But from this response and how their website changed really makes me inclined to believe something is fundamentally broken in truecrypt.
I put it this way --- bluntly, aggressively --- because there's a drive-by element to your comment; "critical flaw", "fundamentally broken", but absolutely no details whatsoever.
And I'd say he has a point. Laying aside your expertise for a moment, and without going all the way to declaring it fundamentally broken, don't you think there's something a little fishy in all this?
For whatever reason, he[1]'s done with the project. Maybe the wife and kids are more interesting these days. Maybe he got offended at auditors being paid and not him. Maybe he feels a responsibility towards his users and since he cannot actively defend them he wants them to move inside someone else's castle. Maybe he died and his brother took over the account long enough to say "we're done" and his brother really doesn't want to talk about it no matter how weird you think it is that his brother doesn't want a bunch of people on the Internet on his lawn like they were on Satoshi's.
It's like a bunch of blind cryptographers trying to describe an elephant.
[1] Assuming a heterosexual singular male just for convention.
I know that's shocking to OSS developers, but not everyone cares (at all) about Linux.
I may refer to this thread the next time someone asks "why don't companies give explanations to candidates they don't hire?" The answer is that the candidates feel compelled to prove that the company's reasons are flawed. Look how they react to someone deciding to stop working on a project.
We likely won't know what happened for several years after, if we ever learn at all.
How about we stop bothering the poor developer(s) and let them be. They have already contributed more to the world than most of us here - time for them to get the well deserved rest they seek.
What I don't like is to have some piece of infrastructure I've come to depend on yanked out suddenly, being mislead about the reasons, and being left with only onerous alternatives (rewrite the whole thing or stick with 7.1a indefinitely). That these two options are onerous is not speculation or simply some kind of bad attitude. It is a fact.
Whether this action was deliberate or just incredibly clueless and negligent, treating TrueCrypt users this way is crappy, and I think it's OK to say so publicly. I'm grateful for the development of TrueCrypt. But that gratitude doesn't translate to a free pass for all subsequent terrible behavior afterward.
If the dev's identity was known, he/she might take a lot more heat than a few harsh words. Considering the needless trouble he's putting people through, a strongly-worded letter of protest is a pretty mild reaction.
He tweeted: Most commercial encryption products are junk.