• 0 Posts
  • 235 Comments
Joined 2 years ago
cake
Cake day: July 29th, 2023

help-circle

  • That’s a funny thing to say. The communication channel between the browser and whatever external password store can be made as restricted as you like… keepassxc and its browser api let you restrict which credentials are offered to the browser, and can let you manually OK each request, for example. It doesn’t need unrestricted read access.

    The bitwarden browser plugins are a bit more dubious though, because they communicate with a remote password store with more limited controls, and their enthusiasm for trying to store passkeys and totp hashes is definitely worth avoiding.








  • It’s everyone’s favourite alternate browser developer back again, lamenting how mean some tech folk are and how cruelly they threaten and oppress certain groups of people.

    Which groups? Oh, you know the ones šŸ˜‰

    spoiler

    A screenshot of a twitter post by Andreas Kling, reading:

    In recent years l’ve attended multiple software conference talks that had unrelated extreme political rhetoric in slides, such as ā€œfuck [name]ā€ and ā€œpunch [group]ā€.

    Whenever this happened, some of the audience would clap and cheer, l’d roll my eyes, and the talk would get back on topic.

    Fast-forward to today, and look at how many people in our industry are openly celebrating the murder of someone they decided was a ā€œnaziā€ and ā€œfascistā€. Turns out these people were more serious than I thought.

    As someone who’s repeatedly been called a ā€œnaziā€ and ā€œfascistā€ myself for disagreements with far-left ideology, I know how easily those labels get thrown around. And honestly, this is making me seriously reconsider which conferences I attend.

    There’s a hateful rot within our industry. It shouldn’t be socially acceptable to cheer for murder. We need to do more than roll our eyes.

    Source: https://goblin.band/notes/aeui8zv7rw80c08v


  • Kinda, but nothing I’m entirely happy with. We use bitwarden at work, at my suggestion, but I don’t like the tools as much as I do keepassxc, and even though you can self-host the network service that stores the data, you still have to host something whereas keepassxc is standalone and you can sync the password vault over some file sharing service, or carry it on a usb stick, etc. there have been a couple of incidents whereby user license data wasn’t processed correctly and people got locked out of bitwarden vaults, which is pretty serious even if it was only temporary. That can’t happen with easily-backed-up-and-restored local databases.

    They’ve also had some ā€œlicense controversiesā€ which should also give you pause for thought if you were interested in a free and open system: https://www.techradar.com/pro/bitwarden-clarifies-open-source-commitment-amid-user-concerns

    The original keepass project is still alive, and maybe I’ll have a look at that. The current maintainer is a bit odd, and the project has had some historical security issues, but I suspect that all password managers (at least on windows) will have the exact same problems. It is unlikely to have the same range of features, but it is written in a memory safe language (C#) rather than in C++, which keepassxc uses (and I’ve never been entirely happy with).

    In short, everything is awful, and I will probably stick with xc for my own purposes for now, as there isn’t quite a replacement for me yet. I’d buy a mooltipass (https://www.mymooltipass.com/) except I’d want a backup, and that means an outlay of a good Ā£300 which is a bit painful. And they’re often out of stock šŸ˜•


  • KeepassXC (my password manager of choice) are ā€œexperimentingā€ with ai code assistants 🫩

    https://www.reddit.com/r/KeePass/comments/1lnvw6q/comment/n0jg8ae/

    I’m a KeePassXC maintainer. The Copilot PRs are a test drive to speed up the development process. For now, it’s just a playground and most of the PRs are simple fixes for existing issues with very limited reach. None of the PRs are merged without being reviewed, tested, and, if necessary, amended by a human developer. This is how it is now and how it will continue to be should we choose to go on with this. We prefer to be transparent about the use of AI, so we chose to go the PR route. We could have also done it locally and nobody would ever know. That’s probably how most projects work these days. We might publish a blog article soon with some more details.

    The trace of petulance in the response… ā€œwe could have done it secretly, that’s how most projects do itā€ is not the kind of attitude I’m happy to see attached to a security critical piece of software.




  • KDE showing how it should be done:

    https://mail.kde.org/pipermail/kde-www/2025-October/009275.html

    Question:

    I am curious why you do not have a link to your X social media on your website. I know you are just forwarding posts to X from your Mastodon server. However, I’m afraid that if you pushed for more marketing on X—like DHH and Ladybird do—the hype would be much greater. I think you need a separate social media manager for the X platform.

    Response:

    We stopped posting on X for several reasons:

    1. The owner is a nazi
    2. The owner censors non- nazis and promotes nazis and their messages
    3. (Hence) most people who remain on X or are clueless and have difficulty parsing written text (one would assume), or are nazis
    4. Most of the new followers we were getting were nazi-propaganda spewing bots (7 out of 10 on average) or just straight up nazis.

    Our community is not made up of nazis and many of our friendly contributors would be the target of nazi harassment, so we were not sure what we were doing there and stopped posting and left.

    We are happy with that decision and have no intention of reversing it.