11 ms·

For years people have been begging Keybase to allow them to pay them for the service and Chris Coyne always refused. Now they've lost their independence and th

For years people have been begging Keybase to allow them to pay them for the service and Chris Coyne always refused. Now they've lost their independence and they're owned by a communication company that has [edit: the majority of] its dev team in China. I use Keybase to talk to my friend in China since it's one of the few services they don't block. This is a pretty disappointing outcome.

bgee 6y ago
> communication company that has its entire dev team in China citation needed Also, what are you trying to imply by this assertion?
- fossuser 6y ago
  "Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”" https://www.theguardian.com/uk-news/2020/apr/24/uk-government-told-not-to-use-zoom-because-of-china-fears https://www.theguardian.com/uk-news/2020/apr/24/uk-governmen... The implication is that China is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power. They are aggressive in stealing IP from other companies and blocking software they can't control. They have history of wielding their power to pressure organizations to deny or ignore aspects of their history that they dislike (Taiwan, Cultural Revolution) and they pressure companies to hand over PII on people they find to be political threats without due process. This is not a country you want to be a steward of an encryption identity standard.
  - bgee 6y ago
    I don't think it's true that Zoom has its "entire dev team in China"; doing some research myself reveals Zoom definitely has engineering operations in the US[0][1]. I'm not disagreeing with you on the implications of having engineering teams in China, I think you would like to put that paragraph in your original post to give some context. [0] Tech job postings in US: https://zoom.wd5.myworkdayjobs.com/Zoom/0/refreshFacet/318c8bb6f553100021d223d9780d30be https://zoom.wd5.myworkdayjobs.com/Zoom/0/refreshFacet/318c8... [1] H1b filing on engineering positions: https://h1bdata.info/index.php?em=Zoom+Video+Communications+Inc&job=&city=&year=2019 https://h1bdata.info/index.php?em=Zoom+Video+Communications+... edit: better formatting and grammar
    - fossuser 6y ago
      Thanks - I edited it to soften the language a bit.
      - wutwutwutwut 6y ago
        Is it called "soften the language" to fix a 100% factual error? Honestly I feel that if you're arguing in one direction or another and haven't checked the facts, maybe it's better not to argue about it?
        fossuser 6y ago
        The vast majority of the Zoom software development team is based out of companies in China. They do have support people in the US and a handful of non-support engineering which is why I said thanks and immediately updated the comment to say "majority" instead of "entire" since it's more correct. That technicality is less relevant to the main point of the argument.
        damanamathos 6y ago
        They do have a large R&D presence in China. As of January 2020, they had 2,532 full-time employees. Of those, 1,396 were in the US and 1,136 were in international locations. Within the 1,136 is "more than 700" employees in R&D in China.[1] A LinkedIn search for "engineer" working for "Zoom Video Communications" in location "United States" shows up 558 results.[2] Their entire management team is in the US, and of their 17 data centres, only 1 is in China.[3][4] [1] https://www.sec.gov/ix?doc=/Archives/edgar/data/1585521/000158552120000095/zm-20200131.htm https://www.sec.gov/ix?doc=/Archives/edgar/data/1585521/0001... [2] https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B%222532259%22%5D&facetGeoRegion=%5B%22us%3A0%22%5D&keywords=engineer&origin=FACETED_SEARCH https://www.linkedin.com/search/results/people/?facetCurrent... [3] https://zoom.us/team https://zoom.us/team [4] https://blog.zoom.us/wordpress/2020/05/04/navigating-a-new-chapter-for-zoom/ https://blog.zoom.us/wordpress/2020/05/04/navigating-a-new-c...
        wutwutwutwut 6y ago
  - uoaei 6y ago
    > this arrangement may make Zoom responsive to pressure from Chinese authorities "May" is a weasel word that doesn't offend the sensibilities of CCP. In reality, every single company which is incorporated in China must be majority-owned by the Chinese government. This is what makes their economic system "state capitalism" and not "communism". But that also means they have a controlling share and get last word on any executive and administrative decision within the company.
