Re: Truly Trulymail

[Ari Silverstein]

On Mon, 30 Aug 2010 21:50:58 -0700 (PDT), TrulyMail Support wrote:

>> Looks fairly interesting, but I'd like a lot more info on who they are....
>
> I'm John from TrulyMail Support. What would you like to know about us?
>
> The short version is that we are a Chilean company and we offer a
> secure, powerful, easy-to-use, email client which includes
> automatically encrypted messages between TrulyMail users (and optional
> encryption between email users) along with many other features. Our
> system is quite rich and you can read more about it here:
> http://trulymail.com/Features.aspx

Thanks for the info, John.

What is you and your companies background in delivering and
implementing encryption?

Who is "John", who are the investors, management and directors of
Trulymail?
--
´Looking Above and Beyond the Ramp: A Study of Buffalo Studentsÿ
Attitudes toward Alternative Modes of Transportation"

[TrulyMail Support]

On Aug 31, 12:10*pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:

> Thanks for the info, John.
>
> What is you and your companies background in delivering and
> implementing encryption?

TrulyMail (the company) has been around a short time (two years). Our
products include the TrulyMail Client and related TrulyMail services
(encrypted, private messaging, for example). We have been offering
these products for about two years now.

> Who is "John", who are the investors, management and directors ofTrulymail?

I am John (though, I am not the only one here named John). The
identities of our investors is not public information. Is this
something that is important for you to know? If so, may I ask why?

[Mr. B]

Ari Silverstein wrote:

> On Mon, 30 Aug 2010 21:50:58 -0700 (PDT), TrulyMail Support wrote:
>
>>> Looks fairly interesting, but I'd like a lot more info on who they
>>> are....
>>
>> I'm John from TrulyMail Support. What would you like to know about us?
>>
>> The short version is that we are a Chilean company and we offer a
>> secure, powerful, easy-to-use, email client which includes
>> automatically encrypted messages between TrulyMail users (and optional
>> encryption between email users) along with many other features. Our
>> system is quite rich and you can read more about it here:
>> http://trulymail.com/Features.aspx

1. Where is the source code? It would be nice if we could see what you mean
when you say "strong key encryption."
2. Why should we use this when we can already send encrypted email, and when
we have been doing so for a long time now? What exactly does your software
bring to the table, and why should we sacrifice compatibility with existing
cryptosystems?

-- B

[Nomen Nescio]

> On Mon, 30 Aug 2010 21:50:58 -0700 (PDT), TrulyMail Support wrote:


> Looks fairly interesting, but I'd like a lot more info on who they are....

> I'm John from TrulyMail Support. What would you like to know about us?

> The short version is that we are a Chilean company and we offer a
> secure, powerful, easy-to-use, email client which includes
> automatically encrypted messages between TrulyMail users (and optional
> encryption between email users) along with many other features. Our
> system is quite rich and you can read more about it here:
> http://trulymail.com/Features.aspx

> Thanks for the info, John.

> What is you and your companies background in delivering and
> implementing encryption?

> Who is "John", who are the investors, management and directors of
> Trulymail?

> --
> “Looking Above and Beyond the Ramp: A Study of Buffalo Students’
> Attitudes toward Alternative Modes of Transportation"

Some additional questions (you know how suspecious we are in this
group:-)).
1. Is the service free? I can't see anything about cost. If free,
do you intend to start charging in the future?
2. Your website is in English only. Seems strange for a company
located in Chile.
3. What is the encryption you are using?

[TrulyMail Support]

> * Some additional questions (you know how suspecious we are in this
> group:-)).

You are always welcome to ask. I will answer what I can.

> 1. Is the service free? *I can't see anything about cost. *

Yes, all existing TrulyMail services are free. Our TrulyMail Client is
also free.

> If free,
> do you intend to start charging in the future?

We will not charge for what we currently give away for free. However,
we will be offering additional services which will require a small fee
to use. Think of it like Skype: You get some services for free and
some you pay for.

> 2. Your website is in English only. *Seems strange for a company
> located in Chile.

