15 karma · joined May 4, 2026
I'd most like feedback on the threat model, and on the auth path: login still goes through a normal password-to-server handshake, and moving to a PAKE (OPAQUE/SRP) so the password never reaches the server is the obvious open item I have not done yet. Happy to get into the cryptography also, the no-bank-connection decision, or why it is bootstrapped and not VC scaled.
I'm not sure about this one, though. Today, my experience with LLMs is that they're already pretty helpful for unit test edge cases I wouldn't have thought of. If you mean broader functional tests then maybe, but I wouldn't say the same for unit tests.
I fully agree with what you say regarding Boris, but I would emphasize that I don't think he has malicious intention either. He still is doing his job, to showcase the features their product offers.
Wrt to multiple products with similar ideas, I fully agree - we also use Uber, Bolt, and many others for the same purpose.