CipherShed compromised from the beginning?

[brosef]

How can we trust CipherChed when one of the project managers and security developers works for DISA?

Jason Pyeron: https://www.linkedin.com/in/jpyeron
What is DISA? https://en.wikipedia.org/wiki/Defense_I ... ems_Agency

It looks to me like the CipherShed project was founded with a mole from the beginning. How can anyone trust this project? It's DOA IMO.

[srg]

Oh god, you caught us.

CipherShed tried so hard to hide that Jason was even involved in the project. And by "tried so hard to hide," I mean put the information on our public wiki, including the LinkedIn profile, to make the public aware of who we are. All of us. That was a big discussion in the beginning of the project: To be anonymous or not. We chose "not."

Don't use the software then, brosef. I'd recommend BitLocker. Continue your supposititious campaign against CipherShed, ignoring our public code development and publicly archived mailing lists. We'll keep doing what we do, you keep doing what you do.

On a more serious note, why don't you do something constructive like getting involved with CipherShed. That way you can monitor and question everything CipherShed does? That would be more productive then trolling a forum and reddit.

[blakdawg]

Transparency is a must for any crypto project.

Yeah! We knew all about the guys who wrote TrueCrypt, so there's no way we could possibly trust software that wasn't at least as transparent.

If you fuckers don't get on this right now and publish everybody's resume going back a full 20 years, I am going to demand a full refund of my purchase price, INCLUDING SHIPPING. Also, we should probably have some naked pictures of their girlfriends. And they need to tell us if they use emacs or vi, and why.

[compul]

OP raises some interesting questions. I stumbled across this thread from elsewhere, I won't give the exact location since the link includes personal information and I do not support doxxing. However, what was interesting is that Pyeron was being accused of being a dual U.S. / Israeli citizen. That has far greater impact on the integrity of CipherShed than the fact that he used to work for the Department of Defense.

I don't know what to believe, but something very fishy is up with the CipherShed project.

[compul]

To all the real people reading this troll's monologues:

Yes, Jason Pyerons commits will be subject to the utmost scrutiny of a fixed number of different security reviewers (from different countries and continents, by the way); just like any other person's commits, too. We go off the default assumption that any commit may contain backdoors and / or bugs (purposefully planted or not), and thusly scrutinize every single change of the code. You may also refer to https://wiki.ciphershed.org/Introduction ("Philosophy") to get an idea of how we operate, and https://wiki.ciphershed.org/WhosWho for more information on the other people that are currently more closely involved with the organization of the CipherShed Project.

Thank you.

[krisives]

I saw this post on /r/crypto and deciced it was time I started checking out what is going on to continue TrueCrypt, so I have registered here (hope I can get around to helping out soon)

I don't fault OP for being hyper-sensitive or wanting to keep a better eye on source code changes, but as @compul said the same standard should be held for anyone committing code. There is nothing wrong with wanting to look at the code more. I do think it's wrong to call someone out without a modicum of proof or even a direction to go in. I would say the way to beat potential enemies like the NSA or GCHQ would be to take everything good from them and let them keep all of the bad parts. If we're not capable of determining what those parts are, we're pretty screwed anyhow.

Also, just curious, but why did OP make a new account, was the original account banned?

[JeSuisCharlie]

When is Mr. Pyeron going to release a public statement about his associatIon with the U.S. DoD to the CipherShed community?

Does CipherShed plan on employing the use of a warrant canary in order to alert users when they receive an NSL?

[compul]

Also, just curious, but why did OP make a new account, was the original account banned?

No, he was not. Because he is a troll, I would presume.

Does CipherShed plan on employing the use of a warrant canary in order to alert users when they receive an NSL?

That has been discussed at length in the past. Some do have warrant canaries in their mail signatures. However, we are multiple individuals from multiple countries / continents around the globe. Thus if some do receive NSLs, then ideally there are still others in other countries who haven't. Also we meet regularly on voicechat, so that impersonation is not possible for an extended timeframe.

Further, warrant canaries are untested in court. Publicly known canaries are also known to the agencies sending those letters, and those agencies might very well try enforcing keeping the canary up, and producing a false feeling of security in the community.