This is not a question.

> 3. What is the encryption you are using?

We use both synchronous and asynchronous encryption. We use 4096 bit
keys which we feel is strong enough for now.

[Ari Silverstein]

On Tue, 31 Aug 2010 01:42:07 -0700 (PDT), TrulyMail Support wrote:

> On Aug 31, 12:10*pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:
>
>> Thanks for the info, John.
>>
>> What is you and your companies background in delivering and
>> implementing encryption?
>
> TrulyMail (the company) has been around a short time (two years). Our
> products include the TrulyMail Client and related TrulyMail services
> (encrypted, private messaging, for example). We have been offering
> these products for about two years now.
>
>> Who is "John", who are the investors, management and directors ofTrulymail?
>
> I am John (though, I am not the only one here named John). The
> identities of our investors is not public information. Is this
> something that is important for you to know? If so, may I ask why?

If you're dealing with security products, especially without open
source coding, /who/ you are and your background is extremely
important.

The fact that you ask this question is startling.

And informative.
--
Talk about F-Cars - www.ferrarichat.com/forum/member.php?u=89702

[Ari Silverstein]

On Tue, 31 Aug 2010 06:17:30 -0700 (PDT), TrulyMail Support wrote:

>> 2. Your website is in English only. *Seems strange for a company
>> located in Chile.
>
> This is not a question.

And your answer is not an answer.

Clue: If you are going to be a serious player in encrypted
technologies, acting in seclusion and secrecy is going to run against
any hopes for respectability and credibility.

Only buffoons and morons will be your clientele.
--
9ec4c12949a4f31474f299058ce2b22a

[TrulyMail Support]

<<< my apologies if this post gets repeated, the reply function was
not working as I expected >>>

> 1. Where is the source code? It would be nice if we could see what you mean
> when you say "strong key encryption."

TrulyMail is not open-source (at least not at this time). Accordingly,
our source code is not available to the public. If you would like to
audit our source code, we would be happy to show you some key parts of
it if you are ever in Santiago.

For us, strong-key means 4096-bit keys. That's quite a bit higher than
what is offered by PGP and others.

> 2. Why should we use this when we can already send encrypted email, and when
> we have been doing so for a long time now?

If you have a system you like, keep using it. We feel there are plenty
of users who do not encrypt now who should and will, if we make it
easy enough for them.

> What exactly does your software
> bring to the table, and why should we sacrifice compatibility with existing
> cryptosystems?

While we think we bring a lot to the table (see our features page on
our website: http://trulymail.com/Features.aspx) we also understand
that there are users who prefer to stick to the systems they already
know.

You have a choice. We think we are a great choice but it all depends
on your needs.

[Ari Silverstein]

On Tue, 31 Aug 2010 07:07:27 -0700 (PDT), TrulyMail Support wrote:

> <<< my apologies if this post gets repeated, the reply function was
> not working as I expected >>>
>
>> 1. Where is the source code? It would be nice if we could see what you mean
>> when you say "strong key encryption."
>
> TrulyMail is not open-source (at least not at this time). Accordingly,
> our source code is not available to the public. If you would like to
> audit our source code, we would be happy to show you some key parts of
> it if you are ever in Santiago.

*LOL*

What a crock.

> For us, strong-key means 4096-bit keys. That's quite a bit higher than
> what is offered by PGP and others.

If your implementation sucks, it doesn't matter if you have 400,096
megabit keys.

>> 2. Why should we use this when we can already send encrypted email, and when
>> we have been doing so for a long time now?
>
> If you have a system you like, keep using it. We feel there are plenty
> of users who do not encrypt now who should and will, if we make it
> easy enough for them.

> You have a choice. We think we are a great choice but it all depends
> on your needs.

I chose to pass.

Quickly, completely and what may be forever.
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"

[TrulyMail Support]

On Aug 31, 8:44 pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:
> On Tue, 31 Aug 2010 06:17:30 -0700 (PDT),TrulyMailSupport wrote:
> >> 2. Your website is in English only. Seems strange for a company
> >> located in Chile.
>
> > This is not a question.
>
> And your answer is not an answer.
>
> Clue: If you are going to be a serious player in encrypted
> technologies, acting in seclusion and secrecy is going to run against
> any hopes for respectability and credibility.
>
> Only buffoons and morons will be your clientele.

