1. 3

    You can look at the whole history over the last 10 years, and 1Password has never been down for more than 3 hours. Most outages are <1 hour, scheduled ahead of time for maintenance in the middle of the night. :shrug:

    I feel really good about giving them money!

    1. 5

      1password is a proprietary service, one day they will no longer exist.

      1. 4

        There are many solid businesses that have been around since before the notion of free software even existed. And the average open source project doesn’t exactly have a long maintenance lifetime. I think I’ll take my chances.

        1. 3

          Pass is simple enough that it could be reimplemented in an afternoon if its ‘maintenance lifetime’ ended and it was (magically, for some reason, but I’ll play along) no longer available to decrypt my passwords.

        2. 3

          Is it more probable that I’ll stop existing first, though?

          1. 4

            Recent history is full of technology companies that have gone under, or were acquired and their services shuttered.

          2. 1

            However the 1Password apps store a local copy of the data so even if the servers go offline (or down forever) you can still access the data and the desktop app lets you export the data.

            1. 3

              That’s how it works today, but there’s no guarantee it’ll work like that tomorrow. And since it’s proprietary, you’re just along for the ride.

              1. 0

                That’s a little too cynical for my liking.

              2. 1

                LastPass and Bitwarden does this too. However, you can’t access it in situations when you’re online and they have a problem with their logon servers. Their apps reach out to the server to verify the login and get a fault condition. Their apps don’t then allow you to access the password vaults even though you have all you need to decrypt it locally. The local copy only works if you go offline first and then try to login.

          1. 5

            I’m just waiting for Google to break uBlock Origin. It’ll be a lot easier to coax people into installing Firefox once it has some real, unavoidable, tangible benefits.

            I’ve already got people running Firefox for Android because of it.

            1. 1

              They have no privacy anyway, though. They’re already running Firefox within Android. Do you realize how tightly Chrome is integrated into Android?

              1. 1

                Firefox has First-Party Isolation. That’s its killer feature.

                1. 1

                  First-Party Isolation is cool, but it’s basically invisible. It doesn’t have the kind of quality-of-life improvement that uBlock can provide on some sites.

                  1. 1

                    It doesn’t have to be invisible. Up to you.

              1. 6

                The author cites Zstandard compression as a reason for using Caddy. However, no web browser supports it. (Test tool.) He doesn’t mention Brotli which is supported just about everywhere. I feel like I’m missing something here.

                1. 3

                  I also got the impression that not much research has gone into this, especially from that part. I’m pretty intrigued by Caddy, but I was surprised when the article abruptly ended as I expected it to go deeper into the reasoning and experience/result of the switch.

                1. 9

                  It’s good to see another article like this. I remember reading his other post. I’ve been hosting my own e-mail for years; currently running on an opensmtpd/openbsd stack, and I’ve run into a lot of the same issues.

                  coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD)

                  I really dislike these little quips at political commentary. I’m no fan of the Orange Man either, but stuff like this ignores what he’s trying to say in the article – the big players: big tech, big defence, big pharma and big oil are the ones who call a lot of the shots.. The Big E-mail the author talks about is the core issue, not the orange puppet, and talking about his mental state without examining him personally is problamatic.

                  I like how the author dives into sanctions though. Not only Github, but Adobe and other major platforms have cut off people from essential tools due to a mix of sanctions and shitty subscription models. This stuff alone should encourage people to setup their own infrastructure using open source projects (e.g. run Gogs, Gitlab, etc.). In the case of Adobe … well since you can’t actually buy their software anymore, either buy a used CS6 license or .. I think we’re just going to see more piracy really.

                  I don’t think that either one of the Big Mailer Corps are evil or bad, I use some of their services on a daily basis

                  I get what he’s trying to say: if you’re in tech, do the work to help build out a diverse Internet ecosystem .. but most people are going to use the big stuff cause it’s easy and cheap or free. I dunno how I feel about this. I don’t like the big players and I’m not sure I agree with the author that most of them are operating for the greater good. .. They might have good people working there, but companies end up having emergent goal-setting that is more than the sum of its parts; and that is focused on infinite growth and domination in a way the individuals may not be.

                  1. 10

                    Sanctions apply to everyone, not just big corporations. It’s just as illegal for J. Random Hacker to make their tarballs available to users from Iran from a server hosted in their basement as it is for Github. Distributed infrastructure may make it more difficult to enforce, but then a sufficiently lunatic government can build a Great Firewall of $country to make distributed infrastructure impossible.

