise and Ultimate editions have it and in case of 8/8.1 you need to have Pro or Enterprise edition.

<comment><USER59> True, but if you need disk encryption you probably use one of those already.

I mean, a normal use case is a corporate laptop used when traveling or similar. Normal home users certainly have no need of it, for them it's just something else that can go wrong and destroy all their data.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER60> Perhaps the TC devs were ticked off that this audit kickstarter/indiegogo has netted so much money none of which goes to the devs. And this is their way of not playing along with the whole shenanigan.

</comment><comment><USER61> There's no way this is legit, but if it is, what other kind of cross-platform solution is available? I need to be able to encrypt/decrypt on all 3 major OSes.

<comment><USER62> Maybe EncFS [0]? Its Windows port is experimental, alas. I suppose it would be suitable if you were willing to make frequent backups.

[0]: [https://en.wikipedia.org/wiki/EncFS](https://en.wikipedia.org/wiki/EncFS)

<comment><USER63> There is a relatively recent audit[1] of EncFS with some damning results. I really wouldn't use it.

[1]: [https://defuse.ca/audits/encfs.htm](https://defuse.ca/audits/encfs.htm)

<comment><USER64> > damning results

They didn't seem that severe to me, they seemed pretty minor actually. Especially if your attack vector is solely a read attack rather than a read- write attack.

Which one got you worried?

<comment><USER65> > EncFS is probably safe as long as the adversary only gets one copy of the > ciphertext and nothing more. _EncFS is not safe if the adversary has the > opportunity to see two or more snapshots of the ciphertext at different > times._ EncFS attempts to protect files from malicious modification, but > there are serious problems with this feature.

Which, seeing as my current major use case is to lock down Dropbox, kind of renders it useless for me.

<comment><USER66> EncFS is horrible.

However you should not use XTS with Dropbox [http://sockpuppet.org/blog/2014/04/30/you-dont-want- xts/](http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/)

</comment></comment></comment></comment></comment></comment><comment><USER67> I'm really confused. Which isn't unusual really, but in this case I think it is understandable.

<comment><USER62> I'm with you. This seems like an odd move, given that most likely only a minority of their users used XP for some time. Why haven't they been warning Windows Vista, 7 and 8 users to use Bitlocker for years (not to mention Mac OS X and Linux users)? Perhaps I just missed the warnings, but I am really puzzled.

I suppose the developers could have just found a massive vulnerability (perhaps they're doing their own audit in advance of the public one?).

<comment><USER68> If you scroll to the bottom, you'll find this link: [http://truecrypt.sourceforge.net/OtherPlatforms.html](http://truecrypt.sourceforge.net/OtherPlatforms.html)

<comment><USER62> I saw that. It's just that taking this line at face value, it's not clear why they would port TrueCrypt to Linux and Mac OS X or suggest that people using later versions of Windows should use TrueCrypt:

>The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP.

</comment></comment></comment></comment><comment><USER69> I remember TrueCrypt from several years ago when I was looking into various options for encryption. Haven't used encryption for a while, but if this is true, is there now an encryption software/service that doesn't involve being authored by a large corporation in the country that gave us the NSA, and which allows things like hidden volumes/partitions, algorithm choices, and use with various portable devices?

<comment><USER70> FreeBSD has GEOM/geli, which is a block-level (sub-filesystem) encryption method written by Paweł Jakub Dawidek (a Pole). It allows your choice of several data integrity verification algorithms, several encryption algorithms, and the usage of zero or more key files and/or a passphrase. And you can use it on external devices if you like. Also supports hardware acceleration via AES/NI with recent Intel CPUs.

Since it's block-level, you can use any filesystem you like. Since it's BSD, you might as well use ZFS (but don't use data integrity verification if you do, since ZFS has that built in.)

Downside is that you have to use FreeBSD to get it. Upside is that you get to use FreeBSD =)

</comment></comment><comment><USER71> The interesting thing about this is how everyone is going on about there being no cross-platform alternative. Really, is Truecrypt the only available option? Because that's a pretty sad state of affairs then; there needs to be only one unnoticed bug and pretty much all full disk encryption is broken. Unless you want to chain your data to Microsoft, that is.

<comment><USER46> There are plenty of alternatives that don't work on Windows, and a few that only work on Windows.

Thus, there is no cross-platform alternative.

</comment></comment><comment><USER72> Turning on Bitlocker has been on my TODO list for quite some time now, but to me the real value of Truecrypt wasn't full disk encryption, it was having encrypted volumes and mounting them on a as-needed basis.

And how do I handle sensitive stuff wrt backups? I could burn a Truecrypt volume to a DVD or Blu-ray. I cannot do this in any way with Bitlocker, can I?

<comment><USER73> _I cannot do this in any way with Bitlocker, can I?_

Yes. There's BitLocker to Go for encrypting removable drives, and with Windows Professional editions you can create and mount a VHD virtual hard disk file as if it was any other drive, and Bitlocker encrypt it, e.g.

[http://www.concurrency.com/blog/encrypted-container-using- bi...](http://www.concurrency.com/blog/encrypted-container-using-bitlocker- and-vhd/)

</comment></comment><comment><USER74> I recently came across this link (Apr 15 2014) [1] which references [2]. Wonder what happened.

[1] [http://www.infoworld.com/t/encryption/sloppy-secure-open- sou...](http://www.infoworld.com/t/encryption/sloppy-secure-open-source- truecrypt-passes-audit-240478)

[2] [https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_A...](https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf)

</comment><comment><USER75> A significant concern of mine with this is that Windows 8 has support for syncing your bitlocker encryption keys with microsoft. If privacy is something a user is seeking, how easy would it be to subpoena bitlocker keys for a user under duress?

<comment><USER76> Trivial. It's the same as any other business record.

</comment></comment><comment><USER77> I've always found it sketchy how the maintainers remove old versions.

Now seems like a good time to: git clone [https://github.com/DrWhax/truecrypt- archive.git](https://github.com/DrWhax/truecrypt-archive.git)

<comment><USER78> Can somebody confirm that these archives are valid?

</comment></comment><comment><USER79> Could it be related to this announcement from yesterday: "just yesterday we added the ability to extract cached Truecrypt passphrases from Linux memory dumps."

[http://volatility-labs.blogspot.de/2014/05/volatility- update...](http://volatility-labs.blogspot.de/2014/05/volatility-update-all- things.html)

<comment><USER80> Extracting TrueCrypt passwords from memory dumps has been trivial for quite a while now.

<comment><USER81> Agreed. TrueCrypt has always been upfront about the dangers of physical access to your machine (pulling master keys from RAM). This kind of response wouldn't makes sense

</comment></comment></comment><comment><AUTHOR> OP here, I came across this link via this Tweet [0] and it's probably a good idea to stay away from the linked TrueCrypt version on the site. It's version 7.2 and afaik the last version for Mac was 7.1.1 (At least that's what I installed recently).

I really hope it's "just" a defacement/DNS issue.

[0] [https://twitter.com/maclemon/status/471727027356434432](https://twitter.com/maclemon/status/471727027356434432)

Edit: Just saw the comment that they are properly signed. I'll just sit tight and wait for an announcement then.

