5 ms·
It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are. Use
by jbob2000 10y ago
It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are.
Use 1password and pay $5 a month if you want the right to complain.
- pfg 10y agoProjects should not be exempt from criticism just because they're free. That's a terrible attitude. The article does not attempt to dictate anything, I would not even call it a complaint. It merely points out unsafe practices and recommends a solution, in a very objective tone.
- mikeash 10y agoThat's a justifiable sentiment when people are complaining about missing features or mundane bugs, but security vulnerabilities are a whole different matter. That's causing harm, not just failing to provide value. You're still allowed to complain about a mugging you didn't pay for, after all.
- prohor 10y agoHow about those who donate? Aren't they kind of customers? And what would you say if Linux updates could be easily changed with MitM?
- detaro 10y agoEven if you believe there is no right to complain, you have the right to warn others about issues you see. Contacting the maintainer beforehand and suggesting a fix to them is common courtesy if you do that.
- rcthompson 10y agoGiving something away for free is not an excuse for it to provide negative value by exposing its users to MitM attacks.
- paulryanrogers 10y agoNegative value is a subjective judgement. Updates themselves are signed packages. While it's not ideal, careful users do gain value in an open, free, and mature solution. Full disclosure: I sell a plugin for KeePass 2.
- rcthompson 10y agoI'm not necessarily saying that Keepass2 provides a negative value overall. As you say, that's a subjective judgement. However, the unnecessary MitM exposure is certainly a negative value.
- Ensorceled 10y agoWhat "complaint" are you talking about? The blog is an objective explanation of a CVE along with explicit suggestions to the author and an discussion on how to protect yourself if you're a user.
- cyphar 10y ago> It's free software; It is not free software, it's proprietary. Please don't use the phrase "free software" in this context, as it confuses people. It has a very specific meaning in the context of software.
- mhurron 10y agoEven in the context of software, it still means no cost. In the context of software it can also mean FOSS, but just because we're talking about software doesn't mean we suddenly lose the 'no cost' meaning.
- EpicEng 10y ago'Free' has exactly two specific meanings on the context of software. Sorry to burst your bubble. The version you are referring to is irrelevant in the minds of the vast majority of people who use software.
- 0x4a42 10y agoOn the homepage it says: "KeePass is really free, and more than that: it is open source (OSI certified). You can have a look at its full source and check whether the encryption algorithms are implemented correctly.". Why do you say it's proprietary?
- cyphar 10y agoAh sorry, I was wrong. I thought that KeePass was proprietary and that KeePassX was a free software replacement. :P
- SignalsFromBob 10y agoKeePass is GPL2 licensed.
- EpicEng 10y ago>You aren't the customer, KeePass 2 advertisers are. Well certainly those advertisers will leave along with the user base. This sort of silly attitude is what keeps a lot of people from using free software to begin with.