                    There are many reasons to build a diverse, distributed Internet infrastructure, but it’s not a way to keep governments from enacting more control over the people.

                    1. 1

                      Sanctions apply to everyone, not just big corporations. It’s just as illegal for J. Random Hacker to make their tarballs available to users from Iran from a server hosted in their basement as it is for Github.

                      This is true, and is a valid point.

                      Distributed infrastructure may make it more difficult to enforce, but then a sufficiently lunatic government can build a Great Firewall of $country to make distributed infrastructure impossible. There are many reasons to build a diverse, distributed Internet infrastructure, but it’s not a way to keep governments from enacting more control over the people.

                      This, I disagree with partially. Making a bad law more difficult to enforce changes the incentives of the government trying to enforce it in favorable ways. It forces governments to either spend more political capital and money on enforcement, or decide that it’s not worth it to enforce and give up. This was the case with alcohol prohibition in the United States and also marijuana prohibition in many jurisdictions. A diverse distributed Internet infrastructure might not prevent governments from enacting laws that are designed to give them more control over the people, but it will make it easier for people to break those laws, and that matters.

                    2. 4

                      I really dislike these little quips at political commentary. […] [Companies] are the ones who call a lot of the shots.

                      It’s a very timely comment. Russia blocked StartMail and ProtonMail this week. Mailbox.org is next. Tutanota provide the same type of services as the three others so they may be a liekly target after that.

                    1. 4

                      Thanks for sharing. I had no idea these directives existed.

                      1. 4

                        They are really underrated. I often configure them for services packaged for Debian. Most upstream developers are unaware of those or even unaware of sandboxing in general.

                        1. 3

                          There are a lot more than the ones mentioned in the article. It’s meant as an introduction to make more people aware that these exist. Check the systemd.exec man page for more directives.

                          1. 1

                            Many thanks!

                        1. 1

                          Another concern I have with these TLDs is that many of them are run by private companies. What if they decide that they no longer want to host .ninja because it’s not a good ROI? Or what if the company goes belly-up?

                          1. 2

                            Almost every single TLD is run by a private company. This problem isn’t unique to the newer TLDs.

                            1. 1

                              They will probably sell off their existing customer base (i.e. the domain name holders) to another company with better operating margins.

                              1. 2

                                probably

                                Personally, I’d rather not stake my business’ stability on that.

                                1. 1

                                  That’s a valid concern, I was for some reason thinking about personal domains only.

                            1. 9

                              I’ve independently reproduced the results for .com and .blog, and identify CentralNic, a TLD infrastructure service provider, as the common backend for some of the slowest TLDs.

                                1. 4

                                  I am using Brave for what seems like close to 3 years now. Started back when they were not based on Chromium. And have had nothing but a pleasurable experience with them.

                                  What I don’t get is when some users complain that they are doing something “unethical” by removing ads and showing their own ads. The things is that all of this is custom. As a user using Brace you can: 1) opt-out of adblock and see all the adds; 2) block all the adds; 3) choose to see the ads displayed by Brave.

                                  The choice is yours according to your own ethical standards.

                                  1. 1

                                    The “defaults” is agree, agree, replace all ads with “braver ads”, however. You may customize your browser, but the tyranny of the default suggests most people just stick with the default.

                                    1. 2

                                      But that is not so! There are a couple things wrong with this impression. 1st - in order to receive Brave ads you have to opt-in to Brave rewards. Before that you will not see any ads from them. And 2nd - you say “replace all ads with brave ads” - this never happens. Brave does not replace html ads, Brave ads are shown via OS notifications, not even in the browser. So you can see both sets of ads if you want, there is no “replacing”. 3rd - one important point that is missing is that you get revenue for seeing Brave ads if you choose to do so, and whatever you get is redistributed to websites you visit, based on click-counts.

                                      I am not sure how so many people can have the same distorted impression at the same time. I saw this repeated on hacker news over and over. At first I suspected that google or some other corp is behind this misinformation, with the purpose of saving their ad revenue. But seeing this on lobste.rs - it’s probably not the case.

                                  1. 2

                                    Is t here any way to protect your site if it’s being served through a CDN? Not just the site’s resources but the pages and everything.

                                    1. 5

                                      A proxying CDN like Cloudflare? No, they’re a voluntary man-in-the-middle for your website.

                                      1. 2

                                        If you’re using something like CloudFlare for your pages, then as far as the browser is concerned CloudFlare is your site.