</comment><comment><USER82> Repost from 4chan, there's a silly coincidence in the warning.

>WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues That's worded awkwardly. >Not Secure As Emphasis on the NSA in "not secure as" >WARNING: Using TrueCrypt is NSA it may contain unfixed security issues.

</comment><comment><USER83> In case this is legit: Bitlocker so far so good, but neither Bitlocker nor any other crypto solution offer plausible deniability (aka hidden volumes).

<comment><USER84> I've heard multiple rumors that the NSA has a backdoor in Bitlocker. I don't trust any of this.

<comment><USER85> I suppose this leaves yet another possible explanation: A secret order with the intention of getting people to stop using truecrypt and start using bitlocker (possibly either bl and/or tpm has some convenient back doors in them...)?

</comment></comment></comment><comment><USER86> If this is true it's time to fork I guess. Though I remember TC having a weird license. Anyone knows to what extent TC would be forkable?

<comment><USER87> Amusingly, they modified the license to remove the advertising clause that was causing trouble. The author seems really awesome the way they are handling this, wish they weren't stopping. It may be out of their hands, however: NSA, law suit, whatever.

</comment></comment><comment><USER88> Just did a quick search and came across this:

[http://archive.today/h68Xb](http://archive.today/h68Xb)

I find it very odd that this person also mentions BitLocker... Anyone know who this Peter Kleissner is?

</comment><comment> UVB-76 Suspicion this could be related to the NBC News Snowden interview to be aired tonight?

<comment><USER89> It's hard to see how it could be, but it's hard not to suspect something, given the timing. That'd be a pretty big chance coincidence.

</comment></comment><comment><USER90> So what was the point of raising money to audit TrueCrypt if they knew they would shut it down once XP was EOL? In fact why didn't they announce this earlier?

<comment><USER91> Maybe the result of the audit is that it's not secure?

<comment> artumi-richard But without a similar audit on the alternatives proving their security, surely the most responsible action would be just to explain there is a problem and stop there.

</comment></comment></comment><comment><USER51> Site seems to be getting close to bandwidth quota and returning error occasionally. image mirror from @FiloSottile, [https://pbs.twimg.com/media/Bov18I1IYAEGFEb.png:large](https://pbs.twimg.com/media/Bov18I1IYAEGFEb.png:large)

</comment><comment><USER92> If the developer wanted to 1) motivate a fork, 2) maybe abandon the license under the guise of "he dare not reveal himself for the purpose of enforcing it", and 3) still keep the TC-hugging ciphernerd throngs willing to use the forked software by suggesting an alternative so unpalatable, then he might take actions like we've seen here; and the results might be that he could 1) come out of hiding as some "new" project lead, 2) license it differently, and 3) have a huge, loyal user base. This means he might now be able to participate in funding campaigns like the Audit's and make money from licensing it to, for example, commercial enterprises, without generating too much outrage.

</comment><comment><USER93> So... the best course is likely a bit of patience. However, is there any way to establish some trustworthy mirrors of 7.1a for those who need it while this is still in the course of blowing over?

(I'm just bringing up some new machines, myself -- I'll have to hunt a bit for local copies from the last time I downloaded (legitimate copies of) the 7.1a version.)

\--

P.S. For two recognizable names/sites (to me, at least) near the top of a Google search, FileHippo and CNET are hosting Windows .exe intallers for 7.1a . No signature files, though. And with CNET (download.com), as I seem to recall and last I heard, they practice wrapping the actual product installers inside their own crapware installer.

<comment><USER94> Just checked - i have 7.1a source + windows installer. Securely encrypted on a truecrypt volume. So I baked them up a few times.

In a few days there will be some information and possibly a fork.

</comment></comment><comment><USER95> [http://arstechnica.com/security/2014/05/truecrypt-is-not- sec...](http://arstechnica.com/security/2014/05/truecrypt-is-not-secure- official-sourceforge-page-abruptly-warns/)

</comment><comment><USER96> Screenshot before the site went down.

[http://i.imgur.com/rmuogzH.jpg](http://i.imgur.com/rmuogzH.jpg)

</comment><comment><USER97> Maybe it wasn't someone's account being compromised, maybe some of the developers got into a huge disagreement and one of them did this as a kind of "fuck you, I'm done" to the rest of the team.

</comment><comment><USER72> Is that real? Is the web page just defaced?

<comment><USER98> truecrypt.org does a redirect to this sourceforge page, so perhaps it is the DNS that got hijacked, and not truecrypt website itself.

I don't remember TC ever being hosted on SF, so I think this is a bad redirect...

<comment><USER99> On the other hand, SourceForge lists the project as having been created in 2004: [http://sourceforge.net/projects/truecrypt/](http://sourceforge.net/projects/truecrypt/)

<comment><USER100> The SF account could have been compromised too.

<comment><USER99> Certainly, it just makes it less suspect that it's on SourceForge at all. (Unless SourceForge lets you rename projects? Then it could be an old placeholder project that's been renamed to truecrypt.)

</comment></comment></comment></comment></comment><comment><USER101> It is the only full disk encryption software currently used that offers plausible deniability.

Plausible deniability is the key here.

It think the FBI and/or the NSA bullied the developers and forced them to this.

<comment><USER102> PLEASE DELETE THIS POST!

Dear mod, as you seem to moderate posts (of new user accounts??) I post here despite mailing: Please update [http://ycombinator.com/newswelcome.html](http://ycombinator.com/newswelcome.html) to reflect that posts are moderated before being published (and in which cases) and the actual meaning of "You're submitting too fast. Please slow down. Thanks." (i.e. which frequency is 'OK' etc.). It made your site easier to handle and so more attractive to users willing to abide the rules.

Thank you.

<comment><USER103> Comments from new accounts posted through Tor are killed automatically. This was necessary because of abuse by spammers and trolls. Moderators unkill many of these comments and mark the user accounts as legit so their comments won't be auto-killed.

Please don't post comments like this one, though. As the HN guidelines say, you should email email@example.com instead. We can't always answer right away, but we do answer.

</comment></comment></comment><comment><USER104> If you're looking for actively developed cross platform free software alternative: [http://www.getsafe.org/](http://www.getsafe.org/)

<comment><USER105> Can anyone else comment on the viability of this option? It seems pretty nice, from the website, but I'd like to hear more about it's reputation in the security community.

<comment><USER106> GetSafe was discussed a few times on HN. A potentially interesting thread: [https://news.ycombinator.com/item?id=7588497](https://news.ycombinator.com/item?id=7588497)

It is not full disk encryption, so not a direct alternative for a product like TrueCrypt. I believe it uses a RAM disk for the files so you're limited in size, too - something like that.

Personally I'm not a big fan of using WebDAV to expose the encrypted file system - it seems like a large liability. But I'm not a real security expert at all, just saying it sounds complicated to get right (caching could keep a unencrypted copy) and exposes an even larger attack surface.

</comment></comment></comment><comment><USER107> Time for OpenTrueCrypt AKA LibreTrueCrypt? Theo, we're ready and we're waiting! ;)

</comment><comment><USER108> Just trying to make sense of the news, ( did I miss something, or is this the current state of the rumor mill?)

1\. Truecrypt.org redirects to TrueCrypt's sourceforge account.

