Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting.
Then I learned that to use it, I would be dependent on authenticating using a login on one of the unaccountable internet behemoths who could take away my account for any random reason or no expressed reason at all.
No, thank you.
As far as threat models go, I can't really say I understand this one too much.
Just because a service you sign up for is not contentful, does not mean that they won't choose to boot you off for some reason completely unrelated to anything you control or anything you chose to do.
If we (the US) decided to invade Canada tomorrow, you can be certain that the maple syrup would stop flowing.
Edit: According to their website[1], the overwhelming majority of their employees are in Ukraine. Two of the three cities they have offices in are on the current combat front.
As far as paid services the possibility also is there that someday _you_ run out of money and have to stop paying them. They tend to shut down your access when that happens. Another financial threat you have to model.
These things don't happen when you use public key authentication.
Google will throw you on your ass in the blink of an eye.
What matters most is if they can. Then, if they ever have done. What I want is that they can't.
> Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.
> Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
I _could_ use my github account, but I don't trust them at all anymore. And I'm not going to setup an account with some other service just to use this. So that is a hard pass for personal use.
For a company it makes sense to have to use whatever sso provider you are already using i guess
Super annoying and borderline unacceptable.
Some people suggest trying Nebula instead.
David Crawshaw is CTO.