    - SujiYan 6y ago
      That’s not true since 199x
  - Gasp0de 6y ago
    Isn't the US actually at least as bad if not worse? Thanks to Edward Snowden we know without speculation that the US "is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power" (ok, supposedly there is secret judges that secretly check on this power, but that doesn't really do any good does it?). The USA also "pressure companies to hand over PII on people they find to be political threats without due process" (so called "National Security Letters").
    - Baeocystin 6y ago
      Short answer? No. Not even close. Source: have lived in both countries
      - avanti 6y ago
        Have lived in both, I can say they are equal. Just different culture norms you have to learn to navigate around.
    - remarkEon 6y ago
      The difference is that in the US we actually get to find out about these abuses.
    - patmorgan23 6y ago
      People don't get disappeared for actively disagreeing with the government.
      - guug 6y ago
        Usually, but they do get into unfortunate accidents from time to time.
      - mirimir 6y ago
        That's true for US citizens. But not so much otherwise. Edit: Someone disagrees? Consider Guantanamo Bay, third-party renditions, and drone strikes. If China did drone strikes, there'd be a huge outcry.
- aaomidi 6y ago
  China is a country with even less oversight than the US. For a company that does security that's concerning.
  - andoriyu 6y ago
    Not even that. All encrypted traffic in china needs to be decryptable by CCP. Which means if your call in zoom was routed to one of their China servers, then CCP has access to it. That is on top of the fact that Zoom encryption is weak af.
- kyrra 6y ago
  Another citation: https://investors.zoom.us/static-files/09a01665-5f33-4007-8e90-de02219886aa https://investors.zoom.us/static-files/09a01665-5f33-4007-8e... (warning, PDF) > We also operate research and development centers in China, employing more than 700 employees as of January 31, 2020. You can find more stories from last year talking about that was how Zoom had such a large engineering staff, is that it was cheaper for them to pay for R&D in china than in the US[0]. [0] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china.html https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
  - bgee 6y ago
    The emphasis is on entirety, please see my other reply.
- umeshunni 6y ago
  > Also, what are you trying to imply by this assertion? It's just casual nativism/racism - acceptable on HN as long as it's about China.
  - ethbro 6y ago
    It's not nativism or racism to have security concerns about a country with a non-existent commitment to an independent judiciary. If China wants people to think of it as a country where laws matter, then they can start acting like laws matter. https://worldjusticeproject.org/sites/default/files/documents/WJP-ROLI-2020-Online_0.pdf https://worldjusticeproject.org/sites/default/files/document... (And before we get whataboutism concerning {insert other country's wiretapping laws}, wiretapping through an independent judiciary is fundamentally different than via rubber stamp)
  - cmelbye 6y ago
    "China" isn't a race, it's a multi-ethnic state with laws that heavily restrict communication. It's relevant to bring up in a thread about building encrypted communication technology.
- mrtweetyhack 6y ago
  China is not to be trusted, Zoom and now Keybase is not to be trusted
poofyleek 6y ago
Very disappointed indeed. Keybase is one of the ones I actually used.
- pmorici 6y ago
  There was a competitor app that got posted here a couple weeks ago. https://keys.pub/ https://keys.pub/
  - chupasaurus 6y ago
    Which already did some things wrong even though Keybase is around for a few years.
    - MrGilbert 6y ago
      Care to elaborate? Just curious...
      - chupasaurus 6y ago
        https://news.ycombinator.com/item?id=22997245 https://news.ycombinator.com/item?id=22997245 and requiring gnome-keyring on Linux are issues for me.
        Spivak 6y ago
        Does it actually require GNOME Keyring or does it just use libsecret? Because libsecret is dope and has been nothing but a joy to work with.
        chupasaurus 6y ago