2\. The sourceforge page is defaced.

3\. There is a signed(?) binary which can only be used to migrate.

Sounds remarkably bad ( and remarkably much effort for the lu1z.) So is there a defined version for the audit? ( Such that there is a known good version to roll back to?)

</comment><comment><USER109> Must be fake/ a hack. It wants you to download Truecrypt 7.2, but according to Wikipedia[0] and other download-portals the most recent version is 7.1a. [0}[https://en.wikipedia.org/wiki/TrueCrypt](https://en.wikipedia.org/wiki/TrueCrypt)

</comment><comment><USER110> Can't help but think of Marco Arment's point about free applications... Sigh. Just wish I could throw a bit of money at them now to stop whatever the heck is going on here (and yeah, I know I probably could have donated before but fact is I didn't).

</comment><comment><USER111> It doesn't appear to be related to the Audit [https://twitter.com/matthew_d_green/status/47174183672207360...](https://twitter.com/matthew_d_green/status/471741836722073600)

</comment><comment><USER112> wow this is a kick in the nuts. i've been using truecrypt for years. i probably won't stop just because development has ceased... but i'm still curious to know what the real story is behind this. seems sketchy.

</comment><comment><USER113> I missed the part where this document lists the vulnerabilities in TrueCrypt.

<comment><USER114> It says 'may', which is a responsible message if you're abandoning security software. Never know what the future holds; don't want to encourage people to rely on it if bugs will never be fixed.

</comment></comment><comment><USER115> Back and forth speculation is great and all, but does anyone know of a solid alternative to TrueCrypt? Perferably open-source but at the very least not a potential government lap-dog like Microsoft?

<comment><USER116> tcplay - [https://github.com/bwalex/tc-play](https://github.com/bwalex/tc- play) \- is truecrypt compatible but based on dm-crypt, afaik it's only compatible with Linux/BSD although for privacy-conscious individuals, few other operating systems make sense to run.

Wild guess here but you might want to recreate any containers using tcplay and copy files over, rather than continuing to use possibly compromised truecrypt containers.

For full-disk encryption Linux has LUKS/dm-crypt/cryptsetup.

<comment><USER117> Given that we know nothing about the security of TrueCrypt at this point, can we really say that tcplay is safe? I am especially reluctant to use TrueCrypt to access tcplay containers using the TC gui. Thoughts?

</comment></comment></comment><comment><USER118> [http://news.softpedia.com/news/TrueCrypt-Not-Dead-Forked- and...](http://news.softpedia.com/news/TrueCrypt-Not-Dead-Forked-and- Relocated-to-Switzerland-444447.shtml)

home: [http://truecrypt.ch/](http://truecrypt.ch/)

source: [https://github.com/FreeApophis/TrueCrypt](https://github.com/FreeApophis/TrueCrypt)

twitter: [https://twitter.com/TrueCryptNext](https://twitter.com/TrueCryptNext)

</comment><comment><USER119> I just hope that light will be shed on this sometime soon so the speculation will stop. If you guys have looked at the audits you can see that if there are any ones that can cause harm you need administrator level access, and by that point why try to break into truecrypt by screwing with volume headers when you could just install a bloody ASM keylogger and call it a day.

I honestly think that the government is behind this fiasco, nobody just ups and leaves a massive project used by millions without leaving a valid note.

</comment><comment><USER120> I'm not too up to date on TrueCrypt, but are the authors of the project known? Or is their identity unknown? Can they be contacted in any way, or is there anywhere they post often?

</comment><comment><USER121> If I take this message at face value and decide to switch to BitLocker, can someone answer this.

Dropbox + Truecrypt take full advantage of block sync & block encryption i.e. if a tiny piece of data is modified inside an encrypted container, only the relevant blocks are synced on update. Dropbox does not need to sync the entire container each time. This is a very useful feature. I know Google Drive & OneDrive aren't that smart.

Will bitlocker + Dropbox work the same way?

<comment><USER106> Bitlocker is block based, too. It uses a diffuser keyed off the sector to serve in lieu of an IV. So block-based sync software should work just as well on it.

</comment></comment><comment><USER122> Perhaps it's time for a fork.

<comment><USER90> The TrueCrypt license is not OSI approved, so probably noone wants to touch it for the same reason noone wanted to touch OpenSSL for all those years ... unless you really really have to and have no alternatives.

<comment><USER123> With the authors anonymous and presumably intending to stay so, there is nobody to challenge copyright violations against their code. Furthermore, international copyright law can have a certain flakiness in execution depending on various circumstances.

Not that it makes it right, but the limitations of licensing are more ethical than practical.

</comment></comment></comment><comment><USER91> OS X version [http://truecrypt.sourceforge.net/OtherPlatforms.html](http://truecrypt.sourceforge.net/OtherPlatforms.html)

</comment><comment><USER124> I was wondering: That page on SourceForge with the warning wasn't put up only yesterday, was it? Because, I could've sworn I came across that page several days ago (or even more) and when I saw people talk about the page allegedly being a hoax yesterday, I couldn't help but wonder why it was discovered all of a sudden only yesterday and not before.

</comment><comment><USER125> This is the best analysis I have seen on the situation so far. It has the facts, cites sources, and gives a few theories as to what may be happening.

[http://www.etcwiki.org/wiki/What_happened_to_Truecrypt_- _May...](http://www.etcwiki.org/wiki/What_happened_to_Truecrypt_-_May_2014)

<comment><USER126> Great theories, good list of facts, but there aren't too many facts to begin with. Any ideas to add?

</comment></comment><comment><USER127> You can still reach the old website, if you're asking the SF-webserver for the index.php (not the index.html). That site seems pretty normal, except for the warning: [http://truecrypt.sourceforge.net/index.php](http://truecrypt.sourceforge.net/index.php)

</comment><comment><USER128> From Matt Green's twitter. "This is Truecrypt's advice on creating an encrypted Mac disk image. Encryption: none."

[https://twitter.com/matthew_d_green/status/47199831543788339...](https://twitter.com/matthew_d_green/status/471998315437883392)

</comment><comment><USER129> Why have they only talk about how to secure a partition in Windows. Would the developers, or persons who took over the project, not care about other operating systems?!

Of course, by 'they', I mean the fake development team that the hijacker of the site wanted to portray... no way this is real

<comment><USER130> TrueCrypt is, to be honest, Windows software. The Linux version is a port and used to lag far behind the Windows version featurewise (for some time it was command line and even read-only).

</comment></comment><comment><USER45> One thing I have noticed is that the version they have on this site is 7.2, and if I remember this correctly, it was 7.1a that was on the truecrypt.org (checked a few days ago...)

So they've put up a new version and telling us it's for migration only?

<comment><USER87> Amusingly it also has unrelated changes that look like the developer was working on 7.2 for a proper release before this.

</comment></comment><comment><USER131> This entire situation creates a real headache for people who train human rights defenders, activists and journalists. Quite a lot of the material, lessons etc rely on TrueCrypt (even though many of us had suspicions about it.)

</comment><comment><USER132> Related: [https://www.schneier.com/blog/archives/2014/04/auditing_true...](https://www.schneier.com/blog/archives/2014/04/auditing_truecr.html)

</comment><comment><USER133> Why not turn this around (for fun): It was developed by agencies all the time, and someone from within (snowden fanboy) decided now to blow it up.

