3 ms·

I'm suggesting it's not worth talking about seriously for a toy like in the submission.

• throwanem 10y ago
  There's a paid subscription option, and its developer's comments elsewhere in this thread very strongly suggest people are using it in a serious fashion. If you're thinking of it as a toy, your threat model is bogus.
  • dimino 10y ago
    It's a toy, regardless of what the developer says.
    • throwanem 10y ago
      But not regardless of how people use it.
      • dimino 10y ago
        Yes, actually, regardless of how people use it. You can't stop people from using the wrong tools.
        • throwanem 10y ago
          You can, and I think ethically must, take responsibility for the fashion in which people use the tool you make. If you intend it to be only a toy, then you can, and I think ethically must, make that clear. If people persist despite all warnings in using it in ways that might cause them harm, then you can, and I think ethically must, cease to make it available. To do otherwise is dangerously cavalier at best, and incompatible with the minimal degree of responsibility which I would require of an employee or a colleague. Perhaps you feel otherwise. That's your prerogative. But, if so, I do hope, for the sake of any users you might have, that you aren't in a position to make similar decisions yourself.
          • dimino 10y ago
            I didn't write it, you're going to have to take that up with the author, on what his intended use case was for his website. Sounds like he did what you said, anyway.
            • throwanem 10y ago
              I'm not talking about 'StavrosK's service here. I'm talking about your evaluation of threat models, which seems to include a great big exception around "well, if people aren't using it the way I want them to, then to hell with them."
              • dimino 10y ago
                Well yeah, actually that's how threat models are built -- you can't protect users from themselves, if a user wants to store all their passwords in a greeting card website, in the little "special message to your loved one" field, there's realistically no way you can stop them. Your greeting card website's threat model doesn't include this.
                • throwanem 10y ago
                  Reductio ad absurdum helps no one, you know.
                  • dimino 10y ago
                    It helps illustrate how what you said isn't clear or true.
                    • throwanem 10y ago
                      Does it? It seems like you'd need to argue that this notional greeting card website made some specific claim of security around the content of that field.
• tptacek 10y ago
  You might try re-reading my comment, all the way through.
  • dimino 10y ago
    I don't find this to be a comment in the spirit of HN, yet again, from you.