8 ms·

I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going

I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further. Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault?

gonesilent 3y ago
building a legal team to fight shareholder lawsuits!
pavlov 3y ago
This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.
- Raed667 3y ago
  The fact this is not only legal, but common practice baffles me ...
  - rekttrader 3y ago
    It’s a more transparent and less predatory than venture capital.
    - pavlov 3y ago
      Is it? VCs don’t raise money from “mom and pop and Reddit” retail investors, but SPACs have enabled insiders to sell stock at $10 that often ends up being worth less than $1 or even bankrupt just a year or two later. These often included a social media pump like the SPACs promoted by “SPAC king” Chamath Palihapitiya. However the companies that go public via SPAC are mostly VC-funded, so in that sense you’re right that they’re also profiting from the SPAC con by being able to dump their holdings in these companies that were not actually ready to go public.
      - MaxPengwing 3y ago
        Not this SPAC, https://www.avanza.se/aktier/om-aktien.html/1206860/acq-bure-spac https://www.avanza.se/aktier/om-aktien.html/1206860/acq-bure... It's mostly owned by Swedish Pension funds.
        sam_lowry_ 3y ago
        Yubico is originally Swedish, this makes sense.
  - bhawks 3y ago
    It's faster and cheaper, those are things that are generally considered valuable. Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast. Cheaper: Startups pay much less in fees to investment bankers when going through SPACs, there is also less dilution for investors and employees and more valuation transparency. In traditional IPOs investment bank underwriters have some conflict of interest to get lower valuations to pass the 'pump' onto their high value clients or proprietary trading desk. Why should they benefit over the people who have literally built the company? While it is true that there is room to better regulate SPACs, there haven't been horrible abuses yet. It is also true that SPACs have not had the best returns for retail investors over the past few years however drawing a conclusion that this is due to SPAC usage versus the complex macro economic environment of recent years is very difficult.
    - gizmo 3y ago
      We’ve seen pre-revenue companies that promised flying cars and other obvious scams go public via SPACs. If you don’t consider that SPAC abuse your bar is a lot lower than mine. These are companies that had no chance of surviving the more serious road show due diligence that the likes of GS demand when they take startups public. Instead we saw popular podcasts push their SPACs on gullible retail investors, based on fuzzy concepts like disruption and TAM. Subsequently these SPACs lost 90% of their value and the insiders made bank. I hope to see jail sentences for the more shameless SPAC pump and dump players.
      - lotsofpulp 3y ago
        Index ETFs have been around for 15+ years now, and the advice is widely known that if you are an uneducated investor without inside information or some type of edge, you should stick to sub 0.15% expense ratio index funds. It is so easy nowadays that all you have to do is figure out the year you want to retire and buy that year’s target date fund and forget about it. If people want to gamble, then that is their problem.
  - yellow_lead 3y ago
    Although it's not illegal, I thought exchanges used to delist companies for this. At least NYSE. Maybe someone has more insight
  - Analemma_ 3y ago
    It's probably going to be made illegal, or at least a lot more heavily regulated, any day now. The SEC has indicated that they're not happy with how SPACs are being used to skirt IPO disclosures.
  - aidenn0 3y ago
    I mean a few years back I was told by my accountant that I made too much money to contribute to a Roth IRA, but it was 100% kosher to open a traditional IRA and immediately convert it to a Roth IRA. The fact that this was legal also baffles me.
    - c22 3y ago
      When you convert your traditional IRA to a Roth you immediately owe taxes on the amount. Then, presumably, due to your income, you can no longer contribute to it. Makes sense to me.
      - aidenn0 3y ago
        It was a while ago, but IIRC you only owe taxes on the pre-tax contributions (which, in this case was $0). But I couldn't make a post-tax contribution directly to a Roth, just a post-tax contribution to a traditional, then convert... [edit] Some googling[1] implies my memory was mostly correct. 1: https://www.investopedia.com/roth-ira-conversion-rules-4770480 https://www.investopedia.com/roth-ira-conversion-rules-47704... See particularly the part about "backdoor
      - adrianmonk 3y ago
        The point is that there are income limits for this process: 1. Take N dollars of post-tax money. 2. Put it in a Roth IRA. But the same limits don't apply to this process: 1. Take N dollars of post-tax money. 2. Put it in a traditional IRA. 3. The next day, convert the traditional IRA to a Roth IRA. When you do the conversion, you only owe taxes on any additional earnings (not your post-tax contribution) during the one day that it was a traditional IRA. So the second procedure accomplishes almost exactly the same thing as the first one, but it legally gets around the limit designed to prevent rich people from getting Roth IRA tax breaks.
