OSTIF Blog

Curious to see this take from you! I followed TrueCrypt for years, but always thought it was very strange that they were anonymous, and then the mysterious shutdown happened, and I have no idea what to make of VeraCrypt. It's been in my "possibly good, but too many weird flags around the whole project" bucket. Anything in particular that makes you wary? I'm aware of the 2016 and 2020 audits (https://ostif.org/the-veracrypt-audit-results/ is the 2016 one, I believe), but those seemed to suggest things were getting better over time. Curious what other signals to look for.

you are very wrong about this; dan is most certainly an infosec expert and I take his recommendation not to use openvpn seriously. Seems he was correct: https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-resul…

Might be also about how they present things. For example in the linked page they have the request for donations in small font and end of the results, but no link to donation page [1]. Edit: and on the donation page the Amazon and PayPal links are not working. Don't know how they are collecting money in general, but for me it works best when you do this: "Now we have $xxx, but we still need $yyy to do this fairly specific great thing. Please donate!" [1] https://ostif.org/donate-to-ostif/

I don't think it's meant to be a complete audit of the codebase, and in fact this is alluded to in the final report [0] (though the wording is strange—perhaps they forgot to update it from an earlier report): > Due to the size of Ruby on Rails, it will not be possible to cover all the tests and tasks in the following test plan. The tests performed will be covered in the final report along with suggestions on what to focus on in future audits. I feel like these sorts of audits are usually performed on individual applications rather than "mature" already widely used frameworks. I've got the sense that they are meant to give confidence that the developers knew what they were doing (since they focus on typical vulnerabilities that good developers should know about), rather than proving anything about the code base. Still better than nothing. [0] Section 3.7, https://ostif.org/wp-content/uploads/2025/06/X41-Rails-Audit-Final-Rep…

To back this up with an example, we (DuckDuckGo) tried to look for open source projects with 501(c)3 status or similar for donations, but many projects or organisations don't make it clear. The alternative was to look through online IRS records which not every donor will do. Another problem was finding up-to-date info about whether funding is actually needed and what for. Donors usually want to donate to a project that is needy and in line with their values. My advice for any OSS project looking for donations is: * Have a dedicated easy-to-find donations page or donations.md file. * Explain what you need funding for. Specific is better. * Indicate how to donate and how to contact you for donation questions. * Make your tax status clear, even if you're not a non-profit. * To reduce bureaucracy, consider joining a non-profit umbrella organisation such as OSTIF ( https://ostif.org/ ) or Riseup Labs ( http://riseuplabs.org/ ). * If you do get donations, report the effect of the funding either publicly or to the donor. This builds trust and increases the chance of repeat donations in future. * Include non-financial donation ideas and link to your developer page or contributing.md file (or equivalent). EDIT: The OpenBSD Foundation is a good example of easy-to-access information about donating, activities, and current and past fundraising campaigns: http://www.openbsdfoundation.org/

OSTIF's financial support is sad. Why is the open source world so generous with time and so cheap with money? Kudos to DuckDuckGo for apparently being the only business that pulls their weight; another great reason to use them. https://ostif.org/top-ostif-donors/ Top OSTIF Donors These are the individuals and organizations that have given the most support to the OSTIF. Individuals: Derek Zimmer – $1947 Zach Graves – $188 Amir Montazery – $200 Ben W – $30 Nathan N – $10 Groups: DuckDuckGo – $25,000 VikingVPN – $1000 A special thank you for website support from Mike from HTPCGuides.com EDIT: On a second look, is that list really accurate? The fifth highest individual donor gave $10? I read about the founder and long-time developer of a well-known, respected Linux distro, who had to move back to his hometown because he couldn't afford the Bay Area and has no health insurance. Maybe some of his millions of users could chip in a little for the incredible service he provides to them. How depressing.

but now Ruby on Rails is not a circus like how Next.js is. see [0]: Rails security Audit Report [0]: https://ostif.org/ruby-on-rails-audit-complete/

Veracrypt 1.18 was audited in 2016 by the Open Source Technology Improvement Fund [0]. It is incredibly unlikely that a random NSA backdoor is sitting around on a high profile open source project like Veracrypt. If you are still skeptical you are free to take a look at all of the source yourself [1]. [0] - https://ostif.org/the-veracrypt-audit-results/ [1] - https://github.com/veracrypt/VeraCrypt

Do you believe the audit was compromised as well? https://ostif.org/the-veracrypt-audit-results/

Git Security Assessment Full Report is here: https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Secu…

This sort of thing happens even for high-end pentesting. Here is the same assessment done by four decent consulting companies. They all found risks that the other companies missed. https://ostif.org/four-audits-of-randomx-for-monero-and-arweave-have-b… This is what I'm giving to clients who have unreasonable expectation that all vulns should be found during an assessment. The usually "time boxed" nature of this sort of work does allows for 1.5 sigma when many companies always expect 3 sigma coverage.

Summary link by OSTIF, which includes a quick synopsis of both audits, and link to full report on OpenVPN 2.4 by OSTIF: https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-resul… Matthew Green/Cryptography Engineering audit direct link, which focuses more heavily on the protocol design, as well as a 2.2->2.4 changelog audit: https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-evaluat…

And the very next post on their blog says: OSTIF, QuarksLab, and VeraCrypt E-mails are Being Intercepted We have now had a total of four email messages disappear without a trace, stemming from multiple independent senders. Not only have the emails not arrived, but there is no trace of the emails in our “sent” folders. In the case of OSTIF, this is the Google Apps business version of Gmail where these sent emails have disappeared. https://ostif.org/ostif-quarklab-and-veracrypt-e-mails-are-being-inter…

>I never said the Lincoln Index required prior knowledge You wrote >In fact, your second link begs the question, as it requires the prior knowledge of a "bug hit rate", so you wrote exactly that the Lincoln index "requires the prior knowledge of a bug hit rate". >which are also present in the "vast literature" in Google Ah, so you read all the literature. Good. Then you're realize there are other methods than Lincoln, so your complaint about not knowing E2 is mitigated. >I am not and have not been saying there are no further bugs in VeraCrypt. You wrote above > If there were more bugs, why weren't they found? What did you mean here except to imply you believe there are no more bugs? >I am saying the likelihood of there being "many" more bugs in VeraCrypt is not available, given the data we currently have. Here [1] is the report. It states in multiple places not all code was checked. For example, page 6, states that "Some components of VeraCrypt have not been investigated" including "the OS X and Linux versions of VeraCrypt". Want to bet if there are bugs in there? Of the parts checked, bugs were found by multiple independent groups, including Open Crypto Audit Project, Fraunhofer Institute for Secure Information Technology, and James Forshaw. These bugs have very little overlap. OCAP phase I found 11 bugs, page 4. OCAP Phase II found 4, page 16, two of which overlap previously known bugs. James Forshaw found 2 more bugs, page 18. Sections 5, 6, and 7 each list…