4 ms·

> maybe more so because of the increased attacks on the software supply chain vendors I'm intrigued by this but not 100% sure I follow. Is the implication that

by paulgb 5y ago

> maybe more so because of the increased attacks on the software supply chain vendors I'm intrigued by this but not 100% sure I follow. Is the implication that VC-backed startups are more likely to suffer from a supply-chain attack, or just more general reluctance to incorporate any new tech into the stack as it increases the attack surface area?

verdverm 5y ago
Probably a little of both. I'm personally reducing this surface area with clients in light of recent attacks. Personally, something like this w.r.t. VC means that incentives will diverge and they lose touch with what it means to be a dev tool. w.r.t. supply chain, it's probably more of a correlation (related to) that they will eventually have the large companies as enterprise customers who are the real target. Also, once making money becomes the primary driver, other important tasks are deprioritized. I've seen both the tools and their correct usage go to the wayside. Most abstractly I think the misaligned incentives is what happens. I'm not convinced that VCs get dev tools and don't ruin them.
- nerdponx 5y ago
  Have there been any attacks that are able to exploit iTerm shell integrations or similar tooling?
  - verdverm 5y ago
    ITerm has had security issues, yes, but that is besides the point. With this product, are their collaboration features secure? Are their servers which support that secure? You are installing a tool which phones home on each command Why do I even want a shared terminal?
- brendanfalk 5y ago
  > Personally, something like this w.r.t. VC means that incentives will diverge and they lose touch with what it means to be a dev tool. > Most abstractly I think the misaligned incentives is what happens. I'm not convinced that VCs get dev tools and don't ruin them. I'd love to hear a little more about your thoughts here. We've committed to making autocomplete free for individuals. In your opinion, what else can dev tool companies like ours do to make you feel more comfortable?
  - verdverm 5y ago
    To start with, remove network related code. There is no reason for a autocomplete language to need to fetch a file or send telemetry. A telemetry setting is insufficient

by paulgb 5y ago

verdverm 5y ago

Probably a little of both. I'm personally reducing this surface area with clients in light of recent attacks. Personally, something like this w.r.t. VC means that incentives will diverge and they lose touch with what it means to be a dev tool. w.r.t. supply chain, it's probably more of a correlation (related to) that they will eventually have the large companies as enterprise customers who are the real target. Also, once making money becomes the primary driver, other important tasks are deprioritized. I've seen both the tools and their correct usage go to the wayside. Most abstractly I think the misaligned incentives is what happens. I'm not convinced that VCs get dev tools and don't ruin them.

nerdponx 5y ago
Have there been any attacks that are able to exploit iTerm shell integrations or similar tooling?
- verdverm 5y ago
  ITerm has had security issues, yes, but that is besides the point. With this product, are their collaboration features secure? Are their servers which support that secure? You are installing a tool which phones home on each command Why do I even want a shared terminal?
brendanfalk 5y ago
> Personally, something like this w.r.t. VC means that incentives will diverge and they lose touch with what it means to be a dev tool. > Most abstractly I think the misaligned incentives is what happens. I'm not convinced that VCs get dev tools and don't ruin them. I'd love to hear a little more about your thoughts here. We've committed to making autocomplete free for individuals. In your opinion, what else can dev tool companies like ours do to make you feel more comfortable?
- verdverm 5y ago
  To start with, remove network related code. There is no reason for a autocomplete language to need to fetch a file or send telemetry. A telemetry setting is insufficient