> Proper risk management isn't "paranoia all the time," but an evaluation of the degree of harm posed by a particular hazard along with the likelihood of that h

> Proper risk management isn't "paranoia all the time," but an evaluation of the degree of harm posed by a particular hazard along with the likelihood of that hazard occurring. Risk analysis: using online DVCS/bugtracker/chat service you are one compromised password away from letting an attacker read the whole contents and potentially alter them. Many of those passwords will be stored in browser. Browsers are known for being softer targets compared to servers, generally speaking. Contrast this with an on-premise services: You still have login credentials but also require people to badge-in to access the building and login on the desktops or start a VPN (often requiring creds and 2fa).