        https://keys.pub/docs/specs/keyring.html https://keys.pub/docs/specs/keyring.html
        trey-jones 6y ago
        I've seen some examples of GNOME keyring being required because it implements the freedesktop secrets standard (which I admit to knowing nothing of) where other secret managers do not. Presumably meaning there us no common interface, so we just pick the one that implements the spec. One example: https://github.com/pithos/pithos/issues/559 https://github.com/pithos/pithos/issues/559
deleted 6y ago
[deleted]
mikorym 6y ago
It is funny that Zoom was one of the companies that I flagged in my head as the worst (or rather, most dangerous) up-and-coming tech company and I considered Keybase one of the most promising up-and-coming tech companies. Keybase solves a (to me) nontrivial problem: How to bring private keys into social media. Just a silly example: You don't use the same private-public key exchange in Whatsapp as you would use for your emails, or to sign your packages. It's a bit of the now infamous Dropbox situation: Most people can sign things with private keys and properly keep track of it, but they don't get around to doing it. It's only critical cases where the use is common (like signing packages). It took a long time even for HTTPS to become standard practise, though I guess the situation with your browser is a bit different.
- freshhawk 6y ago
  Yes, this was exactly how I mentally categorized these two companies as well. My first reaction was: it can't be that keybase can it? Huh, well maybe I'd sell my principles for that much money too, oh well. Maybe some keybase employee will end up being a whistleblower sometime soon though.
  - mirimir 6y ago
    Well, they are pitching this as bringing secure stuff to the masses. So it's arguably not all that inconsistent with what Chris etc have been saying about Keybase.
    - freshhawk 6y ago
      Honestly if at this point Zoom hasn't lost all credibility in your eyes I don't know what to say. Zoom already has end to end encryption according to some of their other press releases and public statements (we know they don't), so why on earth would you believe this one?
      - mirimir 6y ago
        I guess that it's because I liked Chris and his team, and so I'm trying to be generous.
foobiekr 6y ago
I am curious: do they block Zoom?
- Jon_Lowtek 6y ago
  Well yes but no. The block zoom.us but there is zoom.cn This is likely related to both nations having rules that allow only their own agencies to wiretap.
tabbott 6y ago
Losing their independence was from the beginning the most likely outcome of building something that's hard to monetize like Keybase on the VC funding model. FWIW, I doubt Keybase offering a paid plan would have raised revenue that's significant compared to their burn, so Chris was probably right to not spend resources figuring out a paid offering. For raising their next round, having $5K in revenue from a paid plan few people buy might well have been worse than having $0. The VC funding model is terrible for most open source projects. With a few exceptions, you end up with an acquisition that ends or repurposes the project, or an Open Core project. And a VC-funded Open Core project will end up trying as hard as it can to have everyone need to buy the paid version, since that's clearly the way to optimize revenue and eventually the slippery slope will get you there. I don't blame folks for taking VC; it was easy to get, and there aren't a lot of alternative funding models that can pay the multiple fulltime staff that might be required to create what one wants to create. I don't think VC funding as it currently exists is consistent with running an open source company according to my values, which is why we're not taking venture funding for Zulip. Obviously, being scrappy, applying for NSF grants, and spending my own money have very real downsides both personally and for our growth, especially when every competitor has VC funding, but it also means that I can ensure Zulip continues existing as a real open source project for the long run.
- fossuser 6y ago