So it's not defacing, but dedefacing -or so ..

</comment><comment><USER134> For me the most weird thing is, that the authors of the current text on the website are mentioning the end of the XP support as a reason.

Am I the only one who things that is odd?

</comment><comment><USER135> My money is on setting a very weak password on the sf.net account to allow trust in the project to be reduced. This allows them to comply with an NSA order.

</comment><comment><USER136> Maybe it is time for LibreTruecrypt ;) like LibreSSL !

<comment><USER137> No it has to be called openTruecrypt first and then we fork that to LibreTruecrypt

<comment><USER45> Someone has to fork openTruecrypt to Go-ot before that, too. (and merge those to LibreTruecrypt...)

</comment></comment></comment><comment><USER138> I'm seeing a message, "This project has been temporarily blocked for exceeding its bandwidth threshold."

Does anyone have a cached version?

<comment><USER96> Or a screenshot?

Edit: Found it. [http://i.imgur.com/rmuogzH.jpg](http://i.imgur.com/rmuogzH.jpg)

</comment></comment><comment><USER139> This is a call to look at BitLocker very closely.

</comment><comment><USER140> Interesting github project:

[https://github.com/bwalex/tc-play](https://github.com/bwalex/tc-play)

</comment><comment><USER141> State sponsored hacking?

I'd think it's to organised for a defacement (re-written code, signed binaries, two sites compromised). I can't see money being made, so can't see criminal.

That kinda leaves a state sponsor with the organisation skills and commitment. It gets to create doubt about the product and slow it's uptake down.

Or it's real :/

</comment><comment><USER142> The OSX instructions are particularly hilarious: encryption - none..

<comment><USER143> Mistake.

</comment></comment><comment><USER144> checkout www.truecrypt71a.com for forums, downloads and information

</comment><comment><USER145> what about the enterprise-class ecryptfs? it works at the filesystem level instead of block(hard-drive partition) level though.

</comment><comment><USER146> What about for the Mac?

</comment><comment><USER147> inb4 LibreCrypt

</comment><comment><USER148> Wow this is a real surprise

</comment><comment><USER149> Even if this is not real, it reduces my trust in the TrueCrypt team (since they were able to get hacked).

</comment><comment><USER150> The poor Czech guy who wrote TrueCrypt and had the pgp keys will be found hanged with his finger nails removed.

</comment><comment><USER151> Seems like a state-financed targeted attack. It only has to last long enough to get the target (a user of truecrypt) to switch off it. My guess is whoever they are going after is being inundated with links to the page. They must also be a Windows user, since they took great pains to demo how to move the data.

</comment><comment><USER152> I don't see why so many are jumping onto conspiracy theories. Truecrypt, like the page states, has become redundant with built-in OS offerings. While it could be used for other things, the main reason/drive behind its development was the Full Disk Encryption feature, which has only ever worked on Windows, and has only ever truly been "necessary" for Windows XP users. Windows had bitlocker for FDE since Vista, Mac OS X had FDE built-in with Filevault 2 since Lion, and linux since installers started shipping with dm-crypt built- in. Like it or not, with Windows XP being obsoleted there isn't much drive left to develop something like Truecrypt. Just use the built-in OS features.

<comment><USER153> There are people in this world that do not trust big corporations with their data. Truecrypt is (was ?) a welcome alternative to Bitlocker and Filevault.

<comment><USER152> Because developers who refuse to show any responsibility for the code they've written (by staying anonymous and thus not risking their career/credibility in software) are much more trustworthy than "big corporations" right?

It hasn't even been a month since phase 1 of the first truecrypt audit ended. Which means up until now this piece of software was as shady as it could be.

<comment><USER154> People who create security software are always targeted by governments, and a lesser extent hackers. Truecrypt devs who remain anonymous can produce software in a much safer environment. Just like Satoshi. Code can speak for itself.

<comment><USER152> > Code can speak for itself.

The constant open source mantra of "code speaks for itself" strikes again.. except that none of the competent eyeballs have looked at truecrypt up until very recently (phase 1 audit ended in April 2014 which is ten years after the first truecrypt release). A lot of good did it do with OpenSSL too.

But surely, code written by anonymous, untrustworthy developers that hasn't been looked at much for ten years is worth more than code written by a corporation that has a public image to uphold.

As for "being targeted by government" that's called conspiracy theories. Unless you live in a place like Russia or Saudi Arabia you don't have anything to fear just because you wrote encryption software.

<comment><AUTHOR> > As for "being targeted by government" that's called conspiracy theories.

This is already happening and not a conspiracy theory any more:

[0] [http://nakedsecurity.sophos.com/2012/06/08/interest-in- crypt...](http://nakedsecurity.sophos.com/2012/06/08/interest-in-cryptocat- spikes-following-developers-interrogation-at-us-border/)

[1] [http://www.cnet.com/news/researcher-detained-at-u-s- border-q...](http://www.cnet.com/news/researcher-detained-at-u-s-border- questioned-about-wikileaks/)</comment></comment></comment></comment></comment></comment>


Don't base your business on a paid app - <AUTHOR> https://signalvnoise.com/posts/3956-dont-base-your-business-on-a-paid-app <comment><USER2> The generalization of this statement: "Don't base your business on a fundamentally unsustainable business model."</comment>


Show HN: Recapp'd – Improving NBA boxscores - <AUTHOR> http://recappd.com

<comment><AUTHOR> OP and author here to add some context.

This is a side-project that was motivated by learning. As a software engineer in the medical device space by day, this project was an opportunity to develop a web app (first time doing this solo), learn a relatively new technology (rails), and scratch my own itch.

The problem I was having that this site attempts to solve is that of a long- time NBA fan, who used to have a lot more time to dive into scores, read game- recaps, peruse boxscores and watch video highlights. As I found my free time dwindling while my appetite for information remained the same, I longed for a solution that would give me more information 'at a glance' than your typical ESPN scores page.

It's plainly obvious I'm not a designer, nor experienced web developer, but I'm proud of having followed through and launching something. I've been spending an hour here and there on the site, with long breaks in between (for example, when your scraping source decides to change their schema, sigh) for over 2 years now.

Games at-a-glance: [http://recappd.com](http://recappd.com) Sample detailed box-score: [http://recappd.com/games/2015/1/21/OKC- WAS](http://recappd.com/games/2015/1/21/OKC-WAS)

Feel free to click around. Player names, teams, and badge descriptions (hover, then click on help-text) all lead to other pages.

Would love feedback and suggestions. I've got new features in mind. For example, adding quick video highlights by embedding Vines.

</comment><comment><USER2> Very interesting. How are you computing your badges? What is you source of information?

<comment><AUTHOR> Thanks! The play-by-play is scraped from si.com into a SQL schema and the badges and stats are compiled from there. It's all done with a background worker (Resque).</comment></comment>


120hz Television "Smoothing" Must Die - <AUTHOR> http://theeditdoctor.tumblr.com/post/3448926555/120hz-television-smoothing-must-die

<comment><USER2> _"24fps has less frames and invites your brain to be a more active participant in the presenting of persistence of motion. 30fps requires less participation. It feels a little more like real life and less artful. "

"So, the drama and emotion of a film or film speed scene with this 120hz smoothing is diminished. Our brains are less active and less participating. Aesthetically, we're looking at a new process for making FILM look much more like VIDEO now. It really changes the emotion of experience… and it does it so loudly…"_

Smooth motion rendering diminishes the drama and emotion of a film? Really?

