3 ms·

Keybase had good concept originally and they even had some momentum for a sec, but then they took VC money and imploded. Considering how simple system it was, I

by zokier 1y ago

Keybase had good concept originally and they even had some momentum for a sec, but then they took VC money and imploded. Considering how simple system it was, I feel it should be something we could implement again (without spof)

ocdtrekkie 1y ago
I really liked Keybase, and do note that Keyoxide exists as an open-source project where annotations of proofs are made directly on the PGP keys and no longer requires a central point of failure. ;) I will say there are downsides to cryptographic keys being required for updating a package: One of the biggest pain points we have in Sandstorm is we both verify authors using their PGP key (from Keybase, as it happens, it's an old project), and we have a keypair for each app which you need to update it. The end result unfortunately is sometimes we have trivial one-line fixes for apps which are abandoned by the author, and it is very difficult to deploy said fix to end users. This can hypothetically manifest in the form of unfixable security problems. We do have a way to forcibly change the key, but it's intentionally a pain to do, and of course, is possible because ultimately the central authority has the ability to code the platform to circumvent that key anyways. Which is to say, you do trade some security risks for other security risks, whether it's a better situation is an exercise for the reader.
0xCMP 1y ago
One of the founders is doing exactly that: https://foks.pub/ https://foks.pub/ Thread with comments announcing it: https://news.ycombinator.com/item?id=44520419 https://news.ycombinator.com/item?id=44520419
- zokier 1y ago
  Seems neat project, but it is missing the most characteristic feature of keybase, public identity verification? I.e. the ability to link key-pairs with social media accounts etc.
- phyzome 1y ago
  Disconcerting amount of AI-slop images on that page... not good for one of the first things I notice about a web page to be "why are the images so weird". (I'm also not keen to follow Max to another project... they fucked up OKCupid pretty badly, and Keybase never actually had a business model, with predictable results, so I have to imagine FOKS is going to get enshittified somehow as well.)
duskwuff 1y ago
> but then [Keybase] took VC money and imploded My understanding is that they were acqui-hired by Zoom - probably for optics reasons, since Zoom was having a series of high-profile security incidents around then. Keybase development basically came to a standstill at that point, probably because the team got pulled away to work on Zoom projects.
- yencabulator 1y ago
  That can still be caused by VC funding. Take VC money, burn money fast, runway gets too short -> look for an acquisition, even if it throws away the product. Investors can even force the founders to take that deal whether they want it or not. A less aggressively funded business might have limped on essentially forever with the base product.
  - RainyDayTmrw 1y ago
    I've heard this a few times. By what mechanism do the investors do the forcing, assuming that the company is early enough that the founder aligned board is still in the majority?
    - yencabulator 1y ago
      It's all a question of are the founders still in power or not. Especially at a time when the company is actively looking for a cheap last-resort acquisition, I'd expect all the possible external funding to have been pumped in, at less-than-ideal terms, and diluted the founders' slice. I've personally worked at a startup that forcibly ejected its founders. It happens. (The startup got sold for scraps about 6 months later. The service I personally worked on kept streaming video for about a year with zero maintenance, only failing when the hardware was physically powered off. This was well after the main database had collapsed, and the web UI was inoperable, while iframe embeds kept chugging along.)
      - Thrymr 1y ago
        > It's all a question of are the founders still in power or not. Plenty of "founders" decide to sell out rather than follow their original vision no matter what. It's not even necessarily the wrong thing to do. But the prospect of a liquidity event can turn an idealist's head quickly.

by zokier 1y ago

ocdtrekkie 1y ago

I really liked Keybase, and do note that Keyoxide exists as an open-source project where annotations of proofs are made directly on the PGP keys and no longer requires a central point of failure. ;) I will say there are downsides to cryptographic keys being required for updating a package: One of the biggest pain points we have in Sandstorm is we both verify authors using their PGP key (from Keybase, as it happens, it's an old project), and we have a keypair for each app which you need to update it. The end result unfortunately is sometimes we have trivial one-line fixes for apps which are abandoned by the author, and it is very difficult to deploy said fix to end users. This can hypothetically manifest in the form of unfixable security problems. We do have a way to forcibly change the key, but it's intentionally a pain to do, and of course, is possible because ultimately the central authority has the ability to code the platform to circumvent that key anyways. Which is to say, you do trade some security risks for other security risks, whether it's a better situation is an exercise for the reader.

0xCMP 1y ago

One of the founders is doing exactly that: https://foks.pub/ https://foks.pub/ Thread with comments announcing it: https://news.ycombinator.com/item?id=44520419 https://news.ycombinator.com/item?id=44520419

zokier 1y ago
Seems neat project, but it is missing the most characteristic feature of keybase, public identity verification? I.e. the ability to link key-pairs with social media accounts etc.
phyzome 1y ago
Disconcerting amount of AI-slop images on that page... not good for one of the first things I notice about a web page to be "why are the images so weird". (I'm also not keen to follow Max to another project... they fucked up OKCupid pretty badly, and Keybase never actually had a business model, with predictable results, so I have to imagine FOKS is going to get enshittified somehow as well.)

duskwuff 1y ago

> but then [Keybase] took VC money and imploded My understanding is that they were acqui-hired by Zoom - probably for optics reasons, since Zoom was having a series of high-profile security incidents around then. Keybase development basically came to a standstill at that point, probably because the team got pulled away to work on Zoom projects.

yencabulator 1y ago
That can still be caused by VC funding. Take VC money, burn money fast, runway gets too short -> look for an acquisition, even if it throws away the product. Investors can even force the founders to take that deal whether they want it or not. A less aggressively funded business might have limped on essentially forever with the base product.
- RainyDayTmrw 1y ago
  I've heard this a few times. By what mechanism do the investors do the forcing, assuming that the company is early enough that the founder aligned board is still in the majority?
  - yencabulator 1y ago
    It's all a question of are the founders still in power or not. Especially at a time when the company is actively looking for a cheap last-resort acquisition, I'd expect all the possible external funding to have been pumped in, at less-than-ideal terms, and diluted the founders' slice. I've personally worked at a startup that forcibly ejected its founders. It happens. (The startup got sold for scraps about 6 months later. The service I personally worked on kept streaming video for about a year with zero maintenance, only failing when the hardware was physically powered off. This was well after the main database had collapsed, and the web UI was inoperable, while iframe embeds kept chugging along.)
    - Thrymr 1y ago
      > It's all a question of are the founders still in power or not. Plenty of "founders" decide to sell out rather than follow their original vision no matter what. It's not even necessarily the wrong thing to do. But the prospect of a liquidity event can turn an idealist's head quickly.