Does that not apply to anything in life? How difficult is it to get code into any open-source software package or distribution really? I work in high-security environments, and I'm always wondering how you can really guarantee that any Debian, Ubuntu or Arch developer is honest and not compromised themselves, any software package installed is 100% clean, and any software library module and container image is fully checked. And that's not getting into tin foil hat assumptions about a shady government agency having access to the major app stores, Github, common distributions or email hosters.

There simply is no way anymore to check the several million lines of code even a minimal setup requires somewhere in the stack. Even an in-depth code review of a medium sized web application – with deps – has already become a gargantuan task most companies simply can't afford.

> Or maybe not?

This.

It is just slightly more difficult and longer to target it in a large company because you usually have to actually be hired by that company and do not necessarily have the choice of the team/products you will be working on.

But adding backdoors and vuln, yes totally possible on random products that person would be affected to. There is review fatigue the same way there is fatigue in a lot of processes.

> Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families?

The more I think about it, the better I understand TrueCrypt's sudden demise.

I would tend to trust Apple more as they define attack vectors and mitigations in their platform security guide. Also they have a holistic approach to this from hardware through to software, not just an app tacked crudely onto whatever APIs were lying around.

I would NOT trust Microsoft though. I've had enough problems with Authenticator and so have other users in our org that I refuse to put data near it. Not concerned so much about other people getting access to it but me losing my data.

A fork of syncthing had been in development and released for a while though, so use of keepass isn't really getting harder unless this developer also pull the plug. https://f-droid.org/en/packages/com.github.catfriend1.syncth...

I've been using keepass for quite a number of years now. I have my database and a security key. I sync my database with dropbox (because I am too lazy to self-host something like nextcloud) between devices and just manually copy my key on everry device. My key was never synced through the internet.

I hope that's secure enough and works fine for me. I guess syncthing is just smaller and obviously doesn't need a third party?

At least the Play Store version has: https://github.com/syncthing/syncthing-android/issues/2064 But isn't https://f-droid.org/en/packages/com.nutomic.syncthingandroid... still being kept up-to-date?

I switched to f-droid at least, remember to Backup your config before uninstalling the Play Store version.

> Bitwarden has been trying to move away from a fully FOSS system

Details?