<comment><USER3> And colour television is worse than black-and-white, too.

<comment><USER4> Talkies ruined the cinema piano, culture has never recovered since.

</comment></comment></comment><comment><USER5> This dude is ranting about the wrong thing. There are parts of Avatar and Transformers, etc, that look like you're running a game on an overloaded computer.

The problem here isn't televisions running at a high rate. The problem is film adhering to the bleeding edge of what was possible 100 years ago. 24fps is _not_ adequate to handle lots of motion.

<comment><USER6> You're right, but he's also right- it "looks funny" and people don't like it.

<comment><USER7> Do you have reference about that claim? (that people don't like it)

</comment></comment></comment><comment><USER8> I agree, it really looks strange, the interpolation just makes motion look somehow wrong. Native 48 fps would just look much more realistic.

<comment><USER6> The problem is that people dislike the `smooth' sensation of high-fps video in their films- is there really something magical about a multiple of 24 that would keep that jerky feel?

<comment><USER9> A multiple of 24 like, say, 120? I'd always thought that 120Hz TVs were being pushed because 120 is a multiple of both 24 and 30.

<comment><USER10> That was the original push, but lots of manufacturers botched the implementation. For example, some would apply 3:2 pulldown to 60hz and then double it instead of 5:5 pulldown. Nowadays 240hz are all the rage making movies look like a cheap karaoke video.

</comment></comment></comment></comment><comment><USER11> 24fps must die. When they'll start making movies that gamer can watch without this feeling that he is sitting in front of too old machine?

I've seen high resolution, high fps movie in cinema and it was so amazing that I remember it after many years despite the fact that it was about usual day of some old couple.</comment>


Show HN: The Instagram of Ecommerce - <AUTHOR> http://www.sailr.co

<comment><AUTHOR> What do you think? Give me some feedback!</comment>


Spamnesty: Waste spammers' time - <AUTHOR> https://spa.mnesty.com/ <comment><USER2> I love that, the conversations are a great read! Unfortunately I haven't seen a spam mail like that for a while (perhaps Gmail's filter?), otherwise I'd start using it immediately!

</comment><comment><USER3> Great idea. You could generate a DailyWTF-esque website with all the conversations.</comment>


HN is using SPDY.  Woot. - <AUTHOR> https://github.com/ElbertF/Wappalyzer

<comment><USER2> This is because Hacker News uses CloudFlare for DDoS protection, and Cloudflare supports SPDY.</comment>


Metcalfe's Law is Wrong - <AUTHOR> http://spectrum.ieee.org/print/4109

<comment><USER2> Excellent article, though the headline looked a bit flamebaity at first.

The author's main point: the growth of a network's value can be better approximated by n log(n) than by Metcalfe's n²-n.

Looking at online communities and social networks, I would even go so far as to say that their value function looks more like a bell curve (taking into account negative factors like spam, scoundrels and stupidity). Anybody still on Usenet?

</comment><comment><USER3> Too bad Spectrum articles don't have abstracts.</comment>


Show HN: Simple markup for rich terminal reports - <AUTHOR>

I have built WOPR - a simple markup for rich terminal reports, presentations and infographics
You can try it:
$> curl tty.zone/1\?cols=$((COLUMNS))
(if you experience firewall issues replace tty.zone with ec2-23-21-64-152.compute-1.amazonaws.com)
Or if you can handle a full deck:
$> p=0; while true; do curl tty.zone/$((p++))\?cols=$((COLUMNS)); read; done
More details:
http://github.com/yaronn/wopr <comment><USER2> This is really neat, great job!</comment>


Ask HN: modern hardware with 80s era video (CGA or so)? - <AUTHOR> Can I get an otherwise modern computer (that can run *nix) that won't support showing images or video or will do it very poorly because of driver issues or just because the hardware can't do it.  A CGA monitor would be fine.  A monochrome monitor would be fine.  I really liked that old amber text on black background.  The idea is to make the computer less exciting and distracting. <comment><USER2> There are several ways you could do it.

1: Don't run an X server; stay in the text console.

2: Run X, but just open up an Xterm to full screen. That way, when you do need something fancy, you can just run it.

3: Buy an old DEC terminal off ebay and hook it up to your new computer. If your new computer doesn't have a serial port, you can use a USB serial adapter.

4: Buy a really old computer and use it to telnet/ssh into the new one.

5: I once made a Compiz display filter to green/black and amber/black. The problem with that is Compiz was buggy in regards to which windows the filter actually worked on. Also, I can't remember exactly how to do it anymore. It looked cool when it worked, though.

<comment><AUTHOR> It's more about not even being able to run X or running it at a color depth that makes videos awful. But thanks for the good suggestions. DEC terminal sounds interesting.

</comment></comment><comment><AUTHOR> Ok I might have to try cathode, and maybe a telnet solution. I'm also considering freebsd, they probably don't have drivers for my laptop video card anyway. It's funny how desktop computer users are nearly forced to have the whole enchilada or no computer at all.

</comment><comment><USER3> If you're using OS X go look for the Cathode app. Set it to your favorite paleolithic-era CRT type,set it to full screen, and voila! :)</comment>


Silverlight: The Rumors of My Death Have Been Greatly Exaggerated - <AUTHOR> http://azurecoding.net/blogs/brownie/archive/2011/06/11/silverlight-the-rumors-of-my-death-have-been-greatly-exaggerated.aspx

<comment><USER2> The title is all wrong. He is not in charge of Silverlight. Pure speculation.

My reading of directui is that XAML is staying but Silverlight libraries are a dead end. If you are a component vendor, you will stop writing additional components for Silverlight. This also heralds the end of any ecosystem for Silverlight. Yes, there may be SL die hards, but they are going to be like Visual FoxPro developers today. Abandoned.

Developers over the next few years are going to have to migrate their work over to DirectUI for tablet development while retaining Silverlight for Windows 7 OS. Oh Silverlight, we hardly knew you.

<comment><AUTHOR> There is indeed some speculation on my part...but it is based on diving into what is publicly available. There are threads where people have dissected the leaked builds and shown how to create apps using the same apis that you use today for Silverlight. I personally have not downloaded any of them (though I'm significantly tempted).

True, Silverlight apps may not port directly, especially if you break out of the sandbox and do things that aren't supported within the platform. But because of the fact that Silverlight compiles down to IL...all Microsoft needs to do is bring the Silverlight VM over and boom it just works.

Basically what I've done is looked at the current state of the ecosystem and what has been revealed publicly for the future and connected the dots. If you look at the demo video and observe some of the animations and rich interaction being shown, it's obvious that it's not just HTML on display there.

<comment><USER2> Yeah, I've been following the naiveuser Jupiter dissection. There is no Silverlight runtime. A new library has been developed on top of DirectUI, similar to Win32 on WinNT. It is not WPF and it is not Silverlight. It will probably start as a subset and end up as a superset. Some parts will not map directly from Silverlight. It looks like the animations have a new model. You will have to port your SL app for this to work.

