4 ms·

This is a super gnarly one to me because it is a PASSWORD MANAGER. Literally they could just supply a password manager that also sends all the passwords to a th

This is a super gnarly one to me because it is a PASSWORD MANAGER. Literally they could just supply a password manager that also sends all the passwords to a third party. I get it open source, hard to keep the lights on, etc etc but I feel like if you take the steps of getting into a such a security heavy space, then you have to be able to keep up your end of the bargain. In this case it might not mean registering every variation of keepass (keepass.com probably useful though) but it certainly means working aggressively with search engines to get things flagged, send push notifications to your users warning them of it, etc etc

acqq 7y ago
> but I feel like if you take the steps of getting into a such a security heavy space, then you have to be able to keep up your end of the bargain. Why, if you don't earn enough money?
- llamataboot 7y ago
  Because people have put their trust into you and you owe them something for that. better to shut down a project and walk-away for example, then leave it up, never update it, have a vulnerability get exposed, and have everyone using your product get owned
  - acqq 7y ago
    > you owe them something Definitely not. The companies even sell products, for which everybody directly pays, and then owe even to the millions of users nothing once they have sold the product (actually sold the "license"). I've even had to buy the exactly same product (the license) more than once, every time I've changed the platform or even just changed the computer. So if I publish anything as open source, free for anybody to use, I own even less to anybody with whom I don't have a paid contract for support.
  - imtringued 7y ago
    Your answer to the problem of malicious actors squatting domains is to shutdown the legitimate one? Did I read that right? keepass.com won't stop serving malware even if the keepass project has been abandoned. Your solution just makes the problem worse.
smileysteve 7y ago
> Literally they could just supply a password manager that also sends all the passwords to a third party. Could have taken the source, added the backup to 3rd party server, and released binaries.

acqq 7y ago

> but I feel like if you take the steps of getting into a such a security heavy space, then you have to be able to keep up your end of the bargain. Why, if you don't earn enough money?

llamataboot 7y ago
Because people have put their trust into you and you owe them something for that. better to shut down a project and walk-away for example, then leave it up, never update it, have a vulnerability get exposed, and have everyone using your product get owned
- acqq 7y ago
  > you owe them something Definitely not. The companies even sell products, for which everybody directly pays, and then owe even to the millions of users nothing once they have sold the product (actually sold the "license"). I've even had to buy the exactly same product (the license) more than once, every time I've changed the platform or even just changed the computer. So if I publish anything as open source, free for anybody to use, I own even less to anybody with whom I don't have a paid contract for support.
- imtringued 7y ago
  Your answer to the problem of malicious actors squatting domains is to shutdown the legitimate one? Did I read that right? keepass.com won't stop serving malware even if the keepass project has been abandoned. Your solution just makes the problem worse.

smileysteve 7y ago

> Literally they could just supply a password manager that also sends all the passwords to a third party. Could have taken the source, added the backup to 3rd party server, and released binaries.