I had in no way intended to hide anything in my response. I think open
conversations are great. That said, one cannot answer a statement. I
could guess at what the real question is (are we really in Chile; why
is our website in English; is our use of English-only accidental;
etc.) but that would be me putting my questions into your mouth and
that just doesn't seem appropriate to me.

I do feel your response was a bit harsh but this is not a place to
critique communication style.

I will list what you might have intended to ask and if I get it right,
great. If not, I hope you will ask a clear question.

a) We are really in Chile.
b) We did choose English on purpose.
c) If we were targeting only Spanish speakers, then we would have
created everything in Spanish. However, we recognize that English is
the main international language and that is what we use here. English
is quite common here in Chile amongst the highly educated. Since we
are targeting the people of the world, English seems a more reasonable
language than Spanish.

There are plenty of companies based in countries where English is not
the official (Switzerland, Germany, etc.) who focus their
communications on English for the same reasons we do.

Now, if I may, why does it seem strange to you that our website is in
English? It helped you to learn more about us, did it not? If it did,
then it has served us well.

[TrulyMail Support]

> If you're dealing with security products, especially without open
> source coding, /who/ you are and your background is extremely
> important.

I guess it all depends on who we are targeting as our customer. For
John Q. Public to choose a system to keep his private messages
private, does he care about who made Thunderbird+GPG+Enigmail or who
made TrulyMail?

I believe he does not. I believe his primary concern is how to keep
his private communications private without spending a day getting
three pieces of software installed, setup, and configured to
interoperate. Of course, the easier path for him is to use TrulyMail,
click the Next button a few times, and have everything done
automatically.

You are clearly a very detail-oriented person. You want to know
everything about whatever topic you dig into. There is nothing wrong
with that. There are many open source systems out there which allow
you to go through the code line-by-line and you can see everything it
does.

We are not that kind of company. We are a 'bring secure, convenient
communications to the masses' kind of company.

Different fits for different people.

[Nomen Nescio]

> On Tue, 31 Aug 2010 06:17:30 -0700 (PDT), TrulyMail Support wrote:


> 2. Your website is in English only. Seems strange for a company
> located in Chile.

> This is not a question.

> And your answer is not an answer.

You just beat me in making this reply! If this was a reply from
a salesman to me, he would have just sealed the loss of the sale.

> Clue: If you are going to be a serious player in encrypted
> technologies, acting in seclusion and secrecy is going to run against
> any hopes for respectability and credibility.

> Only buffoons and morons will be your clientele.

> --
> 9ec4c12949a4f31474f299058ce2b22a

[TrulyMail Support]

> > ...we would be happy to show you some key parts of
> > it if you are ever in Santiago.
>
> *LOL*
>
> What a crock.

It is clear that you would be best served by an open-source solution.
If you believe everyone is best served by the same thing, you should
hear some horror stories of our users about trying to get encrypted
email to work when they used GPG and their broker used PGP. The short
version is that in the end, they gave up and used clear-text email -
far less than ideal.

> If your implementation sucks, it doesn't matter if you have 400,096
> megabit keys.

You're welcome to try to decrypt our messages. I'll buy you a nice
dinner if you can do it.

> I chose to pass.

You get to. Good luck to you, sir.

[Mr. B]

TrulyMail Support wrote:
>> 3. What is the encryption you are using?
>
> We use both synchronous and asynchronous encryption. We use 4096 bit
> keys which we feel is strong enough for now.

Perhaps you could shed some light on which ciphers you use? The more I read
your posts, the more I think you are another snake-oil salesman.