  How much power do the VCs typically have? Don't founders often have the ability to overrule and make their own decisions? Chris is already financially independent from the OKCupid sale, he could have open sourced the server code and/or reduced the overall burn to pivot to paid accounts. Though the weird Stellar wallet addition implied some vision/product issues anyway. Of course it's easy and probably unfair for me to say these things as an outsider with limited information and no real stake, it's definitely possible I'm wrong about important details that would change my mind. It'd be interesting to hear from Chris, but the sale probably restricts public communication? This reminds me a little about the OKC sale actually, they had a blog post about why charging for dating sites made them worse that they took down after selling to match (they used to do cool analysis and publish them as blog posts, most of the details ended up in the book a different cofounder published called Dataclysm). That's more understandable to me though since I think it was their first exit. Reading about Zulip - didn't you get bought by Dropbox before being open source? Is your current situation a lucky outcome - or was it a condition of the sale? [Edit] - To clarify since there are downvotes, my questions aren’t rhetorical - they’re genuinely asking.
ahnick 6y ago
Fingers crossed they open source the server portion at least -> https://github.com/keybase/client/issues/24105 https://github.com/keybase/client/issues/24105
- wiggler00m 6y ago
  +1
alexisgermane 6y ago
Interesting. So the question is why doesn't China block it.
mirimir 6y ago
Sad. Very sad. It was such a great approach to associating GnuPG keys with social media. And their chat etc were also pretty cool. But Zoom is beyond the pale. So what now? Maybe someone could clone the GitHub repos. And/or are GnuPG keyservers safe enough again? For chat, Session looks most interesting. It's got the Signal messaging bits. Plus anonymity via the Loki onion network. And it's available for all platforms. However, it's very new, and often buggy. And the Loki Foundation is Australian. So at some point they'll likely get pressured to backdoor stuff. And they probably won't be able to disclose that, unless someone leaks. There's also Tox, where each user runs a Tor onion client. That's secure enough in Whonix. But the Whonix user base is miniscule, and I wouldn't trust an implementation in Windows. But then, maybe Session in Windows is too iffy as well. Anyway, I'll be deleting my Keybase account, as soon as I've negotiated alternate comms with my contacts.
- namibj 6y ago
  So, yeah. Zoom did bad stuff. But Keybase is designed so that all those things would obviously be detectable (Keybase client code is open source), and the ways in which the Server could mess with data are much restricted. If that spreads to Zoom, there's a chance it'd be a good service in a year or two. PGP keyservers have a fundamental issue that demands a solution like CT logs or Keybase-style merkle trees. The only way to prevent getting Loki backdoor issues would seem to be a development so clearly in-the-open, that any secretive addition of significant code/suspicious PR behavior is obvious. Tor does not use Tor by default. It works with Tor, but that's it.
  - rndgermandude 6y ago
    They are also kinda buying a social graph of mostly IT and security professionals, sprinkled with some journalists (and not the kind that usually does the "10 things" articles) and general tinfoil hats. My tinfoil hat tells me this information could be somewhat valuable to their Chinese overlords...
    - mirimir 6y ago
      Yes, it's Zoom's Chinese connections that rule them out, for me.
_pmf_ 6y ago
> and Chris Coyne always refused Well, now he has a thousandfold outcome compared to breadcrumbs that devs would throw at him. I.e. the system worked.
bythckr 6y ago
> I use Keybase to talk to my friend in China since it's one of the few services they don't block. I think the vital question is why was keybase not blocked? Maybe it was owned by someone high-up in China. That is why maybe Chris Coyne refused funding. It was free to just to onboard maximum number of users. Seems like "users" where the products that bought value to keybase.
- dreamszl 6y ago
  You really have imagination.
- fossuser 6y ago
  Things are usually not blocked when they’re not that popular or well known. In the Keybase case I think it was just obscure enough to avoid the censors.
ydb 6y ago
I am glad you mentioned China. Many people are too afraid to acknowledge the reality of that authoritarian country, for fear of reprisal from liberal do-gooders. This acquisition is a shame.