- lordnacho 3y ago
  Doesn't change the fact that your incentives as a public company are different. Also all the people who built the company in the first place will cash out. People can decide for themselves whether they think the product will become more or less secure from this.
- simplotek 3y ago
  > This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). This reads like a non sequitur. The corporate structure is irrelevant if there is a radical change affecting how strategic decisions are made regarding their products and their userbase.
- JohnFen 3y ago
  That's even worse.
neilv 3y ago
For personal use, I just tried to buy a few pre-SPAC units, just in case. But they seem to no longer sell any plain non-NFC USB-A keychain models.
- panny 3y ago
  >pre-SPAC ?
  - neilv 3y ago
    Before this ACQ Bure deal, in case quality, features, trustworthiness, or pricing change.
    - panny 3y ago
      Okay, but the YK5 was available before this acquisition and is still the same key after. Not sure how the NFC part factors into your assessment. I assumed SPAC meant something technical about the key.
  - INTPenis 3y ago
    Referring to the yubikey merger with a SPAC company called ACQ.
- gertrunde 3y ago
  It is possible to disable the NFC function, if that would be satisfactory?
- nine_k 3y ago
  Unless you're price-sensitive and want to avoid the NFC for tat reason, I don't see how the NFC version is worse. If you don't want NFC at all, a bit of foil or even wire should physically block it.
hayst4ck 3y ago
I agree with this as well. Capitalist influence creates a powerful conflict of interest. When it cuts down to it, which master will yubico serve? The customers or their shareholders? Now Yubico has a fiduciary responsibility to their shareholders. I frankly can't think of very many companies that are able to resist this core capitalist corruption. Even Costco is implementing shareholder over customer policies. 1Password? Google's "do no evil." Are there good examples of companies that stay customer first after going public?
- red_admiral 3y ago
  This is not a matter of going public, but I note that when MS bought Github, there was a lot of concern over whether that would degrade the service's customer-friendliness. So far, that doesn't seem to have happened? You don't need a MS365 identity to set up a github account, for example. Also not going public, but Fastmail was bought by Opera in 2009 I think but then bought themselves back out again, and they've continued to offer excellent customer service (including yubikey support of which they were an early adopter) all the time. So I'd say there's precedent for companies staying customer-focused under capitalism if the stars align: it has to be a place where (1) staying customer-focused is a clear net positive for the domain they're working in, even from a revenue perspective and (2) the people running the company understand this. I imagine this is much more the case for companies where the customers are specialists / power users (think: developers) or other businesses, rather than the general public. I hope that means yubico of all places is lower risk. Although I consider them one of the best if not the best in the market, were they to go under, there are alternatives (google's own titan keys are ok replacements for the end user, though obviously they don't have the yubico back-end infrastructure). FIDO/U2F etc. are standards and come with certifications, so I'd hope there's only limited room for maneuvre for any new yubico owners to mess up, and a sufficient threat of losing their business that they are not incentivised to try anything too shady.
  - adql 3y ago
    Those look very much as an exception to the rule
  - 3y ago
adql 3y ago
I don't think it's irrational, it rarely improves the service
deleted 3y ago
[deleted]
tivert 3y ago
> I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further. I wouldn't call that an irrational concern, since it's in fact pretty rational. Stock market investors demonstrability do not value computer security over financial performance, and once they control a company, its focus will shift to their priorities.
- amanj41 3y ago
  I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. Okta being a good example, when it took a 10% drop after the breach last year.
  - tivert 3y ago
    > I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. The problem is bad security practices don't become clear until it's too late for the customers. A company can coast on reputation for a long time, while its stuff fails to keep up in non-obvious ways.
aidenn0 3y ago
Besides raising funding, a reason to go public is to give the investors a pay-day. Inasmuch as some of the investors are also founders/key people, them "cashing out" can involve them being less involved.
duped 3y ago
> Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault? Liquidity for employees who exercised their options and investors who funded them before they had significant revenue, presumably.

gonesilent 3y ago

building a legal team to fight shareholder lawsuits!

pavlov 3y ago

This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.

