I agree .... for that matter it's uncommon to find larger organizations paying much if any attention to it. So I guess what I'm asking for is examples of web s

I agree .... for that matter it's uncommon to find larger organizations paying much if any attention to it. So I guess what I'm asking for is examples of web startups that you think are creating highly-secure distributed software at Diaspora's level of complexity. Think about it: how much would it cost Diaspora to bring in Matasano or one of your competitors to get some significant help with threat modeling, and catalyze the community to get involved and take it from there? For that matter there may probably at least some security consulting firms who get started for free, both because they believe in what Diaspora's trying to do and because of the visibility they'll potentially get if the project is successful. It's a huge opportunity, and Diaspora's got some advantages: visibility, enthusiasm, name. So while I think that Diaspora has done the right thing so far by focusing on functionality, now's the time they should be thinking about investing in the long term.