6 ms·

It's unfortunate that they bought and destroyed Keybase [1] in a bid to improve their security and even still there seems to be no improvement. Guess even the b

It's unfortunate that they bought and destroyed Keybase [1] in a bid to improve their security and even still there seems to be no improvement. Guess even the best folks can't make an impact if company culture prevents it. [1] https://github.com/keybase/client/graphs/commit-activity https://github.com/keybase/client/graphs/commit-activity

turblety 6y ago
Yeah this was so sad, but I'm happy the guys that made it got paid. Even they would have known this was the end for Keybase. Hopefully when their non-compete clauses end the developers will make another product the same.
- bigiain 6y ago
  < Hopefully when their non-compete clauses end the developers will make another product the same. ... and it will get saddled with the reputation for trustworthiness it deserves. Sell me out once, shame on me...
- kelnos 6y ago
  > Yeah this was so sad, but I'm happy the guys that made it got paid. I don't really sympathize with this. You build something, get a ton of people to use it, advocate for it, get their friends to use it... I think after that, you have a responsibility to those users, and selling to a company like Zoom and then peaceing out on further work does not fulfill that responsibility.
  - bllguo 6y ago
    I couldn't disagree more. Most users didn't even pay, for goodness' sake.
    - orestarod 6y ago
      Was there a choice to pay??
      - bllguo 6y ago
        ok that's my bad - i thought they had an paid enterprise plan. So actually _nobody_ paid. That makes me believe even more strongly that the founders do not owe users anything.
        kelnos 6y ago
        It's a shame you feel that way; personally I feel that avoiding responsibility for your actions toward others is one of the big ills in our society. Suggesting that there's only responsibility if money changes hands merely makes me sadder.
    - kelnos 6y ago
      If you decide to base your business model on unpaid users, that doesn't absolve you of responsibility for them. You're still getting something from them, whether it's user numbers that impress prospective investors, or usage data that you can sell to third parties, or whatever. If you're building a security- and privacy-focused product, selling it to a company that has demonstrated several times that they don't care about their users' security or privacy is unethical, regardless of how you slice it. It makes the world poorer, and the internet less safe for the people who use it. This has nothing to do with payment.
  - iso947 6y ago
    The choice is entirely with the consumer to decide to use non free software. Don’t be shocked when you are hurt
andrewnicolalde 6y ago
Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.
- giancarlostoro 6y ago
  What killed me was I was ready to pay for any features like storage. They just never bothered. I wish they hadnt bought it out and instead just hired their team as consultants... This is a darn shame.
- juped 6y ago
  What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!
  - andrewnicolalde 6y ago
    It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encrypted filesystem with which you could sync files securely across all of your devices, share files publicly or with specific users or sets of users or groups in cryptographically protected ways. The unintelligible foray into cryptocurrency with Lumens made very little sense to me, but apparently the coins I was gifted for free by Keybase are worth over 100 USD now. I'll probably hold on to them.
    - timerol 6y ago
bigiain 6y ago
Ahhhh, "Our incredible journey" aka "So long suckers! See you at the yacht club sometime!"
- rglullis 6y ago
  - The code is open source - It provides all features for free - It is actually usable - AFAICT, no reports of security breaches - No privacy violations - At one point, they actually GAVE free lumens to its users. No strings attached at all. I received ~40USD worth of XLM which I transferred to an exchange and sold it right away. Please explain to me. again: how did they make you a sucker of you or their users?
  - orestarod 6y ago
    Is server side open source?
    - rglullis 6y ago
      Right, I meant the client - where it would be easier to claim malice or ill-intent from the company.
ignoramous 6y ago
> ...in a bid to improve their security Not specific to Keybase, but a lot of "cyber security firms" these days base their entire business on gross violations of privacy, unfortunately.
- foota 6y ago
  What?
  - dylz 6y ago
    They're not wrong. A large amount of the basically exist off gross privacy violations. Fingerprinting, gross PII sharing and overstorage, port scanning users' computers and LAN from their browser behind the FW/NAT for "security purposes",
    - foota 6y ago
      Maybe we're thinking of cyber security as different things, I'm mostly thinking about application security and enterprise security? What are you talking about?
      - dylz 6y ago
        anti-scraping, l7 ddos/bot/spider prevention, "anti fraud", fingerprinting devices on login, port scanning devices on login, this is pretty common in application and enterprise
bad_user 6y ago
Speaking of Keybase, I'm looking for an alternative to their encrypted Git repositories. Any suggestions?
londons_explore 6y ago
> https://github.com/keybase/client/graphs/commit-activity https://github.com/keybase/client/graphs/commit-activity Thats an awesome graph. Pretty hard to hide or fake activity on an opensource project. Also it shows how quickly engineering was pulled off projects... Usually it would be a matter of "finish the PR/feature/bug you're on", which might be days or weeks. Yet here everyone is pulled off over ~3 days.
- vultour 6y ago
  The activity declined over the course of almost 2 months.
dathinab 6y ago
The Problem of that they don't want to be secure in the sense you used. They made it pretty clear that security is for them not a fundamental aspect of their service but an afterthought they have to follow because they would use customers elsewise. I.e. security is still one of the lowest prioritise for them and only a priority art all because of public pressure

turblety 6y ago

Yeah this was so sad, but I'm happy the guys that made it got paid. Even they would have known this was the end for Keybase. Hopefully when their non-compete clauses end the developers will make another product the same.