Raed667 3y ago
The fact this is not only legal, but common practice baffles me ...
- rekttrader 3y ago
  It’s a more transparent and less predatory than venture capital.
  - pavlov 3y ago
    Is it? VCs don’t raise money from “mom and pop and Reddit” retail investors, but SPACs have enabled insiders to sell stock at $10 that often ends up being worth less than $1 or even bankrupt just a year or two later. These often included a social media pump like the SPACs promoted by “SPAC king” Chamath Palihapitiya. However the companies that go public via SPAC are mostly VC-funded, so in that sense you’re right that they’re also profiting from the SPAC con by being able to dump their holdings in these companies that were not actually ready to go public.
    - MaxPengwing 3y ago
      Not this SPAC, https://www.avanza.se/aktier/om-aktien.html/1206860/acq-bure-spac https://www.avanza.se/aktier/om-aktien.html/1206860/acq-bure... It's mostly owned by Swedish Pension funds.
      - sam_lowry_ 3y ago
        Yubico is originally Swedish, this makes sense.
- bhawks 3y ago
  It's faster and cheaper, those are things that are generally considered valuable. Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast. Cheaper: Startups pay much less in fees to investment bankers when going through SPACs, there is also less dilution for investors and employees and more valuation transparency. In traditional IPOs investment bank underwriters have some conflict of interest to get lower valuations to pass the 'pump' onto their high value clients or proprietary trading desk. Why should they benefit over the people who have literally built the company? While it is true that there is room to better regulate SPACs, there haven't been horrible abuses yet. It is also true that SPACs have not had the best returns for retail investors over the past few years however drawing a conclusion that this is due to SPAC usage versus the complex macro economic environment of recent years is very difficult.
  - gizmo 3y ago
    We’ve seen pre-revenue companies that promised flying cars and other obvious scams go public via SPACs. If you don’t consider that SPAC abuse your bar is a lot lower than mine. These are companies that had no chance of surviving the more serious road show due diligence that the likes of GS demand when they take startups public. Instead we saw popular podcasts push their SPACs on gullible retail investors, based on fuzzy concepts like disruption and TAM. Subsequently these SPACs lost 90% of their value and the insiders made bank. I hope to see jail sentences for the more shameless SPAC pump and dump players.
    - lotsofpulp 3y ago
      Index ETFs have been around for 15+ years now, and the advice is widely known that if you are an uneducated investor without inside information or some type of edge, you should stick to sub 0.15% expense ratio index funds. It is so easy nowadays that all you have to do is figure out the year you want to retire and buy that year’s target date fund and forget about it. If people want to gamble, then that is their problem.
- yellow_lead 3y ago
  Although it's not illegal, I thought exchanges used to delist companies for this. At least NYSE. Maybe someone has more insight
- Analemma_ 3y ago
  It's probably going to be made illegal, or at least a lot more heavily regulated, any day now. The SEC has indicated that they're not happy with how SPACs are being used to skirt IPO disclosures.
- aidenn0 3y ago
  I mean a few years back I was told by my accountant that I made too much money to contribute to a Roth IRA, but it was 100% kosher to open a traditional IRA and immediately convert it to a Roth IRA. The fact that this was legal also baffles me.
  - c22 3y ago
    When you convert your traditional IRA to a Roth you immediately owe taxes on the amount. Then, presumably, due to your income, you can no longer contribute to it. Makes sense to me.
    - aidenn0 3y ago
      It was a while ago, but IIRC you only owe taxes on the pre-tax contributions (which, in this case was $0). But I couldn't make a post-tax contribution directly to a Roth, just a post-tax contribution to a traditional, then convert... [edit] Some googling[1] implies my memory was mostly correct. 1: https://www.investopedia.com/roth-ira-conversion-rules-4770480 https://www.investopedia.com/roth-ira-conversion-rules-47704... See particularly the part about "backdoor
    - adrianmonk 3y ago
      The point is that there are income limits for this process: 1. Take N dollars of post-tax money. 2. Put it in a Roth IRA. But the same limits don't apply to this process: 1. Take N dollars of post-tax money. 2. Put it in a traditional IRA. 3. The next day, convert the traditional IRA to a Roth IRA. When you do the conversion, you only owe taxes on any additional earnings (not your post-tax contribution) during the one day that it was a traditional IRA. So the second procedure accomplishes almost exactly the same thing as the first one, but it legally gets around the limit designed to prevent rich people from getting Roth IRA tax breaks.
lordnacho 3y ago
Doesn't change the fact that your incentives as a public company are different. Also all the people who built the company in the first place will cash out. People can decide for themselves whether they think the product will become more or less secure from this.
simplotek 3y ago
> This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). This reads like a non sequitur. The corporate structure is irrelevant if there is a radical change affecting how strategic decisions are made regarding their products and their userbase.
JohnFen 3y ago
That's even worse.