-- B

[Ari Silverstein]

On Tue, 31 Aug 2010 07:48:47 -0700 (PDT), TrulyMail Support wrote:

>> If you're dealing with security products, especially without open
>> source coding, /who/ you are and your background is extremely
>> important.
>
> I guess it all depends on who we are targeting as our customer. For
> John Q. Public to choose a system to keep his private messages
> private, does he care about who made Thunderbird+GPG+Enigmail or who
> made TrulyMail?
>
> I believe he does not. I believe his primary concern is how to keep
> his private communications private without spending a day getting
> three pieces of software installed, setup, and configured to
> interoperate. Of course, the easier path for him is to use TrulyMail,
> click the Next button a few times, and have everything done
> automatically.

Let me translate. You want newbies, dumbasses and those with no
education in anything cryptology to guy into your product.

OK, at least we have your marketing plan down.

> You are clearly a very detail-oriented person. You want to know
> everything about whatever topic you dig into. There is nothing wrong
> with that. There are many open source systems out there which allow
> you to go through the code line-by-line and you can see everything it
> does.

Hardly detail oriented. Examining open source code isn't my cop of tea
either.

But I do believe in peer review and your rather flippant attitude "see
you in Santiagoe" toward your code is utter ********.

But, hey, there is a large market for morons who will trust their
privacy with people like you so have at it. Expect to get zero
credibility from anyone has any teensy bit of workable knowledge
regarding encryption.

> We are not that kind of company. We are a 'bring secure, convenient
> communications to the masses' kind of company.

You're a bring the bucks to John kinda company who hides behind single
names and averts the honest intentions of prying eyes.

> Different fits for different people.

Most certainly but you can have your profits and your credibility as
well. For whatever reason, none of which I can think of that is either
honest or straightforward, Trulymail has decided to take the lowest of
low roads.

The only reasons you would do so are:

1) Trulymail is comprised of a set of waffling imbeciles.
2) You're crooked

You see, transparency is the lifeblood of professional cryptology. The
breast that feeds its reliability and innocence. You guys are as
valuable as a tit on a boy pig.

Now you are exposed which is a good thing for everyone including you.
Repent. Turn away from the Dark Side.

This "trust us, we're really good guys" is a bunch of hocus-pocus BS,
it demeans you and it demeans your products.

Remember Allende.
--
Ari's Fun Times!
http://tr.im/hrFG
Motto: Run, rabbit, Run!

[Ari Silverstein]

On Tue, 31 Aug 2010 07:39:38 -0700 (PDT), TrulyMail Support wrote:

> On Aug 31, 8:44 pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:
>> On Tue, 31 Aug 2010 06:17:30 -0700 (PDT),TrulyMailSupport wrote:
>>>> 2. Your website is in English only. Seems strange for a company
>>>> located in Chile.
>>
>>> This is not a question.
>>
>> And your answer is not an answer.
>>
>> Clue: If you are going to be a serious player in encrypted
>> technologies, acting in seclusion and secrecy is going to run against
>> any hopes for respectability and credibility.
>>
>> Only buffoons and morons will be your clientele.
>
> I had in no way intended to hide anything in my response. I think open
> conversations are great. That said, one cannot answer a statement. I
> could guess at what the real question is (are we really in Chile; why
> is our website in English; is our use of English-only accidental;
> etc.) but that would be me putting my questions into your mouth and
> that just doesn't seem appropriate to me.

It's Usenet.

What is appropriate is this discussion. Or lack of one. You want to
dance around direct questions or offer flippant responses to
professional inquiry. Yes, that is tissue paper hanging from your
shoe.

> I do feel your response was a bit harsh but this is not a place to
> critique communication style.

Harsh it was an intended to be. I get my knickers in a wad anytime I
see people who want to play at privacy, make ostentatious claims about
their products and refuse to offer any reasonable details as to basis
for those claims. Call me old fashioned. Call me an *******. I could
care less.

It's not me who is hiding behind a Harry Potter Invisibility Cloak and
shouting "No problems, trust me."

> I will list what you might have intended to ask and if I get it right,
> great. If not, I hope you will ask a clear question.
>
> a) We are really in Chile.

How do we know? Because you say so? Ain't flying.