</comment></comment></comment><comment><USER3> From its initial introduction Silverlight was Microsoft's response to Flash. It's development was a business strategy rather than the next step in the evolution of a programming paradigm.

If you accept that very few if any mobile apps are being developed/sold now with either Flash or Silverlight then you have to accept that the future of those technologies are in question.

The only thing that we can be certain of is that any decisions on the future of Silverlight will be based on a business strategy. The repercussions to developers from any decisions made will be of little or no significance to those making the decisions.

<comment><AUTHOR> Microsoft has over 20000 apps on the Windows Phone 7 market place...I don't know the exact mix between Silverlight vs. XNA (the two frameworks that you can target WP7 with) but I'd feel safe betting that at least 75 percent are Silverlight. 15000 apps is hardly what I'd call very few.

<comment><USER4> Can you point to the real "showstoppers" on this platform for comparison to other apps on iOS/Android?

<comment><AUTHOR> First are the apps that are built in to the device. The Zune Media Player coupled with a Zunepass lets you download almost any song in the library directly to the device. I've been able to consistently name a song, look it up on the zune marketplace and listen to it 30 seconds later.

The Office hub integrates with Sharepoint Online allowing you to collaborate on documents from your phone. Make annotations etc. Included in this is OneNote which becomes a portable notebook.

The Games hub has full Xbox live integration with games from the major publishers made specifically for the phone.

Facebook and Twitter both have multiple clients both "Official" and third party.

Netflix, Kindle, Youtube, and a number of other major media outlets have native clients.

4th and Mayor is a foursquare app that was written as an example app by a member of Microsoft's platform evangelism team (<http://www.4thandmayor.com/>)

So far there hasn't been a case where I wanted an app to do something on my phone and couldn't find multiple examples both free and paid. The ecosystem is very robust. Microsoft just released tools to simplify porting apps from iOS and Android so it's only going to grow from there.

</comment></comment></comment></comment><comment><USER5> I think there's a very good chance that the Silverlight "brand" is going away. People think of it as a browser plugin and, whether rationally or not, popular opinion has turned against browser plugins.

Just like with Zune, the brand going away doesn't necessarily mean that the actual technical components are. (Did you know that the development platform behind the Microsoft "SPOT" smart watches initiative from a while back is still being actively maintained - they just released a new version with significant new features a few days ago? It's been repurposed and rebranded as the .NET Micro Framework, a competitor of sorts to Arduino, but the API namespaces still begin with Microsoft.SPOT!)

<comment><AUTHOR> I'm not sure if they'll call it Silverlight (although I think it would be smart if they did), but the skills used in developing Silverlight applications will translate directly to the new platform.

</comment></comment><comment><USER6> I think the panicky response is unwarranted based on the demo alone, which I thought looked as though the metro UI was still implemented in XAML.

I think the main issue is that Microsoft has a history of delivering mixed messages and ill-fated solutions that disappear within a couple years. I remember seeing a MIX video (can't find it anymore) from when they announced Silverlight where Microsoft made fun of themselves for doing this to developers so consistently in the past with things like Hailstorm.

Alternately, it could just be a convenient excuse for developers who might have already been looking at platforms with more buzz like Android & iOS.

<comment><USER7> The problem here is they made this announcement to the Wall Street Journal. Had they done this at a developer conference it would be "just another Microsoft sending mixed signals" thing. But by saying "HTML5 is our development engine" to the largest business newspaper in the world they put MS developers in a tough spot. Because CEOs and CFOs read the Wall Street Journal and suddenly want to question every budget item that contains the word Silverlight.

</comment></comment><comment><USER8> After watching the demo, I kind of wondered if they expected this initial reaction. Or rather, wanted to see the community's reaction. From there, they could have taken a pure HTML5+JS path if there was nobody upset about dropping .NET. Alternatively, having an upset community shows how much passion and investment there is for XAML.

Good writeup though, it is interesting that XAML has exactly the same mindset as HTML5+JS. Only under MS's control.

</comment><comment><AUTHOR> Discusses why the speculation about the future of Windows Development is little more than pure hysterics.

<comment><USER9> Are you, in fact, the author?

In the post you say "Effectively the past 5 years has served to wean developers off what came before and start learning the future of Windows development."

I really wonder if this comes from the same planet I'm on.

I'm a software developer at work and our products don't currently depend on anything newer than .Net framework 2.0. A huge percentage of our customers are running XP SP2 or Server 2003r2. I can't imagine how far into the distant future that anything announced for Windows 8 and above is going to be an acceptable dependency for commercial software development.

As someone who's seen people's careers peak and die as MS promotes then abandons one generation of APIs after another I hardly agree that this kind of speculation is "little more than pure hysterics". It's an industry survival skill.

<comment><AUTHOR> I am in fact the author. I do understand the conservative approach toward adopting a new framework from Microsoft. However, as I pointed out in the post, Microsoft has been moving this way since Windows 95.

<comment><USER9> Right, and when they told us Active Desktop was the future of the Windows UI and we should bet the success of our applications on it some of us knew to ignore it back then too.

The lesson here for developers is not to do what MSDN advises you to do. Look at what MS is actually doing for its own application development. In some cases, like Office, that even means having a portable codebase.

<comment><AUTHOR> Very good point. But Microsoft has made a STRONG commitment to declarative UIs starting with WPF continuing with Silverlight. Windows Phone 7 was a total reboot of their mobile platform centered around Silverlight. There's no pussyfooting when it comes to Windows 8. They're severing the ties and going all in.

<comment><USER9> _Microsoft has made a STRONG commitment to declarative UIs starting with WPF continuing with Silverlight._

What does that even mean? Talk is cheap, show me the code.

If a DLL shipped in Vista, I can expect it will be available in Windows 8. So I might consider using it (for app code that is intended to be Windows-only) once none of my customers are running anything earlier than Vista, or maybe after MS stops providing security fixes. We recently dropped support for Win2k for example.

So new _APIs_ , even for old ideas, aren't usually interesting to me. Wake me up in 5-10 years if you're still committed to it then.

Is this one of those considerations that cloud computing (e.g. Azure) is somehow going to make go away?

<comment><AUTHOR> Again, I wasn't targeting this at people still supporting XP and the like. Unlike WPF, I don't see Microsoft back-porting DirectUI __especially __not to XP. My article was targeted at the people up in arms about the death of Silverlight.</comment></comment></comment></comment></comment></comment></comment>


AWS opening Beijing Region (for select customers) - <AUTHOR> http://aws.amazon.com/about-aws/whats-new/2013/12/18/announcing-the-aws-china-beijing-region/ <comment><USER2> I am extremely concerned about this move. We use AWS extremely heavily at our company, and as much as we love AWS, I'm concerned that their having a data center in China would subject the data and information flowing through their pipes to China's draconian data interception and censorship laws.

