dteare

Get a safe, secure job.

Rocket is a delight. Been using it for a year now and the docs and dev experience and stability are all exceptional.

Request Guard Transparency[1] is something I’ve only seen in Rocket:

> When a request guard type can only be created through its FromRequest implementation, and the type is not Copy, the existence of a request guard value provides a type-level proof that the current request has been validated against an arbitrary policy. This provides powerful means of protecting your application against access-control violations by requiring data accessing methods to witness a proof of authorization via a request guard. We call the notion of using a request guard as a witness guard transparency.

Basically your endpoints can require access to a protected service via a parameter and you’re guaranteed that your code will only execute for valid&authorized requests. For example, imagine a UserService and a TeamAdminService, each with their own methods appropriate for their user type. Request guards are used to validate the request headers and database entries are correct before constructing these services. And since you can only construct them from a request, simply having a service listed as a parameter in your endpoint guarantees that the proper access control has be enforced before your code runs.

We’ve structured our app so that every sensitive operation goes through these services, thereby sidestepping entire classes of security concerns and missteps. I sleep better as a result and our security reviews are much more enjoyable.

I’d love to see this discussed more and adopted by more frameworks.

[1]: https://rocket.rs/v0.5/guide/requests/#guard-transparency

I agree providing the Secret Key to other devices can be a pain. In fact it's our #1 onboarding challenge. On Apple devices specifically it's much easier as we can store it in iCloud Keychain, but we'd like to make it simpler everywhere.

Curious if you've had a chance to try the Setup Code? It's not as slick as iCloud since we don't own the OS, but it enables you to scan the code and get all the account details on your new device. That way all you need to do is type your password.

On that note we recently had a hackathon around this to make things even simpler and we had some success there. I'm hoping we can make this real and share it in an update later this year.

We do have a $1,000,000 bug bounty for anyone that can capture the flag.

You're welcome! And thank you for supporting us all these years. <3

We looked around a bit but Electron worked so well for us when we started development in 2019 that we didn't have a need to continue searching. Electron also has such a strong community and momentum behind it that I'm happy to continue using it.

Sciter looks interesting and so does Tauri. Perhaps one of those will win out next time we do a deep dive here. :) Until then I've been really impressed with how well Electron is working when paired with Rust.

Cheers!

++dave;

I'm sorry it comes off that way. We don't mean any disrespect in the slightest. Your support over all these years means the world to us and we know darn well we wouldn't be here today without awesome customers like you. <3

I left a comment just above yours that I invite you to read. I don't want to repeat it in its entirety here but suffice it to say we're excited about our hosted solution and yes we can find ourselves shouting from the rooftops about it. Kinda like newlyweds I suppose. :)

++dave; 1Password Founder

Thank you for supporting us all these years! We wouldn't be here without awesome customers like you. <3

As a long time user I bet you remember when we needed to write posts like Two Factor or not Two Factor[1].

> One and a Half Factors?

Good times. :) Thankfully with our own service we are now able to provide real 2FA as our server is able to enforce it. Same with family sharing, team environments, automated backups, item history, account recovery that only your family organizers/team admins can perform, along with simple invites and easier device setup.

And it's not just new features but we can make existing ones better. You probably have seen your fair share of Conflict Resolution windows and weird sync issues over the last 10 years. Sync is a hard thing to get right and being able to rely on a server to give specific responses in specific situations has enabled us to provide a much better experience than we ever could with a generic file service.

The reality is 1Password is better than it ever has been as a direct result of allowing our developers to work their magic on both sides of the network connections. Server and client.

It's a bit dated now but I wrote From a Happy 1Password Maker[2] back in 2017 that highlights a lot of things we love about memberships. In it I explain why I'll continue to non-apologetically nudge everyone towards 1Password Memberships.

[1]: https://blog.1password.com/two-factor-or-not-two-factor/ [2]: https://blog.1password.com/why-we-love-1password-memberships...

++dave; 1Password Founder

Sorry it took us so long! We'll do our best to win you back. <3

++dave; 1Password Founder

Yup! Since the very beginning in 2006 Roustem and I wanted to make sure everyone used 1Password because they enjoyed doing so and not because of being locked in.

File > Export is your friend.

++dave; 1Password Founder

Thanks! That's what I was going for.

++dave; 1Password Founder

I'm happy to hear our export worked well for you. We spent extra effort there to make sure our export format contained enough structured information that it could be imported properly elsewhere. I hate data lock-in and we wanted to make sure you wouldn't be locked into 1Password.

I hope we can win you back someday.

++dave; 1Password Founder.

We're bringing this feature to Mac and Windows as well. It's currently in beta and will be coming to the official release soon.

If you'd like to play with this now be sure to install the beta of the Desktop app as well as the beta of the browser extension.

++dave; 1Password Founder

Yup! In many ways Linux is leading the charge. Not just with these features but also for development as a whole. Here's the background story on how 1Password for Linux started and how it was built:

https://dteare.medium.com/behind-the-scenes-of-1password-for...

++dave; 1Password Founder

Thanks for sharing. I’m sorry it took us so long to release a native Linux app. We have a great app for Linux now in beta and will move it to an official release shortly.

https://blog.1password.com/1password-for-linux-beta-is-now-o...

I hope you can give us another chance.

—Dave 1Password Founder

So sorry we scared you away! Linux has been on our radar for a while but our biggest challenge was finding a way to share code between apps without writing everything in C++. Thankfully we found Rust, a systems language built around efficiency and safety. From there we were able to build the common core we've always dreamed of and were off to the races. Please give us another chance and let us know what you think. <3

Awesome! I'm so happy to hear this. We'd love to hear about your experiences so please share after you give it a go.

I'm no Roustem but I'm close. :)

You're right, 1Password for Linux integrates tightly with the 1password.com service and as such does not support local vaults.