The purpose of a stock buyback is to increase the shares value. This allows investors to choose to realize profits, but this is not a "pump and dump" because having less outstanding shares fundamentally drives the price up. There is nothing wrong with stock buybacks.
The reason this is often done instead of a special dividend is that dividends create an immediate taxable event for all investors, which is considered less flexible than the capital gains tax associated with a stock buyback.
Besides the tax treatment difference, it's mostly a signalling/communication choice: share buybacks increase EPS which is a nice story, whereas dividends signal reliable profits.
I respectfully disagree. I think that stock buybacks distort the market and dividends don't. If our markets could be either based on A: a nice story or B: reliable profits, the choice for stability and growth is bright and clear.
This is not true. A walled garden only works well when it applies universally.
When app developers have the ability to bypass the walled garden, they have many incentives to do so ranging from financial to wishing to circumvent scrutiny. This will include an increasing amount of popular and useful apps, decreasing the options available to those who want to stay in the walled garden. For less technical users they will blindly follow instructions to leave the walled garden.
You are removing the choice of users who want a walled garden by supporting legislation forcing these ecosystems open.
Alternatively it just puts pressure on the walled garden to let people do what that want to do safely within the walls so they don’t have to go through the escape hatch.
If you consume any chess media, you would know there's a fair amount of crossover in chess players who enjoy playing poker.
That is because although chess appears to be a game of perfect information, it is impossible to calculate anything but a small fraction of possible future game states in a limited time. So skilled chess players must make educated guesses as to which lines are worth calculating, whether their opponent has already studied the current line, and what moves to play to get them out of their memorization.
This is effectively a game of limited information where solid Bayesian reasoning wins, just like poker.
That seem like a reductive take on why people live in HCOL areas. Those areas cost a lot because most people believe the quality of life is better, which raises the cost of living due to competition for real estate.
If every part of the US became equally expensive and convenient for work, VHCOL areas like the Bay Area would still be immediately oversubscribed for reasons unrelated to work.
The Bay Area has arguably the best climate (cool Mediterranean) of any major city, unique proximity to a diverse set of outdoor recreation (Big Sur, Napa, Yosemite, Tahoe just to name a few), and all the desirable amenities of a major metro area.
That’s not to say you can’t have a perfectly happy life in other areas if you have different preferences, but the cost of living is ultimately a market, driven by the aggregate preferences of all people.
To clarify, this was new information added to the release within the past hour or so, which seems like the company responding to criticism. The original article gave no indication 2FA was anything but mandatory.
Agreed. There is no way to rely on the simple model of 'my master password is the single point of failure' now. With any form of 2FA, there is now lockout risk in a way that cannot be mitigated fully. Bitwarden itself recommends printing out a recovery code and storing it in a safe, but what happens if you lose access to that safe? Or if you're traveling and need emergency access to your accounts after your phone gets stolen?
On the reddit post announcing this, Bitwarden added a response saying they will provide an opt-out option. It's unclear if this opt-out is temporary or not. It would be a huge step back for their product if 2FA becomes mandatory.
That actually happened to me a couple years ago. I was in a foreign country, and lost my phone. All I had to do was buy a new cheap phone and login to Bitwarden again. If I had 2FA enabled, I'd be completely screwed.
I have hidden recovery information in a few places on the internet - someone stumbling across it would not know what they are looking at, or what it's for. For example, you can hide the TOTP secret for an authenticator app, but it's useless unless you know what account and service it's for, and the associated master password.
So to mitigate lockout risk, you keep multiple Yubikeys, store recovery codes in multiple physical locations including presumably a fire-proof safe bolted into your home (at your expense), and use obscurity to store the TOTP secret on random places in the internet, presumably relying to external services or a self-hosted solution, which are themselves dependent on regular credit card payments going through.
Okay, I grant that you've reasonably mitigated the lockout risk. But I don't want to do any of this, and is it really reasonable to expect the everyday person to understand or implement all this? What happens in practice is that many users will not realize anything is wrong until they get locked out with no recourse.
This makes it hard for me to recommend Bitwarden to my friends who use typical insecure practices like password reuse or post-it notes.
Security has either been easy and weak, or difficult and strong. It will never change and so you will always have the option of weak security if you dont want to jump through the hoops for the peace of mind.
> my friends who use typical insecure practices like password reuse or post-it notes
IMO people who do those things will never change. Its like the environment, everybody knows what they should be doing but no-one cares enough to do it.
So Bitwarden should offer 2FA for users who want the additional security – they should never force users to enable it. It would be like refusing to save "password" as a password, because it is insecure.
If you have literally no other option than SMS 2FA because of bad support from websites, maybe. Otherwise it's probably one of the worst options (though I suppose unlike using your main number at least it's harder to discover the number for the 2FA phone to attack it with social engineering).
Same here, mine got pickpocketed. My mates laughed at me because they thought I was an idiot not be able to login to my accounts.
Was easily solved though, got a new SIM card from my network from the local store when I got back and recovered my Authy account via SMS which I can then generate 2FAs for my password app through. Was always a backup method I had up my sleeve. My browser keeps logged in as well so was able to get into most stuff through my PC once I got back.
> Bitwarden itself recommends printing out a recovery code and storing it in a safe, but what happens if you lose access to that safe?
I feel like your own creativity is limiting you here. There are lots of options to store those backup codes. Including giving them to multiple relatives to keep in a safe place so you can call and ask for it, creating a dedicated email account with no 2fa and email the code there, leave yourself a saved answerphone message with it on so you can dial in and listen, write it in the important info section of your passport so you always have it abroad etc etc...
It's great that recovery codes exist, but the security model can't rely on them. Unused email accounts get deleted, yubikeys get lost or reset, relatives lose documents, passports get renewed, house fires and car accidents happen, time passes, etc.
Any critical procedure needs to be exercised regularly to ensure it's still working. Normal people don't do that with recovery codes.
All of these things can be mitigated by a little care and attention by yourself.
What you are really saying is you want a way to be able to recover your account thats easy, quick, and you dont need to think about it. Unfortunately strong security will never be any of those things.
Any concept of "strong security" that doesn't consider losing access to be a security issue is, at best, amateur.
If a state actor can't access your email, but you also can't access your email (and receive notices of login attempts, password reset attempts, server intrusions, etc.), then you absolutely do not have a good security posture.
It doesn't matter how you want to describe it, keeping recovery keys available is an ongoing maintenance burden that most people aren't going to do perfectly. It's not appropriate to blame users for reasonably foreseeable problems with a fragile system and lock them out of their bank passwords.
> creating a dedicated email account with no 2fa and email the code there
Of course, that account could also decide to implement mandatory 2FA. Could even be unannounced, just "This login is suspicious, we sent a message to your recovery email to confirm this login"
The reason this is often done instead of a special dividend is that dividends create an immediate taxable event for all investors, which is considered less flexible than the capital gains tax associated with a stock buyback.
Besides the tax treatment difference, it's mostly a signalling/communication choice: share buybacks increase EPS which is a nice story, whereas dividends signal reliable profits.