bigiain 6y ago
< Hopefully when their non-compete clauses end the developers will make another product the same. ... and it will get saddled with the reputation for trustworthiness it deserves. Sell me out once, shame on me...
kelnos 6y ago
> Yeah this was so sad, but I'm happy the guys that made it got paid. I don't really sympathize with this. You build something, get a ton of people to use it, advocate for it, get their friends to use it... I think after that, you have a responsibility to those users, and selling to a company like Zoom and then peaceing out on further work does not fulfill that responsibility.
- bllguo 6y ago
  I couldn't disagree more. Most users didn't even pay, for goodness' sake.
  - orestarod 6y ago
    Was there a choice to pay??
    - bllguo 6y ago
      ok that's my bad - i thought they had an paid enterprise plan. So actually _nobody_ paid. That makes me believe even more strongly that the founders do not owe users anything.
      - kelnos 6y ago
        It's a shame you feel that way; personally I feel that avoiding responsibility for your actions toward others is one of the big ills in our society. Suggesting that there's only responsibility if money changes hands merely makes me sadder.
  - kelnos 6y ago
    If you decide to base your business model on unpaid users, that doesn't absolve you of responsibility for them. You're still getting something from them, whether it's user numbers that impress prospective investors, or usage data that you can sell to third parties, or whatever. If you're building a security- and privacy-focused product, selling it to a company that has demonstrated several times that they don't care about their users' security or privacy is unethical, regardless of how you slice it. It makes the world poorer, and the internet less safe for the people who use it. This has nothing to do with payment.
- iso947 6y ago
  The choice is entirely with the consumer to decide to use non free software. Don’t be shocked when you are hurt

andrewnicolalde 6y ago

Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.

giancarlostoro 6y ago
What killed me was I was ready to pay for any features like storage. They just never bothered. I wish they hadnt bought it out and instead just hired their team as consultants... This is a darn shame.
juped 6y ago
What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!
- andrewnicolalde 6y ago
  It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encrypted filesystem with which you could sync files securely across all of your devices, share files publicly or with specific users or sets of users or groups in cryptographically protected ways. The unintelligible foray into cryptocurrency with Lumens made very little sense to me, but apparently the coins I was gifted for free by Keybase are worth over 100 USD now. I'll probably hold on to them.
  - timerol 6y ago

bigiain 6y ago

Ahhhh, "Our incredible journey" aka "So long suckers! See you at the yacht club sometime!"

rglullis 6y ago
- The code is open source - It provides all features for free - It is actually usable - AFAICT, no reports of security breaches - No privacy violations - At one point, they actually GAVE free lumens to its users. No strings attached at all. I received ~40USD worth of XLM which I transferred to an exchange and sold it right away. Please explain to me. again: how did they make you a sucker of you or their users?
- orestarod 6y ago
  Is server side open source?
  - rglullis 6y ago
    Right, I meant the client - where it would be easier to claim malice or ill-intent from the company.

ignoramous 6y ago

> ...in a bid to improve their security Not specific to Keybase, but a lot of "cyber security firms" these days base their entire business on gross violations of privacy, unfortunately.

foota 6y ago
What?
- dylz 6y ago
  They're not wrong. A large amount of the basically exist off gross privacy violations. Fingerprinting, gross PII sharing and overstorage, port scanning users' computers and LAN from their browser behind the FW/NAT for "security purposes",
  - foota 6y ago
    Maybe we're thinking of cyber security as different things, I'm mostly thinking about application security and enterprise security? What are you talking about?
    - dylz 6y ago
      anti-scraping, l7 ddos/bot/spider prevention, "anti fraud", fingerprinting devices on login, port scanning devices on login, this is pretty common in application and enterprise

bad_user 6y ago

Speaking of Keybase, I'm looking for an alternative to their encrypted Git repositories. Any suggestions?

londons_explore 6y ago

> https://github.com/keybase/client/graphs/commit-activity https://github.com/keybase/client/graphs/commit-activity Thats an awesome graph. Pretty hard to hide or fake activity on an opensource project. Also it shows how quickly engineering was pulled off projects... Usually it would be a matter of "finish the PR/feature/bug you're on", which might be days or weeks. Yet here everyone is pulled off over ~3 days.

vultour 6y ago
The activity declined over the course of almost 2 months.

dathinab 6y ago

The Problem of that they don't want to be secure in the sense you used. They made it pretty clear that security is for them not a fundamental aspect of their service but an afterthought they have to follow because they would use customers elsewise. I.e. security is still one of the lowest prioritise for them and only a priority art all because of public pressure