bgee 6y ago

> communication company that has its entire dev team in China citation needed Also, what are you trying to imply by this assertion?

fossuser 6y ago
"Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”" https://www.theguardian.com/uk-news/2020/apr/24/uk-government-told-not-to-use-zoom-because-of-china-fears https://www.theguardian.com/uk-news/2020/apr/24/uk-governmen... The implication is that China is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power. They are aggressive in stealing IP from other companies and blocking software they can't control. They have history of wielding their power to pressure organizations to deny or ignore aspects of their history that they dislike (Taiwan, Cultural Revolution) and they pressure companies to hand over PII on people they find to be political threats without due process. This is not a country you want to be a steward of an encryption identity standard.
- bgee 6y ago
  I don't think it's true that Zoom has its "entire dev team in China"; doing some research myself reveals Zoom definitely has engineering operations in the US[0][1]. I'm not disagreeing with you on the implications of having engineering teams in China, I think you would like to put that paragraph in your original post to give some context. [0] Tech job postings in US: https://zoom.wd5.myworkdayjobs.com/Zoom/0/refreshFacet/318c8bb6f553100021d223d9780d30be https://zoom.wd5.myworkdayjobs.com/Zoom/0/refreshFacet/318c8... [1] H1b filing on engineering positions: https://h1bdata.info/index.php?em=Zoom+Video+Communications+Inc&job=&city=&year=2019 https://h1bdata.info/index.php?em=Zoom+Video+Communications+... edit: better formatting and grammar
  - fossuser 6y ago
    Thanks - I edited it to soften the language a bit.
    - wutwutwutwut 6y ago
      Is it called "soften the language" to fix a 100% factual error? Honestly I feel that if you're arguing in one direction or another and haven't checked the facts, maybe it's better not to argue about it?
      - fossuser 6y ago
        The vast majority of the Zoom software development team is based out of companies in China. They do have support people in the US and a handful of non-support engineering which is why I said thanks and immediately updated the comment to say "majority" instead of "entire" since it's more correct. That technicality is less relevant to the main point of the argument.
        damanamathos 6y ago
        They do have a large R&D presence in China. As of January 2020, they had 2,532 full-time employees. Of those, 1,396 were in the US and 1,136 were in international locations. Within the 1,136 is "more than 700" employees in R&D in China.[1] A LinkedIn search for "engineer" working for "Zoom Video Communications" in location "United States" shows up 558 results.[2] Their entire management team is in the US, and of their 17 data centres, only 1 is in China.[3][4] [1] https://www.sec.gov/ix?doc=/Archives/edgar/data/1585521/000158552120000095/zm-20200131.htm https://www.sec.gov/ix?doc=/Archives/edgar/data/1585521/0001... [2] https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B%222532259%22%5D&facetGeoRegion=%5B%22us%3A0%22%5D&keywords=engineer&origin=FACETED_SEARCH https://www.linkedin.com/search/results/people/?facetCurrent... [3] https://zoom.us/team https://zoom.us/team [4] https://blog.zoom.us/wordpress/2020/05/04/navigating-a-new-chapter-for-zoom/ https://blog.zoom.us/wordpress/2020/05/04/navigating-a-new-c...
        wutwutwutwut 6y ago
- uoaei 6y ago
  > this arrangement may make Zoom responsive to pressure from Chinese authorities "May" is a weasel word that doesn't offend the sensibilities of CCP. In reality, every single company which is incorporated in China must be majority-owned by the Chinese government. This is what makes their economic system "state capitalism" and not "communism". But that also means they have a controlling share and get last word on any executive and administrative decision within the company.
  - SujiYan 6y ago
    That’s not true since 199x
- Gasp0de 6y ago
  Isn't the US actually at least as bad if not worse? Thanks to Edward Snowden we know without speculation that the US "is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power" (ok, supposedly there is secret judges that secretly check on this power, but that doesn't really do any good does it?). The USA also "pressure companies to hand over PII on people they find to be political threats without due process" (so called "National Security Letters").
  - Baeocystin 6y ago
    Short answer? No. Not even close. Source: have lived in both countries
    - avanti 6y ago
      Have lived in both, I can say they are equal. Just different culture norms you have to learn to navigate around.
  - remarkEon 6y ago
    The difference is that in the US we actually get to find out about these abuses.
  - patmorgan23 6y ago
    People don't get disappeared for actively disagreeing with the government.
    - guug 6y ago
      Usually, but they do get into unfortunate accidents from time to time.
    - mirimir 6y ago
      That's true for US citizens. But not so much otherwise. Edit: Someone disagrees? Consider Guantanamo Bay, third-party renditions, and drone strikes. If China did drone strikes, there'd be a huge outcry.
aaomidi 6y ago
China is a country with even less oversight than the US. For a company that does security that's concerning.
- andoriyu 6y ago
  Not even that. All encrypted traffic in china needs to be decryptable by CCP. Which means if your call in zoom was routed to one of their China servers, then CCP has access to it. That is on top of the fact that Zoom encryption is weak af.
kyrra 6y ago
Another citation: https://investors.zoom.us/static-files/09a01665-5f33-4007-8e90-de02219886aa https://investors.zoom.us/static-files/09a01665-5f33-4007-8e... (warning, PDF) > We also operate research and development centers in China, employing more than 700 employees as of January 31, 2020. You can find more stories from last year talking about that was how Zoom had such a large engineering staff, is that it was cheaper for them to pay for R&D in china than in the US[0]. [0] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china.html https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
- bgee 6y ago
  The emphasis is on entirety, please see my other reply.
umeshunni 6y ago
> Also, what are you trying to imply by this assertion? It's just casual nativism/racism - acceptable on HN as long as it's about China.
- ethbro 6y ago
  It's not nativism or racism to have security concerns about a country with a non-existent commitment to an independent judiciary. If China wants people to think of it as a country where laws matter, then they can start acting like laws matter. https://worldjusticeproject.org/sites/default/files/documents/WJP-ROLI-2020-Online_0.pdf https://worldjusticeproject.org/sites/default/files/document... (And before we get whataboutism concerning {insert other country's wiretapping laws}, wiretapping through an independent judiciary is fundamentally different than via rubber stamp)
- cmelbye 6y ago
  "China" isn't a race, it's a multi-ethnic state with laws that heavily restrict communication. It's relevant to bring up in a thread about building encrypted communication technology.
mrtweetyhack 6y ago
China is not to be trusted, Zoom and now Keybase is not to be trusted

poofyleek 6y ago

Very disappointed indeed. Keybase is one of the ones I actually used.

