Hacker News Reader

Comment by ryanwaggoner | Hacker News Reader

This seems in slightly bad taste, as it feels like a slightly disingenuous jab at 37signals so you can plug your own service. 37signals is serving a completely different market, one that isn't going to peruse their source code. So that market is going to have to trust them to some extent.

Additionally, every service requires some level of trust. How am I to know that the source code you show me is what you're actually using? (obviously client-side encryption services are better in this area). How do I know you won't sell my personal information, or abuse my billing information?

View on HN

This seems in slightly bad taste, as it feels like a slightly disingenuous jab at 37signals so you can plug your own service.

I plead guilty to taking advantage of the opportunity to mention my service (although most of my readers are already very much aware of tarsnap), but I would have written the blog post anyway.

that market is going to have to trust them to some extent.

Sure, but I still think there's a huge gap between "we don't log sensitive information" and "we have a policy which says that we shouldn't look at the data we've logged".

Given that the inability to look at user data was an explicit design decision, calling it out when you talk about this very issue is quite fair, I think.

I think it might be lame if cperciva reacted to the 37s thing by changing his product, but he called it long before it happened.

This response is easily within bounds. Tarsnap is opinionated software. So is 37signals' offerings. Let them have a debate. It is for the better education of us all.

Tarsnap's position here is assailable, and we will all benefit from the discussion.

as it feels like a slightly disingenuous jab at 37signals so you can plug your own service.

How do you feel Colin's point is in any way disingenuous? Do you think he doesn't believe what he says? Because that's the only way I could see it as being "disingenuous."

Personally, I don't think it's disingenuous to opportunistically state what you believe to benefit yourself, assuming you truly do believe it.

The point is not that his product is better, it's that his method of ensuring customer privacy is better and should be industry standard.

This seems to be the MO for this particular site. There is a blog post calling out someone's faults (privacy, security, etc), some basic misinformation and a plug for his service as being better.

I don't mind him wanted to do PR, but it does seem a bit distasteful. This was basically an ad couched in something that was supposed to look like content.

As one of the previous posters said, there are tradeoffs made when using a SaaS service and it is not possible to run a system like theirs while using strong client side, opaque encryption. Besides, comparing a backup system to a online file management system is apples to oranges.

There is a blog post calling out someone's faults (privacy, security, etc), some basic misinformation and a plug for his service as being better.

I make lots of posts about security and cryptography. I happen to think that Tarsnap does things right; if I didn't, I would have Tarsnap do things differently.

I usually decide to blog about something based on (a) whether I think it's interesting, and (b) whether I think people will learn from it. (There are exceptions like calling out jungledisk for not fixing weaknesses in their cryptography, but those are rare.) The question "will this give me a chance to advertise Tarsnap" doesn't come into it -- for one thing, the vast majority of my readers are already aware of Tarsnap.

Reply on news.ycombinator.com