neilv 3y ago

For personal use, I just tried to buy a few pre-SPAC units, just in case. But they seem to no longer sell any plain non-NFC USB-A keychain models.

panny 3y ago
>pre-SPAC ?
- neilv 3y ago
  Before this ACQ Bure deal, in case quality, features, trustworthiness, or pricing change.
  - panny 3y ago
    Okay, but the YK5 was available before this acquisition and is still the same key after. Not sure how the NFC part factors into your assessment. I assumed SPAC meant something technical about the key.
- INTPenis 3y ago
  Referring to the yubikey merger with a SPAC company called ACQ.
gertrunde 3y ago
It is possible to disable the NFC function, if that would be satisfactory?
nine_k 3y ago
Unless you're price-sensitive and want to avoid the NFC for tat reason, I don't see how the NFC version is worse. If you don't want NFC at all, a bit of foil or even wire should physically block it.

hayst4ck 3y ago

I agree with this as well. Capitalist influence creates a powerful conflict of interest. When it cuts down to it, which master will yubico serve? The customers or their shareholders? Now Yubico has a fiduciary responsibility to their shareholders. I frankly can't think of very many companies that are able to resist this core capitalist corruption. Even Costco is implementing shareholder over customer policies. 1Password? Google's "do no evil." Are there good examples of companies that stay customer first after going public?

red_admiral 3y ago
This is not a matter of going public, but I note that when MS bought Github, there was a lot of concern over whether that would degrade the service's customer-friendliness. So far, that doesn't seem to have happened? You don't need a MS365 identity to set up a github account, for example. Also not going public, but Fastmail was bought by Opera in 2009 I think but then bought themselves back out again, and they've continued to offer excellent customer service (including yubikey support of which they were an early adopter) all the time. So I'd say there's precedent for companies staying customer-focused under capitalism if the stars align: it has to be a place where (1) staying customer-focused is a clear net positive for the domain they're working in, even from a revenue perspective and (2) the people running the company understand this. I imagine this is much more the case for companies where the customers are specialists / power users (think: developers) or other businesses, rather than the general public. I hope that means yubico of all places is lower risk. Although I consider them one of the best if not the best in the market, were they to go under, there are alternatives (google's own titan keys are ok replacements for the end user, though obviously they don't have the yubico back-end infrastructure). FIDO/U2F etc. are standards and come with certifications, so I'd hope there's only limited room for maneuvre for any new yubico owners to mess up, and a sufficient threat of losing their business that they are not incentivised to try anything too shady.
- adql 3y ago
  Those look very much as an exception to the rule
- 3y ago

adql 3y ago

I don't think it's irrational, it rarely improves the service

deleted 3y ago

[deleted]

tivert 3y ago

> I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further. I wouldn't call that an irrational concern, since it's in fact pretty rational. Stock market investors demonstrability do not value computer security over financial performance, and once they control a company, its focus will shift to their priorities.

amanj41 3y ago
I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. Okta being a good example, when it took a 10% drop after the breach last year.
- tivert 3y ago
  > I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. The problem is bad security practices don't become clear until it's too late for the customers. A company can coast on reputation for a long time, while its stuff fails to keep up in non-obvious ways.

aidenn0 3y ago

Besides raising funding, a reason to go public is to give the investors a pay-day. Inasmuch as some of the investors are also founders/key people, them "cashing out" can involve them being less involved.

duped 3y ago

> Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault? Liquidity for employees who exercised their options and investors who funded them before they had significant revenue, presumably.