Bishop Fox, a security consulting firm, publishes research on web vulnerabilities, fuzzing, request smuggling, SSRF and pen testing tools.
HN links it for its security explainers, such as JSON interoperability bugs, email spoofing defences and password rotation, which commenters cite as a bad practice.
I understand where Moxie it coming from: user friendlyness (and candy) increases the user base in a demonstrable way. At the same time, adding code like this pretty clearly increases the attack surface unnecessarily. So there is a tradeoff they are making for everyone. I would much rather be able to disable that additional state space, even if I can't strip it out of the build entirely.
I also find it a bit crazy that the 'desktop' app is Electron, and they don't hint anywhere what a house of cards Electron is. I wouldn't run it except inside a VM, and even then I would have to accept that all the messages could be extracted remotely. They give no indication of their compliance with best practices (e.g. https://labs.bishopfox.com/tech-blog/reasonably-secure-electron) with is disturbing.
If you squint at it the right way, sure ;-)
It's basically a binary format that has a 1:1 compatible text format. The idea is that everything stays in binary format (which is faster to process, more efficient, and smaller), and then convert the document to text only if/when a human needs to see it or edit the document.
It could still be further compressed using a general purpose compressor like gzip, but the main purpose of the data format is to be easy for a machine to process compared to JSON/XML/etc, and tight in specification so that you don't end up with exploitable security holes due to implementation differences like you do with JSON/XML: https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities
The guy who first recommended rotation "has since come out and apologized about the first iteration of the NIST guidelines"[1]
Password rotation has always been a bad idea.
https://labs.bishopfox.com/industry-blog/2018/08/password-security-the-good-the-bad-and-the-never-should-have-happened
https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop-email-spoofing is a pretty good primer on spoofing (SPF, DKIM, DMARC)