Moat must have been written more times in the last 12 months than in all of history before that time.

In his pocket or what? When SpaceX IPO'd he was valued at over a trillion USD. Currently somewhere over 900MM, and worth more than the 2nd, 3rd and 4th on the rich list combined.

In terms of net worth, you are closer to Jeff Bezos than Bezos is to Musk.

> When SpaceX IPO'd he was valued at over a trillion USD.

If you offer 0.0000001% of your LLC for sale and I purchase one share for $1, the value of your company becomes $1 billion dollars.

That’s exactly what SpaceX did. But with 5% shares for sale.

Big difference between getting people to buy 0.0000001% at that valuation, and getting them to buy 5%. Even if you assume SpaceX is worth zero, he's still worth $200B

And we are all closer to being millionaires than both of them.

> Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?

It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?

Someone did the math. Cost of continual maintenance, versus cost of product loss. They determined it wasnt worth the maintenance cost, and accepted that risk. And that risk manifested.

This happens all the time. Unfortunately, in my experience, most of the risk acceptance happens without even really believing in the cost of the risk, and people just accept everything. it is highly likely someone like that accepted this.

And the people that made the decision largely have moved on and cashed their bonuses from saving all that money. It's now someone else's problem.

Management is never held accountable.

> Management is never held accountable.

By whom and for what?

The problem with security maximalist[0] ideology is that it does not accept reality for what it is: shit will happen. The correct way to handle risks is to mitigate them to some extent, and then insure (or self-insure) against the risk that remains[1].

Then, when the risk actually materializes and mitigations prove insufficient, you write off the damage and carry on with your day - and yes, perhaps even reward the executives who set up mitigations and insurance that allowed the business operations to continue undisturbed.

Only then, mitigations MAY be upgraded and insurance premiums adjusted, as an event happening is an important new evidence in risk estimate for it happening again.

That's how adults in the room handle security.

It's only the general public and cybersecurity people who see random events happening and decry that somehow it affects them and Somebody Needs To Be Accountable, and Someone Must Do Something About It.

--

[0] - Or should I say, cybersecurity maximalist, because in every other field except software, this is well understood.

[1] - Talking about regular security, that applies to 99.99%+ of businesses; the risk to life and limb is a special case with extra considerations, though it fundamentally doesn't change much about the framework.

The polite term is 'self-insurance', and it's often the right move.

Saw an interesting app on f droid that lets your encrypt the password with another password and print them as qr codes. Nice idea but no idea why I'd use it

Presumably the bitwarden apps will stop working with them eventually

addig Vaulwarden compatibility to already FOSS mobile password managers might be the path of least resistance

or pooling together tokens and asking Claude nicely to make a mobile app

Or just fork the OSS bitwarden client?

With android changes this year how do you deploy it?

through a non-profit of course.

I don't like the changes, but if someone wants easy access to all the Android phones someone needs to take responsibility for what gets published. (and naturally since it's mostly a sham we need to have some shell corporation, just as malware publishers already have.)

> and you can use bitwarden's phone client

What will you use when this stops working in the near future?

You use Keyguard (https://github.com/AChep/keyguard-app).

>The source code is available for personal use only.

Not sure how switching from a "FOSS with some proprietary source-available components" client, that can be forked mostly intact if need arises, to a full proprietary source-available client, that author can make closed source at any point with no forks being possible, is an improvement.

May be worth submitting this to the front page

Why does everyone act like this hypothetical (and however likely) future is something that needs to be acted on now?

I'll just export my vault and move to KeepPass or something else?

How do you force password manager usage?

Technically or socially? The second one is hard, the first one can be done easily - just require the passwords to be 14/16+ characters, multiple symbol domains and calculate tempo of input. Slower than 350ms between keystrokes - error message. Those who can type that fast already are using pw manager or you can just skip this 0.001%.

Doing that will certainly get people to use a password manager.

But it doesn't say which password manager.

The most popular password manager is some text/word/excel document on the desktop.

I have no evidence to back this hypothesis, but I wonder if that’s still more secure than using bad passwords.

This being on the front page at the same time as the coffee machine sending 1TB of data, and the icann application being submitted by Coffee Danger LLC is just beautiful

This being on the front page at the same time as the coffee machine sending 1TB of data, and the icann application being submitted by Coffee Danger LLC is just beautiful

3 years ago written in rust meant it was probably faster and smoother than other options. Now it means vibecoded