pmorici 6y ago
There was a competitor app that got posted here a couple weeks ago. https://keys.pub/ https://keys.pub/
- chupasaurus 6y ago
  Which already did some things wrong even though Keybase is around for a few years.
  - MrGilbert 6y ago
    Care to elaborate? Just curious...
    - chupasaurus 6y ago
      https://news.ycombinator.com/item?id=22997245 https://news.ycombinator.com/item?id=22997245 and requiring gnome-keyring on Linux are issues for me.
      - Spivak 6y ago
        Does it actually require GNOME Keyring or does it just use libsecret? Because libsecret is dope and has been nothing but a joy to work with.
        chupasaurus 6y ago
        https://keys.pub/docs/specs/keyring.html https://keys.pub/docs/specs/keyring.html
        trey-jones 6y ago
        I've seen some examples of GNOME keyring being required because it implements the freedesktop secrets standard (which I admit to knowing nothing of) where other secret managers do not. Presumably meaning there us no common interface, so we just pick the one that implements the spec. One example: https://github.com/pithos/pithos/issues/559 https://github.com/pithos/pithos/issues/559

deleted 6y ago

[deleted]

mikorym 6y ago

It is funny that Zoom was one of the companies that I flagged in my head as the worst (or rather, most dangerous) up-and-coming tech company and I considered Keybase one of the most promising up-and-coming tech companies. Keybase solves a (to me) nontrivial problem: How to bring private keys into social media. Just a silly example: You don't use the same private-public key exchange in Whatsapp as you would use for your emails, or to sign your packages. It's a bit of the now infamous Dropbox situation: Most people can sign things with private keys and properly keep track of it, but they don't get around to doing it. It's only critical cases where the use is common (like signing packages). It took a long time even for HTTPS to become standard practise, though I guess the situation with your browser is a bit different.

freshhawk 6y ago
Yes, this was exactly how I mentally categorized these two companies as well. My first reaction was: it can't be that keybase can it? Huh, well maybe I'd sell my principles for that much money too, oh well. Maybe some keybase employee will end up being a whistleblower sometime soon though.
- mirimir 6y ago
  Well, they are pitching this as bringing secure stuff to the masses. So it's arguably not all that inconsistent with what Chris etc have been saying about Keybase.
  - freshhawk 6y ago
    Honestly if at this point Zoom hasn't lost all credibility in your eyes I don't know what to say. Zoom already has end to end encryption according to some of their other press releases and public statements (we know they don't), so why on earth would you believe this one?
    - mirimir 6y ago
      I guess that it's because I liked Chris and his team, and so I'm trying to be generous.

foobiekr 6y ago

I am curious: do they block Zoom?

Jon_Lowtek 6y ago
Well yes but no. The block zoom.us but there is zoom.cn This is likely related to both nations having rules that allow only their own agencies to wiretap.

tabbott 6y ago

Losing their independence was from the beginning the most likely outcome of building something that's hard to monetize like Keybase on the VC funding model. FWIW, I doubt Keybase offering a paid plan would have raised revenue that's significant compared to their burn, so Chris was probably right to not spend resources figuring out a paid offering. For raising their next round, having $5K in revenue from a paid plan few people buy might well have been worse than having $0. The VC funding model is terrible for most open source projects. With a few exceptions, you end up with an acquisition that ends or repurposes the project, or an Open Core project. And a VC-funded Open Core project will end up trying as hard as it can to have everyone need to buy the paid version, since that's clearly the way to optimize revenue and eventually the slippery slope will get you there. I don't blame folks for taking VC; it was easy to get, and there aren't a lot of alternative funding models that can pay the multiple fulltime staff that might be required to create what one wants to create. I don't think VC funding as it currently exists is consistent with running an open source company according to my values, which is why we're not taking venture funding for Zulip. Obviously, being scrappy, applying for NSF grants, and spending my own money have very real downsides both personally and for our growth, especially when every competitor has VC funding, but it also means that I can ensure Zulip continues existing as a real open source project for the long run.

