3 ms·

I see this from a lot of people and I'm puzzled, can you not just avoid using the features you don't like? I don't see anyone going "I used to use VS Code but t

I see this from a lot of people and I'm puzzled, can you not just avoid using the features you don't like? I don't see anyone going "I used to use VS Code but they added a database viewer so I stopped".

stingraycharles 7y ago
This is kind of different. It’s more like, “I used this database viewer and suddenly it became VS Code”. It used to be something lean and simple, but now you’re simply not the target audience anymore at all.
JNRowe 7y ago
I'm one of those people, and the thing that worries me is the huge amount of code that I'm not interested in that is hovering around my keys. If it was a collection of smaller tools I doubt I'd feel the same, but as things stand grabbing a binary means a 500mb installed package with very little functionality I actually want. Not that I'm saying they should support just me, everyone has their own set of a magical does-just-enough feature set.
jks 7y ago
I stopped using Keybase when they started sending me cryptocurrency spam.
corobo 7y ago
No. When they started doing cryptocurrency spam every device I had Keybase on alerted me to each new message, even with the spamming bot blocked
eeZah7Ux 7y ago
> can you not just avoid using the features you don't like No: people cat take a moral stance against things that look sleazy like asking for uploading private keys or trying to sell cryptocurrencies. > can you not just avoid "can you just" is a bit patronizing, would you mind not using that tone?
vorpalhex 7y ago
The keybase client went from a small CLI to a persistently connected app that ties into a filesystem, cryptocurrency platform, chat ecosystem and more. Nothing is free. Adding features takes up resources, adds complexity and errors and increases attack surface. Sometimes that's an OK tradeoff - I like being able to see images in my email client. Sometimes the tradeoff is not worth it - my text centric IDE has no business touching database files.
- StavrosK 7y ago
  That's fair, my question was more about the cryptocurrency feature specifically. "General bloat" I can understand, if you only care about the keys. It seems to me, though, that the key part is just the first step in an entire featureset: Once you have a reliable way to get trusted encryption keys for any person, you can build a whole lot of useful functionality on top of that, which is what they've been doing. Personally, I wouldn't have much use for just the key exchange, and I really like the encrypted chat/repos/files/etc on top, but I can understand different preferences there.
  - detaro 7y ago
    The entire cryptocurrency airdrop thing has caused lots of noise, triggered campaigns to try and hack/social engineer accounts that would qualify the attacker to grab more cryptocurrency, ... It makes it vastly less likely I'll recommend Keybase with those associations, which diminishes the value of the "key part". (Not recommending it both because it makes me question the long-term priorities of the product and because I don't want to explain why I'm recommending "weird cryptocurrency-stuff", which is the impressions others could have)
    - ocdtrekkie 7y ago
      Isn't Keybase built exactly for this though? To be able to look at the connected accounts/proofs, and know that a given Keybase user has proven control of those accounts? An attacker looking for crypto may have hacked someone's HN or GitHub. However, with Keybase, you can establish someone you want to talk to has linked their Twitter and their web domain and the like, whereas an attacker probably does not have access to all of their various identities around the Internet.
oefrha 7y ago
If they didn’t insist on putting a kext on my system (comes with the app for kbfs), or registering a persistent launchd agent that can’t be disabled (comes with the kbfs-free CLI, always reinstalls itself), then sure, I could ignore the features. But they did, so their clients got kicked out of my system. I also got spammy alerts mentioned by siblings (in email).
jwr 7y ago
Keybase went from a command-line tool with a clear purpose to a behemoth requiring an installer, a resident daemon, and a permanent menu-bar icon. I can't even trust a tool that is so complex (and likely has a huge attack surface). These days, I don't even know what keybase is for. What is it for, really?

stingraycharles 7y ago

This is kind of different. It’s more like, “I used this database viewer and suddenly it became VS Code”. It used to be something lean and simple, but now you’re simply not the target audience anymore at all.

JNRowe 7y ago

I'm one of those people, and the thing that worries me is the huge amount of code that I'm not interested in that is hovering around my keys. If it was a collection of smaller tools I doubt I'd feel the same, but as things stand grabbing a binary means a 500mb installed package with very little functionality I actually want. Not that I'm saying they should support just me, everyone has their own set of a magical does-just-enough feature set.

jks 7y ago

I stopped using Keybase when they started sending me cryptocurrency spam.

corobo 7y ago

No. When they started doing cryptocurrency spam every device I had Keybase on alerted me to each new message, even with the spamming bot blocked

eeZah7Ux 7y ago

> can you not just avoid using the features you don't like No: people cat take a moral stance against things that look sleazy like asking for uploading private keys or trying to sell cryptocurrencies. > can you not just avoid "can you just" is a bit patronizing, would you mind not using that tone?

vorpalhex 7y ago

The keybase client went from a small CLI to a persistently connected app that ties into a filesystem, cryptocurrency platform, chat ecosystem and more. Nothing is free. Adding features takes up resources, adds complexity and errors and increases attack surface. Sometimes that's an OK tradeoff - I like being able to see images in my email client. Sometimes the tradeoff is not worth it - my text centric IDE has no business touching database files.

StavrosK 7y ago
That's fair, my question was more about the cryptocurrency feature specifically. "General bloat" I can understand, if you only care about the keys. It seems to me, though, that the key part is just the first step in an entire featureset: Once you have a reliable way to get trusted encryption keys for any person, you can build a whole lot of useful functionality on top of that, which is what they've been doing. Personally, I wouldn't have much use for just the key exchange, and I really like the encrypted chat/repos/files/etc on top, but I can understand different preferences there.
- detaro 7y ago
  The entire cryptocurrency airdrop thing has caused lots of noise, triggered campaigns to try and hack/social engineer accounts that would qualify the attacker to grab more cryptocurrency, ... It makes it vastly less likely I'll recommend Keybase with those associations, which diminishes the value of the "key part". (Not recommending it both because it makes me question the long-term priorities of the product and because I don't want to explain why I'm recommending "weird cryptocurrency-stuff", which is the impressions others could have)
  - ocdtrekkie 7y ago
    Isn't Keybase built exactly for this though? To be able to look at the connected accounts/proofs, and know that a given Keybase user has proven control of those accounts? An attacker looking for crypto may have hacked someone's HN or GitHub. However, with Keybase, you can establish someone you want to talk to has linked their Twitter and their web domain and the like, whereas an attacker probably does not have access to all of their various identities around the Internet.

oefrha 7y ago

If they didn’t insist on putting a kext on my system (comes with the app for kbfs), or registering a persistent launchd agent that can’t be disabled (comes with the kbfs-free CLI, always reinstalls itself), then sure, I could ignore the features. But they did, so their clients got kicked out of my system. I also got spammy alerts mentioned by siblings (in email).

jwr 7y ago

Keybase went from a command-line tool with a clear purpose to a behemoth requiring an installer, a resident daemon, and a permanent menu-bar icon. I can't even trust a tool that is so complex (and likely has a huge attack surface). These days, I don't even know what keybase is for. What is it for, really?