Great, here it is...

All good things come to an end and Picocrypt is no exception. Since 2021, I've been developing and maintaining Picocrypt voluntarily with great interest, passion, and care for detail and design. Although time-consuming with no direct benefits to me other than experience, I found it very enjoyable and it was nice to be involved in OSS. Since then, the software has gone through many versions, become quite stable and reliable, a CLI and Web version have sprung up, and the core source code was professionally audited. A lot of things have happened and I'm glad I could be a part of it, and I thank all of you for making it possible. It's been an amazing journey.

However, times have changed (don't they always?). LLMs have become very adept at writing code and it is starting to "replace" software engineers, or at least redefine who they are and what they do. Large tech companies and investors are buying into the vibe coding hype, prioritizing quantity over quality and laying off people who can actually code for real in the process. I originally intended to work in the software engineering industry, but seeing the complete disregard for high quality code, overpowering greed and hype, and the layoffs that follow from it, I am shifting into academic research instead. Somewhat ironically, into AI research, but still research nonetheless which cannot be or at least is much harder to "vibe through" (although even research is seeing the vibes seeping through which is concerning). If you know me personally and/or have used/seen Picocrypt's code, you'll notice that (although code structure is ugly, one single file), I've been very meticulous in designing and writing it and take great care in writing code, handling edge cases, adding new code, reviewing changes, locking things down, and so on. Every single line of code in any part of Picocrypt was proudly handwritten by me, which is something that will vanish in the near future, if not already. Going fast and breaking things disgusts me, but the industry thinks otherwise and who am I to speak in a sea of AI slop-embracing "software engineers" with a seemingly 10x productivity at face value. I'm honestly surprised Windows 11 even boots up at all given the amount of AI-written crap that's been making its way into the system. I'm probably one of the most loyal Windows users to ever stand on this planet but I can't help but stare jealousy at the comparatively rock-solid Linux sometimes.

I want to do something actually meaningful and innovative with my time and life, not command Claude like I'm speaking to a child who forgets something every ten minutes and makes an oopsies every twenty before breaking down every hour. So with this change in career direction, my focus and need for software engineering decreases and I don't have as much incentive or reason to continue working on Picocrypt. I'll even say that I've lost much of the drive and motivation that once inspired me and drove this project forward. It's still a great piece of software that I use regularly and I'm sure will continued to get use for many years to come, but I can no longer offer my support on the project and will freeze everything into a read-only state.

What it means for you (the user)

As long as you can run the code, archiving this project means nothing, really. Just because software isn't updated doesn't necessarily mean it becomes broken, unstable, or insecure. Sure, for a lot of software, this is indeed the case, but for software like Picocrypt that is carefully designed to use strong cryptographic algorithms and do so completely offline, there's not a lot of place for things to go wrong like you might have for Internet-connected software where protocol updates and new features regularly introduce new attack vectors. As long as the core design is secure and the implementation is correct (which most certainly appear to be true), Picocrypt doesn't get any less secure or less stable over time.

In fact, in some sense, Picocrypt hasn't been updated since 2022 which is when the actual encryption format was designed and implemented. The iterative releases since then have been bug fixes and small improvements, but the actual core encryption has remained unchanged. Do you feel less secure using Picocrypt after hearing that? If you do, then point proven: Picocrypt's core cryptography hasn't been updated in years but there are no issues discovered and it passed a security audit with basically no issues at all. There are a lot of things you might wish not to know in life, and just because an "Archived" label is slapped on Picocrypt doesn't mean it is inherently unusable, unstable, or insecure. It's the exact same software that it was 10 minutes ago before being archived. Unbelievable, right? It's the same core cryptography that's remained unchanged for years already. As long as you can run Picocrypt 1.49, it's almost certainly safe to use it unless the state-of-the-art top-of-the-line cryptography used in Picocrypt breaks at which point everything in technology will pretty much break catastrophically and the NSA/FBI/CIA would be sweating bullets (this is extremely unlikely, if it wasn't clear from the wording).

So don't worry about Picocrypt's core design. If you can get Picocrypt running, you can feel safe using it as it is the safest it can be within the constraints of the knowledge of the world we currently have and blah blah blah... But in terms of actually running the software that won't be updated/rebuilt anymore, there are a few things to note:

Windows users

If you're a Windows user, you have absolutely nothing to worry about. Because of Microsoft's excellent track record and business incentive to maintain software compatibility on the Windows platform, Picocrypt will continue running on the OS for a very long time. Considering that software written for Windows XP can still run on Windows 11, and that the Windows platform has "slowed down" in terms of major software/ABI and system changes significantly over the past decade, an executable built for Windows 11 will run basically forever as long as Microsoft Windows is a thing. In particular, the Installer.exe is designed to last indefinitely. It'll work on both traditional x64 systems as well as newer ARM64 processors (through native emulation), and the bundled OpenGL to DirectX 12 translation ensures you only need DirectX 12 support to run Picocrypt which is already a requirement to run Windows 11 at all. Basically, if you use Windows 11 (or above in the future), you have nothing to worry about -- Picocrypt will work on the OS indefinitely.