> b) We did choose English on purpose.
> c) If we were targeting only Spanish speakers, then we would have
> created everything in Spanish. However, we recognize that English is
> the main international language and that is what we use here. English
> is quite common here in Chile amongst the highly educated. Since we
> are targeting the people of the world, English seems a more reasonable
> language than Spanish.
>
> There are plenty of companies based in countries where English is not
> the official (Switzerland, Germany, etc.) who focus their
> communications on English for the same reasons we do.
>
> Now, if I may, why does it seem strange to you that our website is in
> English? It helped you to learn more about us, did it not? If it did,
> then it has served us well.

Blitherings aside, it might as well be in Yiddish except of course
that Jews don't trust much of anyone.

Certainly not those with Harry Potter Syndrome.

Picking this issue (English v.s Yiddish) is a nice dodge but the
bottom line is this.

Maybe you will make money, maybe you won't. But until you come clean,
you will *never* have the credibility that an honest, open and
concerned cryptology company would desire.

I suggest that you could care less.

P.S. Don't even think about trying to sell to the US Gov't, DoD or any
of the intertwined military-intelligence agencies. They /really/ frown
on foreign nationals who play at such serious business.
--
9ec4c12949a4f31474f299058ce2b22a

[Ari Silverstein]

On Tue, 31 Aug 2010 07:58:02 -0700 (PDT), TrulyMail Support wrote:

>>> ...we would be happy to show you some key parts of
>>> it if you are ever in Santiago.
>>
>> *LOL*
>>
>> What a crock.
>
> It is clear that you would be best served by an open-source solution.
> If you believe everyone is best served by the same thing, you should
> hear some horror stories of our users about trying to get encrypted
> email to work when they used GPG and their broker used PGP. The short
> version is that in the end, they gave up and used clear-text email -
> far less than ideal.

Oh I see so the alternative is to "trust you" and your Wizard of Oz
act behind your curtain?

Har.

You could be a honeypot, a NSA/CIA front company, a terrorist node and
a whole lot of other much nastier things than a clear text email
provider.

>> If your implementation sucks, it doesn't matter if you have 400,096
>> megabit keys.
>
> You're welcome to try to decrypt our messages. I'll buy you a nice
> dinner if you can do it.

I won't be in Santiago anytime soon. Offer rings as hollow as your
unknown implementation of this "encryption" you have.

>> I chose to pass.
>
> You get to. Good luck to you, sir.

None to you.
--
Just Say Now!
http://firedoglake.com/justsaynow

[TrulyMail Support]

On Aug 31, 9:57*pm, Nomen Nescio <nob...@dizum.com> wrote:
> > On Tue, 31 Aug 2010 06:17:30 -0700 (PDT),TrulyMailSupport wrote:
> > 2. Your website is in English only. *Seems strange for a company
> > located in Chile.
> > This is not a question.
> > And your answer is not an answer.
>
> * You just beat me in making this reply! *If this was a reply from
> a salesman to me, he would have just sealed the loss of the sale.

OK, please let me publicly apologize. It was never my intention to
snub anyone here. My point was simply that it is easier to answer
clear questions. Clearly I was inappropriate in my response and I hope
you will forgive me.

[=?utf-8?Q?B=E2=84=AEar_Bottoms?=]

On Tue, 31 Aug 2010 07:07:27 -0700 (PDT), TrulyMail Support wrote:

> If you would like to
> audit our source code, we would be happy to show you some key parts of
> it if you are ever in Santiago.

I often fly down to South America.

How about next Tuesday?

--
Bâ„®ar Bottoms

[=?utf-8?Q?B=E2=84=AEar_Bottoms?=]

On Tue, 31 Aug 2010 11:25:32 -0400, Ari Silverstein wrote:

> Don't even think about trying to sell to the US Gov't, DoD or any
> of the intertwined military-intelligence agencies. They /really/ frown
> on foreign nationals who play at such serious business.

We will see. I say, see you next Tuesday Silverstein. Who needs to sell to
the government? I have friends who will pay big for the right service.

--
Bâ„®ar Bottoms