fossuser 6y ago
How much power do the VCs typically have? Don't founders often have the ability to overrule and make their own decisions? Chris is already financially independent from the OKCupid sale, he could have open sourced the server code and/or reduced the overall burn to pivot to paid accounts. Though the weird Stellar wallet addition implied some vision/product issues anyway. Of course it's easy and probably unfair for me to say these things as an outsider with limited information and no real stake, it's definitely possible I'm wrong about important details that would change my mind. It'd be interesting to hear from Chris, but the sale probably restricts public communication? This reminds me a little about the OKC sale actually, they had a blog post about why charging for dating sites made them worse that they took down after selling to match (they used to do cool analysis and publish them as blog posts, most of the details ended up in the book a different cofounder published called Dataclysm). That's more understandable to me though since I think it was their first exit. Reading about Zulip - didn't you get bought by Dropbox before being open source? Is your current situation a lucky outcome - or was it a condition of the sale? [Edit] - To clarify since there are downvotes, my questions aren’t rhetorical - they’re genuinely asking.

ahnick 6y ago

Fingers crossed they open source the server portion at least -> https://github.com/keybase/client/issues/24105 https://github.com/keybase/client/issues/24105

wiggler00m 6y ago
+1

alexisgermane 6y ago

Interesting. So the question is why doesn't China block it.

mirimir 6y ago

Sad. Very sad. It was such a great approach to associating GnuPG keys with social media. And their chat etc were also pretty cool. But Zoom is beyond the pale. So what now? Maybe someone could clone the GitHub repos. And/or are GnuPG keyservers safe enough again? For chat, Session looks most interesting. It's got the Signal messaging bits. Plus anonymity via the Loki onion network. And it's available for all platforms. However, it's very new, and often buggy. And the Loki Foundation is Australian. So at some point they'll likely get pressured to backdoor stuff. And they probably won't be able to disclose that, unless someone leaks. There's also Tox, where each user runs a Tor onion client. That's secure enough in Whonix. But the Whonix user base is miniscule, and I wouldn't trust an implementation in Windows. But then, maybe Session in Windows is too iffy as well. Anyway, I'll be deleting my Keybase account, as soon as I've negotiated alternate comms with my contacts.

namibj 6y ago
So, yeah. Zoom did bad stuff. But Keybase is designed so that all those things would obviously be detectable (Keybase client code is open source), and the ways in which the Server could mess with data are much restricted. If that spreads to Zoom, there's a chance it'd be a good service in a year or two. PGP keyservers have a fundamental issue that demands a solution like CT logs or Keybase-style merkle trees. The only way to prevent getting Loki backdoor issues would seem to be a development so clearly in-the-open, that any secretive addition of significant code/suspicious PR behavior is obvious. Tor does not use Tor by default. It works with Tor, but that's it.
- rndgermandude 6y ago
  They are also kinda buying a social graph of mostly IT and security professionals, sprinkled with some journalists (and not the kind that usually does the "10 things" articles) and general tinfoil hats. My tinfoil hat tells me this information could be somewhat valuable to their Chinese overlords...
  - mirimir 6y ago
    Yes, it's Zoom's Chinese connections that rule them out, for me.

_pmf_ 6y ago

> and Chris Coyne always refused Well, now he has a thousandfold outcome compared to breadcrumbs that devs would throw at him. I.e. the system worked.

bythckr 6y ago

> I use Keybase to talk to my friend in China since it's one of the few services they don't block. I think the vital question is why was keybase not blocked? Maybe it was owned by someone high-up in China. That is why maybe Chris Coyne refused funding. It was free to just to onboard maximum number of users. Seems like "users" where the products that bought value to keybase.

dreamszl 6y ago
You really have imagination.
fossuser 6y ago
Things are usually not blocked when they’re not that popular or well known. In the Keybase case I think it was just obscure enough to avoid the censors.

ydb 6y ago

I am glad you mentioned China. Many people are too afraid to acknowledge the reality of that authoritarian country, for fear of reprisal from liberal do-gooders. This acquisition is a shame.