On the grounds of something along those lines, we at the time decided to not have a mandatory canary in all core members' email signatures (If the server admin received an NSL, the agencies may just keep maintaining the website themselves - including the canary. Again, a false sense of security would do more harm than what was gained.)

On the other hand, there may or may not (I literally do not know, obviously!) exist private canaries between the members, such that if one member receives an NSL in country A, the other one from country B can sound the alarm

You get the idea; CipherShed is not one entity that can be compromised with one letter from one judge in one country, but is spread out across the globe (USA, Europe and Asia currently).

[srg]

The "BrosefRebooted" account was banned. There's no need for one person to have multiple accounts, it causes confusion. Please use your original account. It was never banned or restricted in any way (and wont be).

Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.

And this is it.

How can you let Jason Pyeron participate in this project when he has known ties to DISA and the DoD? People are not going to take this project seriously if a U.S. Government employee, especially a DoD contractor, is one of the main contributors.

Because there are policies in place that force a review of everyones (including Jason's) code changes. In addition, the code changes are public. If one has reason not to trust the binaries, then one can compile from the GitHub repo themselves. We provide instructions. They can review each and every commit to ensure that nothing evil is being done.

3. We need a full biographical details of every CipherShed project contributor. I see at least 8 people in the CipherShed Redmine that aren't listed on the about page. Any gaps in employment history need to be justified with corroborating evidence and alibis in order to assure the community that they were not employed by the U.S. government or another five eyes nation during that time period.

That will never happen. Not because we refuse to, but because it's a distributed project. If we requre every person sending a pull request or filing a bug report to give us a full biographical background, we wont get anywhere. No one will contribute; developers will go elsewhere, the project will die.

Why don't you trust the code instead of the people behind it? You're not running people on your computer, you're running the code. It shouldn't matter of god himself wrote the code, the director of the NSA, or some homeless hobo on the street. It's the code itself that matters. You're focusing on the wrong thing here.

You claim to be transparent but I see no evidence of transparency. Transparency is a must for any crypto project.

I take it you never once used TrueCrypt then? Because we know those guys (or girls, or NSA empoyees) were so open with their personal details.

Finally, I am getting involved. That's the point of raising these questions in this forum.

Yes, and I accept that and we as a group will respond to it. We're not ignoring you or sweeping this under the rug. However, you aren't understanding that we already thought about this and developed policies and procedures and priorities to deal accordingly. Such as focusing on the code, not the people. Bill Cox himself said he doesn't even trust his own machine. Read the mailing list archives, including the original list hosted on FreeLists.

And they need to tell us if they use emacs or vi, and why.

I use vim. I have used pure vi in the past on my FreeBSD system, but vim is easier to use and has syntax highlighting. I realize that hiding my .vimrc is compromising the entire CipherShed project (you know, all my secret NSA backdoors are in my ~/.vimrc), so I'll be sure to post it on GitHub. I used emacs twice. It's annoying. Never again.

I won't give the exact location since the link includes personal information and I do not support doxxing.

Oh, that's nice that you don't support the sharing of detailed personal information!

When is Mr. Pyeron going to release a public statement about his associatIon with the U.S. DoD to the CipherShed community?

I think he already did on the mailing list. There is also discussion on how to go about handling events like this in the future, as they will undoubtedly occur again.

[rusty]

When is Mr. Pyeron going to release a public statement about his associatIon with the U.S. DoD to the CipherShed community?

I think he already did on the mailing list. There is also discussion on how to go about handling events like this in the future, as they will undoubtedly occur again.

I've been silently waiting for a post from jpyeron as well. It seems to me that his silence has confirmed the original OP's suspicion. Instead he has his cronies reply in this thread for him.

You could have provided a link to his supposed public statement on the mailing list. Instead, I went in search on my own, and while I did find the discussion about this thread ... I did not find the statement from jpyeron. All I found was a discussion about how to handle this "public relations" situation and how to do damage control. People just want an honest answer from jpyeron, not a cooked up public relations stunt.

Here's a link to the thread in the mailing list archive: https://lists.ciphershed.org/pipermail/ ... 00940.html

As far as I can tell, the Russian bloke Alexander is the only person that "gets it".