I remember Microsoft wanting to open up Azure in China: [http://www.theepochtimes.com/n3/4357-microsoft-azure-s- china...](http://www.theepochtimes.com/n3/4357-microsoft-azure-s-china-cloud- raises-troubling-questions/)

but backtracked just two months later, likely for exactly those reasons: [http://www.wired.com/wiredenterprise/2012/11/azure-goes- to-c...](http://www.wired.com/wiredenterprise/2012/11/azure-goes-to-china/)

<comment><USER3> Perhaps that's why it seems to be extra specially isolated (separate credentials, separate domain, separate API endpoints).

</comment></comment><comment><USER4> > Customers who wish to use the new Beijing Region are required to sign up for > a separate set of account credentials unique to the China (Beijing) Region. > Customers with existing AWS credentials will not be able to access resources > in the new Region, and vice versa.

I'm guessing this is related to China's foreign ownership laws?

<comment><USER5> Also, I imagine the various regulation ISPs and hosting providers are obligated to inside the country - if customers can siphon off data that local officials disapprove of to another region easily, it puts Amazon in a difficult position.

<comment><USER6> Also it's bad for other sites. If China pulls of their google antics on Amazon and blocks sites hosted by them its a large proportion of what we all use blocked inside China as casualties.

Hopefully it doesn't come to something like that</comment></comment></comment>


Ask HN: How to deploy to a customer that doesn't have access to your repo? - <AUTHOR>

I need to support multiple deployments to various customers. Their servers could be on anything.
I can access them, but I don't want them to be able to directly checkout code from my Github repo.
The only tool I'm familiar with is Capistrano, and as far as I know, requires access on the production machine to the source control repository. That's not what I want in this situation... Any ideas or suggestions? <comment><USER2> It sounds like Capistrano's `deploy_via` option is what you're looking for:

[http://bu.chsta.be/blog/2013-02-24/capistrano-deployment- str...](http://bu.chsta.be/blog/2013-02-24/capistrano-deployment-strategies- deploy-via-a-copy/)

</comment><comment><USER3> If you use ssh for your deployments, look up "ssh agent forwarding". It allows you to temporarily use credentials from your own local machine to perform remote operations.

</comment><comment><USER4> Take a stable version, put it into a zip, put that onto a HTTPS server, and then give them a deployment script which downloads via wget and unpacks it.

Amazon's S3 will host the zip file for pennies.

</comment><comment><USER5> No matter what you'll have code on their servers. Some languages have obfuscation/encryption you can use.

Overall from a tech perspective, I'd suggest building the app into containers (docker), so the computer they use at least becomes less important. Not sure what that means for users of Windows.

(Docker won't protect against code theft but is a nice abstraction so the host OS matters less)

<comment><AUTHOR> Having code on their servers isn't a big deal.. it's just I don't want them to checkout from my repo. (Like having to provide credentials, etc)

</comment></comment><comment><USER6> Ftploy.com?</comment>


HN for college essays - <AUTHOR>

When I was in college, essays were a big part of the curriculum, especially in humanities. IFor subjects like philosophy or history they often made up the majority of the work, learning and assessment. Do any colleges use a HN-like forum for submitting and discussing essays? Would it be useful? <comment><USER2> I'm not aware of any.

It could be very useful, but if experience tells me anything, it's that getting students to actively use an online (learning) platform of some kind is like pulling teeth. There'd be a considerable amount of feet dragging and gnashing of teeth if it were required to post articles. Just ask students who've had to post in a class forum for discussions. Many just phone it in.

That said, it could work well for students who are very engaged. Or maybe better as a department-wide thing. (That way there are more genuinely- interested students using it. Critical mass and such.)

One thing to consider is how casual Facebook/Twitter sharing, etc. among classmates fills this role to a small extent.

</comment><comment><USER3> You can try College Confidential ([http://talk.collegeconfidential.com](http://talk.collegeconfidential.com)). It's a traditional forum, but there's a lot of people who give advice there.</comment>


Making Ruby Yours - <AUTHOR> https://blog.conjur.org/making-ruby-yours/ <comment><USER2> > Taking inspiration from the Unix pipe | and Elixir's pipe operator |>, we > can refine ruby's unused >> method on the Array and Symbol classes and > write:

Ruby 2.5 introduced yield_self[1] (which is likely (or is) to be aliased/renamed to then[2]) which can accomplish more or less the same thing as the pipeline operator (it's just unfortunately not as sexy as the |> operator)

      some_var
        .yield_self { |v| foo(v) }
        .yield_self { |v| bar(v) }
        .yield_self { |v| baz(v) }

Or even more succinctly/ugly (depending on who you ask) with the coming soon then alias and using/abusing the &method(:name) syntax:

      some_var
        .then(&method(:foo))
        .then(&method(:bar))
        .then(&method(:baz))

One of the reasons I love Ruby, and some people really hate Ruby, is how easy it easy to modify the language to your task/preferences. So, you could just define alias or method proxy for >> (or whatever) to yield_self to get a cleaner, less verbose syntax (though I wouldn't do this is code that others are also working on):

      module PipelineOperator
        refine Object do
          def >>(next, &block)
            yield_self block ? &block : &proc { |v| next(v) }
          end
        end
      end

      module Foo
        using PipelineOperator

        def method
          foo >> bar >> baz
        end
      end

[1] [https://ruby-doc.org/core-2.5.1/Object.html#method-i- yield_s...](https://ruby-doc.org/core-2.5.1/Object.html#method-i-yield_self)

[2] [https://bugs.ruby-lang.org/issues/14594](https://bugs.ruby- lang.org/issues/14594)</comment>


The rising "creative middle class" – Patreon makes sure those artists get paid - <AUTHOR> http://pando.com/2014/06/23/theres-a-rising-creative-middle-class-patreon-raises-15m-to-make-sure-those-artists-get-paid/

<comment><AUTHOR> The last startup I was involved in had almost this exact business model, great work by Patreon is making it work.</comment>


Rename the Very Large Array - <AUTHOR> http://www.nrao.edu/namethearray/

<comment><USER2>
      Dennis Ritchie Memorial very_large[];

or

      space* dennis_ritchie[]; // array of pointers to space

</comment><comment><USER3> The thing that immediately comes to mind is "Sagan", though more from the image of the dishes reminding me of "Contact" than from anything else.

</comment><comment><USER4> I'd have thought that after Mister Splashy Pants people would have stopped asking the Internet to name things.

</comment><comment><USER5> "My Array Is Bigger Than Yours"

</comment><comment><USER6> Mind-boggingly Large Array

<comment><USER2> And the old one will retroactively be "a long way down the road to the chemist's" array.

</comment></comment><comment><USER7> Ellie

Figure out your own backronym, if you need one. As far as I'm concerned, I don't.

P.S. The form also asks for a prefix to the existing name. So, I propose the "Arroway" Very Large Array .

Call me sentimental, but that story represents for me a superb merging of fact and vision.

</comment><comment><USER8>
      Seq.initInfinite (fun i -> new Dish())
      |> Seq.toArray</comment>


Which Hollywood movies feature the most ridiculous code? - m-i-l http://www.bbc.co.uk/guides/zxj487h <comment><AUTHOR> Unavailable outside the UK, or at least that's the message I'm getting.

My personal vote would be for the first _Terminator_ movie, where Arnold was apparently running on a 6502 microprocessor.

<comment><USER2> Does it work if you change the co.uk to .com?

