While I agree I think the most missed point of this whole topic is this:

I'd spent a lot of time thinking about how to roll my own GeoDNS, and then I saw yours that seemed nice and easy to configure and seemed to work from my test.

To keep this concrete: Marix does not claim universal security guarantees. Its scope, threat model, and cryptographic parameters are explicitly documented and open to review in the repository.

(Quote)

Just to clarify: Marix does not make any absolute security guarantees — all security properties and limitations are documented and open for audit. Marix’s threat model is local client encryption for S

I suggest you look at how https://lowendtalk.com/discussion/212947/release-zero-trust-lite-tiny-secure-zero-trust-gateway-for-your-vps went down before stating with such confidence that this vibe code

We clearly disagree on the premise. I’ve stated the project’s guarantees, limitations, and intended use, and I’m comfortable letting users evaluate the current code and documentation on that basis. I

You didn't simply publish this on GitHub. You stated that you finished a security-related tool and advertised it for others to use. It can exist, sure. Hell, I've written my own block ciphers just as

The suggestion to auto-tune Argon2 to a ~1 second target is reasonable, and I’m considering it as a follow-up improvement.

I'd recommend a fixed 256 or 512 MiB of memory with iteration count auto-tuned to take one second on the system. Your project is very heavy, so everything running on it will easily have that much memo

Since your earlier comment, the cryptographic parameters and documentation have been materially updated:

There's no room for debate. You should not be releasing anything that uses cryptographic primitives if you don't have this understanding. This may be a fun pet project, but suggesting that others use

Thanks for taking the time to provide detailed feedback from a cryptography perspective.

Yes there was one paid customer and one free using the service. All other accounts had no domains. I was only counting the paid as that's all most people care about.

Infosec expert here. I would strongly urge everyone to stay away from this client, or any brand-new SSH client, especially if it is vibe coded. Even a quick skim shows me several issues, such as using

He openly admitted to stealing my money. Basically in real time, documented here on let.

he was banned because he sent threats to the mod team

What's even more cringe is you guys got the MODs to believe all this bullshit and got him banned, when he provided more credentials than Lewis ever did. He revoked LET deals because of that needless b

RAID can slow down an object-storage cluster and it’s usually unnecessary when you use erasure coding and replication.

Anyway, shame. Seemed like I'd be able to avoid rolling my own.