remy_

No inspiration, only work!

Not the same budget.

Thanks for the report

Yes the repository was forked from CakePHP v2, before the framework was moved as a composer dependency, so v2 contributors are shown as Passbolt contributors.

It's the same model than redhat, you buy a subscription, and the software checks if you have a valid subscription. Nothing is stopping you from modifying the source to remove that check, re-build and re-distribute for free (or for a fee) under another name. This allows community-driven projects like Centos or Fedora to exist. It's an ambitious business model, which doesn't prevent other to compete. The bet is companies that rely on the service will want to pay and will prefer getting professional services / hosting from the original maintainers.

Hi passbolt developer here, the reason for building on top of CakePHP was mostly: - it's been audited multiple time (last in date was by Cure53, financed by mozilla foundation) - convention over configuration - good versatility for hosting (= less support) - lovely community (less big but very friendly)

The paid version is also distributed under Open Source license, but is not free (as in free beer).

Passbolt team was actually part of the Mailvelope project that did this. Integration setup is not easy / very user friendly, that's why it's not the default on Mailvelope.

mariadb / mysql? matomo / piwik.pro? It seems mostly done by the original developers however and not a new 3rd party.

That may be true for gitlab, but it's not the case for all the development tools. Like good luck running a selenium grid with 10min of maintenance per month.

In practice it's more than "ends-justify-the-means", it's a matter of how much time free software developers have and what they want to spend time on. For every alternative tools to github, CI, test grid, audit tools, etc. you have to factor in the cost of installation, maintenance and update. It's just not realistic to expect free software developers to take on extra work and/or financial investment. The author instead of calling people hypocrites should shift the discussion to finding creative solutions to foot the bill.

Passbolt, give it a try! https://www.passbolt.com/

Because the binary is served from a marketplace that works with an app that you trust and that will verify the package signature. Or, the web browser does not behave like a package manager.

Fair enough, whatever is the easiest for the attacker :). I'm checking Cyph and its "Trust On First Use" concept. Very interesting.

Because if you serve the library responsible for the encryption from the server, an attacker can perform a man in the middle attack and change that library. This will change when browsers will start implementing the web crypto api. https://www.w3.org/TR/WebCryptoAPI/

> - Do you have programmer APIs other than JS?

He probably means SOAP, Corba, etc. not just REST/JSON.

Thanks for the suggestions. We'll definitely come up with a feature/roadmap page shortly. As for the demo account it is a bit more complicated, but we'll look into it.

Fair play! We will propose something with less dependencies and more native support.

> Is passbolt able to pull gpg keys of a user from some external source automatically.

Not yet, same as key signing and manual keyring management. But hopefully we'll get there. Thanks for the positive feedback!

The authentication token follows a very specific pattern to prevent this type of attacks. For example an authentication token would look like this: gpgauthv1.3.0|36|8661be60-23df-11e5-b16c-0002a5d5c51b|gpgauthv1.3.0. Both the server and client check for the consistency of that format.

Passwords are not stored in the firefox extension, they are stored encrypted server side. The firefox extension is there make sure the cryptographic library (openpgp.js) cannot be tampered with (via MiM/XSS for example).