</comment></comment><comment><USER3> Relevant: [http://moviecode.tumblr.com/](http://moviecode.tumblr.com/)

I found this one the most interesting: [http://moviecode.tumblr.com/post/119171520870/in-the- movie-e...](http://moviecode.tumblr.com/post/119171520870/in-the-movie-ex- machina-which-is-really-great)

</comment><comment><USER4> On a slight tangent - if you enjoyed this article, you'll probably like [http://www.pushing-pixels.org](http://www.pushing-pixels.org), which has many interviews with designers of TV screen graphics and fantasy user interfaces.

</comment><comment><USER5> Jurassic Park with that weird 3-d graphical tree file system and the girl geek exclaiming roughly "Cool, its Unix!" gets my vote.[1]

[1] [https://www.youtube.com/watch?v=dFUlAQZB9Ng](https://www.youtube.com/watch?v=dFUlAQZB9Ng)

<comment><USER2> FSN was a real, although experimental, viewer.

[https://en.wikipedia.org/wiki/Fsn](https://en.wikipedia.org/wiki/Fsn)

There was FSV which was an open source version, and there's a newer version discussed here: [http://www.phoronix.com/scan.php?page=news_item&px=MTg4MTk](http://www.phoronix.com/scan.php?page=news_item&px=MTg4MTk)

EDIT:

> It's also worth bringing up a project with similar aim which was Sun's > Project Looking Glass and powered by Java but that Java 3D desktop has been > canned for many years now.

Holy moly this is _terrifying_.

</comment></comment><comment><USER6> In a similar vein to this, /r/itsaunixsystem is worth checking out.

</comment><comment><USER7> Featuring our very own JGC!</comment>


Ask HN: Do you still use IRC? - <AUTHOR> What are some of the channels/servers you use? <comment><USER2> Daily for 10+ years. Of course the instance sometimes loses connection, and I have to re-establish.

IRC beats _ALL_ social networks, in my experience. I've learned more, and helped/gotten help more from it, than any other source.

Started out on UnderNet. Gave up on it years ago. I'm on FreeNode. I only get on other networks if whoever has the channel doesn't have their primary presence on FreeNode.

I hang out in channels related to Linux and programming languages.

I've tried all the popular IRC clients. I _always_ come back to irssi. irssi+<multiplexer of choice, I prefer tmux> is a marriage made in heaven. :)

</comment><comment><USER3> I absolutely do, daily, with a 24/7 irssi instance running in screen on a VPS I can connect to from anywhere, but I don't frequent any popular channels or servers, just smaller ones with channels that are mostly small groups of friends who have known each other for 15 years rather than general purpose channels with a stream of new people.

<comment><USER4> Same.

</comment></comment><comment><USER5> I do from time to time, but grudgingly. I think the time has come for the Slack/Mattermost/Rocket.Chat model for a number of reasons:

      1. Better support for hypermedia
      2. Acceptance with more non-technical users, who often plan an important role in development
      3. Mobile-friendliness means I can close the laptop and continue the conversation on the train easily
      4. History logs are much easier to search
      5. Commercial support
      6. Backwards compatibility with IRC via plugins

The channels I follow are:

      - #django
      - #react
      - #elasticsearch

This has been on my mind recently as I've started a Slack group for the Stockholm Tech community [1], and I've also been validating the need one for the Django Community as well.

[1] - [https://stockholm-tech.m3b.net](https://stockholm-tech.m3b.net)

</comment><comment><USER6> IRC is still big for programming. Your language and/or framework of choice has a channel. The quality depends on the community, though.

The best alternative to IRC for "communities" is Discord. The React community uses it and it's quite fast and looks fine. It's also a bit like IRC in that you log in and then join networks with channels. It's meant for gamers though, so no text logging.

For GitHub projects, Gitter is great. Integrates well with GitHub and all it takes is one click. Performs fine too.

Every Slack chat for any open source community slows down my computer to a crawl. I love it for work and stuff, but no idea why people use it for 500+ people chats.

</comment><comment><USER7> I don't use IRC for my social life, but it's essential to my professional and software life.

Freenode, without a doubt. I've learned a lot discussing stuff on the channel, received a lot of help, and met a lot of people.

My favorite channels:

#vim - Super helpful, from extreme newb questions, to learning how to us vim more efficently, to plugin discussion, and learning about features you never even asked for

#python - Another friendly community from the pythonista to someone new to programming.

Things I don't like:

\- Disconnects. It's 2016, it's absurd I need to use a VPS to keep up with my channels on a laptop.

\- Join spam

\- Excessive reliance on bots

\- Hard for newbies, leading to a monoculture and excessive like minded thinking.

</comment><comment><USER8> Not on a daily basis, but I sometimes get in Freenode looking for support from the devs in some projects.

Fun fact: Last time I had to help a customer with their application running on my platform, I went to Freenode to learn more about the technologies used by that app (had some specific questions after reading the documentation). The customer was actually there in the same IRC channel, looking for help too, and recognised me. We had a fun conversation and were able to advance further on our troubleshooting together :)

</comment><comment><USER9> Like a lot of people, not for social purposes of internal communications, but to engage with open source communities on FreeNode.

There are a half dozen projects I use whose IRC channels are the best place to get urgent help or to talk through a complex problem or corner case. For the ones whose mailing lists are full of tumbleweeds, it can be the only viable option to get help.

</comment><comment><USER10> We use Slack at work and I use Facebook Messenger and iMessage for everything else.

Sometimes I'll watch illicit NBA streams where there will be a chat next to the video and I'll shitpost in there.

Most "channel" type discussion is best done in subreddits or places like HN rather than real-time chat. At least in my experience. I wasn't around during the heyday of IRC though so I have a bit of a different perspective.

<comment><USER11> > Most "channel" type discussion is best done in subreddits or places like HN > rather than real-time chat.

I wasn't around it as well, but I feel the types of discussions you get on reddit/HN is extremely different from irc/slack.

</comment></comment><comment><USER11> Not really, I used it daily a year ago but since then not so much. If I want to get in touch with the key people of the 'project' I am involved in I'd open it. But now Slack replaced it, it is not exactly the same people but almost.

</comment><comment><USER12> #haskell has been fun to hang out in. Had some well respected people in the community help me on some trivial problems. I recently realised there is a haskell beginners chat to. I probably should have give there instead!

</comment><comment><USER13> I use it a lot at work, the company have an IRC channel for each software on freenode, and an internal server.

I also use it to talk with my friends and to ask questions on various programming languages/api on their respective channels.

</comment><comment><USER14> Mozilla has a nice network, especially their Rust related channels. I occasionally hop on there using LimeChat on my Mac .

</comment><comment><USER15> Unfortunately I don't really use IRC because all my friends/family use more user-friendly services like WhatsApp or Slack.

</comment><comment><USER16> Nope. I am frustrated that the tool for discussing some software projects is one which doesn't allow multi-line comments.

</comment><comment><USER17> I used to, I stopped a few years ago when the old channels became empty.

</comment><comment><USER18> Yes, irc.mixxnet.net port 6697 channel #armind

</comment><comment><USER19> i lurk in #opendarwin on freenode. bunches of friendly start-up orientated minds and intelligent conversation...</comment>