I wouldn't put them in the Dropbox bucket.
Also, I think the value Tailscale provides is fairly unique and far from obviously a platform feature like file storage and perhaps even password management.
Vs a clear moral screw up like the big tech companies colluding to not hire one another’s employees.
I thought customers were complainingly loudly against their new direction of making 1Password an Electron app. Is that not the case?
Note: I'm not a 1Password customer.
The swap from native to electron on macos was hugely disappointing but something I could have probably lived with if they hadn't gone full saas no alternative.
So you think they could be lying about their fundamental selling point, and hiding it in all of their audits? Personally, I'd trust them more than Apple/Google/etc.
https://support.1password.com/1password-security/
https://1passwordstatic.com/files/security/1password-white-p...
Their online security-related UX is also a freaking nightmare. The desktop and mobile apps are excellent and still clearly the best, but yikes, their password plus secret uuid plus device identity is awful. I know multiple people who permanently lost everything thanks to that (remember, no local backups any more! That's what cloud storage almost always guarantees!), and they now push others away too.
I'm now a (relatively) happy KeePass user.
I get why they're doing it (or, at least, think I do), and I'm not angry enough to go get angry on Twitter, but I am going to avoid the upgrade for as long as I can. That's kind of a bummer to get there with a product you've historically really liked.
> the industry should collectively come up with a solution that incentivizes app developers away from electron rather than hoping they swim against the current of incentive.
They have the financial resources to build it in ~Rust but still chose electron. It’s a mind boggling decision.
Respectfully, I think you may misunderstand the company’s mission.
No, you confuse "customers" with a vocal minority.
I don’t necessarily blame them but think their decision was pushed along by the need for big money.
For example, I think they’d still be able to do the pay once model if they abstracted they storage to work with Dropbox/icloud/OneDrive/whatever.
There’s really no value add as a user for a monthly fee. Although lots of people don’t mind. I’d rather not pay for something as essential and simple as a synchronized, encrypted data blob. I literally replaced it with a Google doc and cutting and pasting more. A filter over Google docs does not require a monthly fee.
I have this problem with lots of SaaS products that could be software if they didn’t want or need lots of money.
I get why they don't but I often wish more SaaS companies had a bring your own computer & storage model. It doesn't make sense for 95% of customers and the 5% of us who might like it and have the tech chops to use it would just complain about having to pay more because we are outliers. But I wish it was offered!
Also sad because bring your own storage is more secure to me than trusting a company with all of my passwords. So they are reducing security and increasing price.
Perhaps you refer to loss of local vaults? If so, they were never really a viable option for me - I needed the app syncing across multiple devices, including mobile, and doing so with a third party sync solution wasn't suitable.
why not?
More importantly why was it necessary to remove the local vaults feature (I don't need it to integrate with any particular 3rd party syncing solution, I can handle that myself without any features from them) entirely?
A fully native app will offer you no such protection. If a dependency used for styling or animations or whatever is compromised, it will have total access to the system and be able to exfiltrate at will to any location. In Electron, the equivalent dependencies can instead run inside the CSP sandbox, preventing them from doing any serious harm.
Supply chain vulnerabilities also aren't unique to npm. Any project that uses dependencies (in any language) has the same issue.
While that's absolutely true, the Node ecosystem (which I use, love, and make my money in) definitely takes the sheer dependencies of dependencies of dependencies problem to a rather fascinating extreme, compared to nearly any other language I use.
My theory is that this is because there is no standard library in Node.
My JS frontend has something like 20,000 packages that need to be installed to build the app. The next highest-dependency lang I use is python, where my average python app will have approx 100 packages all in. And then it only goes down from there with other systems.
There's an exponential effect at work based on the number of libraries that do any one thing. If in python you have (for sake of argument) an average of 5, and in node an average of 25, the downstream effect is that you have massively more dependencies in your tree (many, many, more than 5x), just like you're seeing.
I still don't think the O(n) properties of dependency trees are any different in other languages though. Node just has the largest scale. If python had as many total packages as node, and was also as popular for building frontends, I think you'd have exactly the same situation. That's what I meant by "not in a different category". Node's scale/popularity is in a different category than python's, but its approach to dependencies is basically the same.
Is there anyone here with a counter argument? Has a security review been performed on each dependency? Any reason to think my fear is unfounded?
Regardless at Uno we're working on a password manager with a native app and rust core. It's geared more towards everyday consumers than power HN users, but you might find it interesting. The rust core including api server is open source right now because that's one point where we diverge from 1P. Whatever tech stack you choose, it needs to be openly auditable so that the community can collectively ensure it remains secure. https://github.com/withuno/identity
They used to have a kick-ass Mac app. That appealed to a considerable amount of their users. Then they ditched the native app for Electron, and those same users were disappointed.
OK, but it's not. Now what? Do we just live without until the platform overlords provide it, or does someone build it on top of the platform?
What even is the "platform", when my Android phone is connecting to my iPad and my Windows laptop and Linux desktop and Amazon cloud server?
$100M = ~$0.20 / computer user in US and western Europe (wealthy countries in connected software markets)
I pay over $700/ yr for their business plan and would like to have better performance for it.
There are Docker containerized apps that manage Wireguard too
Maybe contribute to one and fret less about behavior of VC funded business and wondering if they’re actually respecting your privacy to accomplish finance goals
With an open source implementation out there, anyone can do it merely pulling a Docker container, and without paying Tailscale.
Regardless I manage a dozen users with no issue using Embarks container; once they’re setup I touch nothing.
Paying people is not working with people; it’s working with a specific group. Open source is working with people.
The reality is that making software, like any other human endeavour, takes time and energy. Paying one another money is a rather well-established mechanism of rewarding and incentivising that time and energy (since not everyone wants to work free of charge to make and maintain software for you, out of the goodness of their hearts, no matter how much you insist that you're owed their unpaid labour).
There are small and local means of getting free food, or free woodworking, etc, but the general reality is that a high-quality high-dependency maintained product, over the long term, is more feasible when it's paid.
A fully functional web app in a Docker image is what wg-ui is.
Web companies could probably just provide API keys for customers at this point and abandon UX teams.
If it’s a real human problem, humans will solve it. If it’s instigated due to someone with coins in their pocket to mesmerize lizard brains, it’s a synthetic solution that will vanish with the synthetic driver of the work; payments.
Just because paying for things is common throughout history does not mean it’s necessary or the best choice long term; see Netflix propping up payment flows churning out crap. It means meat based tape recorders simply LARP the past.
I sincerely hope not, but there's so much bad precedent.