Linux users

Linux users also do not need to worry. Picocrypt on Linux only requires a few core libraries (basically always preinstalled), GTK 3, and OpenGL. While GTK3 isn't the newest major release, the packages for it will likely still remain in the Debian repositories for a long time (GTK2 is still present). The raw binary and .deb should continue working for a while as is, but if ABI breaks, rebuilding from source (it's really easy) should let you continue running Picocrypt without issue for the foreseeable future. OpenGL might not be supported natively in some very future Linux distro/release, but Mesa's llvmpipe and zink are not going anywhere and it'll keep working as well. Worst case scenario, just use Wine, it's surprisingly capable.

macOS users

Here we run into some problems. Picocrypt requires OpenGL to run and it's been deprecated from macOS for years now and knowing Apple, will absolutely be removed in the near future. Without OpenGL, there will be no easy way to run Picocrypt since you can't just place a .dll beside Picocrypt like you can on Windows. It's not easy to fix in the code either because it'll require major changes to the GUI library which can get messy, especially since GUIs were never a strength of Go. If you're a macOS user, I would advise you to stop using Picocrypt's GUI or at least don't use any advanced features or keyfiles so that the CLI can still decrypt them if the GUI stops working.

Worst case scenario

If all goes wrong and Picocrypt stops working on your OS, you can always use QEMU to run an x64 Ubuntu 24.04 image or something like that to run Picocrypt again. Yes, it's not ideal, but it works and reliably so. So don't worry about being unable to decrypt your volumes -- there will always be a way.

CLI and Web

These will work indefinitely and you can safely use these without concern. The CLI uses only standard Go (no cgo) and doesn't interact with any GUI-related system things so it'll work as long as Go runs on your OS (it almost certainly does and will). The Web version uses WebAssembly which is a standardized and backwards compatible format that will continue to work on browsers indefinitely.

Continuation of the project

I don't plan to work on Picocrypt anymore. I'll archive it and it'll be a complete project. However, it is likely that the community will want to pick it back up again. For anyone who does, I have a few requests. I technically cannot enforce these as they are not part of the GPLv3, but I hope there are still some people who respect the wishes of open source developers.

Do NOT call it "Picocrypt" only. Please call it "Picocrypt NG (new generation)", "Picocrypt Next", "Picocrypt Evergreen", or something unrelated to "Pico" entirely. Picocrypt is a name that's been built up over time and linked to a high-quality software project that I am also linked to. I wish to let Picocrypt's legacy remain as it is and not be overwritten by another project. If you see another project calling themselves "Picocrypt" only, please do something about it. I worked hard to create this piece of software and I would like to keep it in the pristine condition I've left it.
Give credit back to this project. I've spent probably well over 1,000 hours into Picocrypt over the years, whether you can see it directly or not. It often clouds my thoughts and free time. It's been a significant investment (or not really) of my time and at minimum wage, is worth at least $16,000 CAD (~$11,600 USD as of time of writing). Have some decency to respect what I have put in to make this software completely free and open for anyone to use without paying a single cent. People don't understand the time and energy and sanity it takes to keep a high-quality, security-critical open-source project afloat until they actually do so themselves, most of which will never do and yet some of which will complain and disregard. Don't take for granted the kindness of others. Is that much to ask?

Security is paramount

I cannot and will not appoint certain people to continue the project because to trust anyone is to blindly trust everyone and that is no way to go with security software. A chain is only as strong as its weakest link; I cannot trust anyone at all if I am to keep Picocrypt safe for people who use it. So I will not give any guidance in terms of that.

Final parting words

First, please do not take any offense or malintent from this long, admittedly tense and potentially insulting-to-some message. I hold no grudges against any one person or company or thing, and I am just being plain about my perspective on the state of technology without any sugar coating because sometimes, simple honest unfiltered words get the point across the best. I'm disappointed with the direction that the software industry is heading and I'm not going to hide it. Of course, I still wish the best for any software engineers whether they embrace AI or not. It's a tough world out here. Also, I'm not picking on Claude in particular, it was just the first name that popped up -- if anything, Claude is probably one of the better ones.

Second, I know I've taken a break from Picocrypt multiple times in the past, but this time, it's likely final and for real. Previously, my career goals were still in the software industry, I was just taking time off to focus on academics. This time, I'm shifting my career direction away from software engineering exclusively to a different direction, so it's fundamentally different from past occurrences. Expect to not hear from me on Picocrypt ever again.

Finally, I just want to thank all of you -- every single one of you -- for reading this message. The fact that you took the time and cared to read the words I've written means a lot to me. It's been a truly wonderful journey these past 4 years developing Picocrypt and the things I learned, people I helped, positive comments and feedback you gave, and code patches you PR'd mean a lot to me. I have never felt so much power and impact in my hands, and I'm glad I could use it to make software that people enjoy using and trust (and can continue to do so, even if archived!). I hope that if there's one thing you take away from this long message (more of a rant, I'll be honest), it's that nothing in life is for certain. Change will always happen and change is always happening. We are perhaps riding the biggest change that humanity will ever face. Life is full of fun moments and pleasant surprises, but also of bumps and bruises. Go touch some grass, spread love and kindness, and donate your time, money, and thanks to the countless other open source developers who devote their invaluable time, energy, and sanity to a greater, honourably selfless cause.

Very sincerely,

Evan

I'm archiving Picocrypt #134

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions