[dumpster_fire]

I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further.

Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault?

[pavlov]

This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC). It has no operations, it just holds a bunch of money put in by investors who want to find a private company that wants to go public.

[lordnacho]

Doesn't change the fact that your incentives as a public company are different.

Also all the people who built the company in the first place will cash out. People can decide for themselves whether they think the product will become more or less secure from this.

[Raed667]

The fact this is not only legal, but common practice baffles me ...

[bhawks]

It's faster and cheaper, those are things that are generally considered valuable.

Faster: the finance markets have been extremely tenuous the past 4 years between pandemics, supply chain crisis, world wars, inflation, and so on. An IPO requires 12 to 18 months of work / process before listing. SPACs can be done in a quarter or 2. In uncertain times it is much less risky to get the listing done fast.

Cheaper: Startups pay much less in fees to investment bankers when going through SPACs, there is also less dilution for investors and employees and more valuation transparency. In traditional IPOs investment bank underwriters have some conflict of interest to get lower valuations to pass the 'pump' onto their high value clients or proprietary trading desk. Why should they benefit over the people who have literally built the company?

While it is true that there is room to better regulate SPACs, there haven't been horrible abuses yet. It is also true that SPACs have not had the best returns for retail investors over the past few years however drawing a conclusion that this is due to SPAC usage versus the complex macro economic environment of recent years is very difficult.

[gizmo]

We’ve seen pre-revenue companies that promised flying cars and other obvious scams go public via SPACs. If you don’t consider that SPAC abuse your bar is a lot lower than mine. These are companies that had no chance of surviving the more serious road show due diligence that the likes of GS demand when they take startups public.

Instead we saw popular podcasts push their SPACs on gullible retail investors, based on fuzzy concepts like disruption and TAM. Subsequently these SPACs lost 90% of their value and the insiders made bank. I hope to see jail sentences for the more shameless SPAC pump and dump players.

[lotsofpulp]

Index ETFs have been around for 15+ years now, and the advice is widely known that if you are an uneducated investor without inside information or some type of edge, you should stick to sub 0.15% expense ratio index funds. It is so easy nowadays that all you have to do is figure out the year you want to retire and buy that year’s target date fund and forget about it.

If people want to gamble, then that is their problem.

[gizmo]

I'm not sure what your argument is. Sophisticated investors don't invest in obvious scams. That's tautologically true. Does that mean we should just watch and do nothing while people get scammed?

The thing is, nobody is born sophisticated and there are many ways to get hurt in financial markets in the absence of scams even if you're intelligent and do your homework.

You mention index trackers, but they are no silver bullet. Their mechanism is basically to buy more of stocks that go up, and to sell those stocks that stumble badly. The more people rely on index trackers (exchange traded or not) the more volatile they'll become, and because index funds use such a simple trading strategy it's easy to front-run or otherwise exploit them. Furthermore, index trackers depend on active investors for price discovery, and the fewer active investors you have the worse index funds will perform. Relying on a vanguard ETF might continue to work, but to assume that it will is hopelessly naïve. It's no coincidence that ETFs got so popular with interest rates at 0 and a fed that made stonks go up.

[tivert]

>> Instead we saw popular podcasts push their SPACs on gullible retail investors, based on fuzzy concepts like disruption and TAM. Subsequently these SPACs lost 90% of their value and the insiders made bank. I hope to see jail sentences for the more shameless SPAC pump and dump players.

> Index ETFs have been around for 15+ years now, and the advice is widely known that if you are an uneducated investor without inside information or some type of edge, you should stick to sub 0.15% expense ratio index funds....

> If people want to gamble, then that is their problem.

So what? It's also well known that the IRS doesn't take payment in iTunes gift cards. So do you think if people get scammed, it is their problem for not knowing better? Should we just repeal all the laws against fraud and scams, because caveat emptor?

The behavior described in the GP post is unacceptable, and the fact that someone theoretically should have known better doesn't excuse it.

[lordnacho]

I don't think you can avoid the conclusion that this is a legal loophole. It's "easy" to get listed as an empty shell because there's nothing there to check. Then you buy an actual business and everything is just dandy? Seems fishy to me.

[fnordpiglet]

“Faster and cheaper” isn’t really the goal when selling stock to retirees and pension funds. Going public is supposed to be a rigorous process of assuring your grandparents that this company meets a minimum bar of compliance and financial quality. Finding a back door to avoid scrutiny is a flaw, not a feature. I get that we all want to avoid the paperwork and red tape in life, but there are certain things that we have seen burn too many people too many times that we as a society demand you slow down and dot your i’s and cross your t’s for very good reasons.

[lotsofpulp]

No one is forcing, or even recommending, retirees and pension funds to invest in SPACs.

[tivert]

>> The fact this is not only legal, but common practice baffles me ...

> It's faster and cheaper, those are things that are generally considered valuable.

For the company. It's also faster and cheaper for the company to just to ignore all regulatory requirements (financial reporting, product safety, pollution, labor, etc.), but that's usually illegal for good reason.

It's seems pretty dysfunctional that companies would be allowed to do an end-run around pre-IPO scrutiny like this.

[aidenn0]

I mean a few years back I was told by my accountant that I made too much money to contribute to a Roth IRA, but it was 100% kosher to open a traditional IRA and immediately convert it to a Roth IRA. The fact that this was legal also baffles me.

[c22]

When you convert your traditional IRA to a Roth you immediately owe taxes on the amount. Then, presumably, due to your income, you can no longer contribute to it. Makes sense to me.

[aidenn0]

It was a while ago, but IIRC you only owe taxes on the pre-tax contributions (which, in this case was $0). But I couldn't make a post-tax contribution directly to a Roth, just a post-tax contribution to a traditional, then convert...

[edit]

Some googling[1] implies my memory was mostly correct.

1: https://www.investopedia.com/roth-ira-conversion-rules-47704... See particularly the part about "backdoor

[adrianmonk]

The point is that there are income limits for this process:

1. Take N dollars of post-tax money.

2. Put it in a Roth IRA.

But the same limits don't apply to this process:

1. Take N dollars of post-tax money.

2. Put it in a traditional IRA.

3. The next day, convert the traditional IRA to a Roth IRA.

When you do the conversion, you only owe taxes on any additional earnings (not your post-tax contribution) during the one day that it was a traditional IRA. So the second procedure accomplishes almost exactly the same thing as the first one, but it legally gets around the limit designed to prevent rich people from getting Roth IRA tax breaks.

[Analemma_]

It's probably going to be made illegal, or at least a lot more heavily regulated, any day now. The SEC has indicated that they're not happy with how SPACs are being used to skirt IPO disclosures.

[yellow_lead]

Although it's not illegal, I thought exchanges used to delist companies for this. At least NYSE. Maybe someone has more insight

[rekttrader]

It’s a more transparent and less predatory than venture capital.

[pavlov]

Is it? VCs don’t raise money from “mom and pop and Reddit” retail investors, but SPACs have enabled insiders to sell stock at $10 that often ends up being worth less than $1 or even bankrupt just a year or two later. These often included a social media pump like the SPACs promoted by “SPAC king” Chamath Palihapitiya.

However the companies that go public via SPAC are mostly VC-funded, so in that sense you’re right that they’re also profiting from the SPAC con by being able to dump their holdings in these companies that were not actually ready to go public.

[MaxPengwing]

Not this SPAC, https://www.avanza.se/aktier/om-aktien.html/1206860/acq-bure... It's mostly owned by Swedish Pension funds.

[sam_lowry_]

Yubico is originally Swedish, this makes sense.

[JohnFen]

That's even worse.

[simplotek]

> This is not really a merger because the other company is a “blank check” holding company (a.k.a. SPAC).

This reads like a non sequitur. The corporate structure is irrelevant if there is a radical change affecting how strategic decisions are made regarding their products and their userbase.

[tivert]

> I have an irrational concern about using security products from a company post-merger or acquisition. It has never ended well for me as an anecdotal user. Going public is taking that worry even further.

I wouldn't call that an irrational concern, since it's in fact pretty rational. Stock market investors demonstrability do not value computer security over financial performance, and once they control a company, its focus will shift to their priorities.

[amanj41]

I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business. Okta being a good example, when it took a 10% drop after the breach last year.

[tivert]

> I mostly agree with your point but I would say the exception is when the success of the company is closely tied to their security practices or their security features are their business.

The problem is bad security practices don't become clear until it's too late for the customers. A company can coast on reputation for a long time, while its stuff fails to keep up in non-obvious ways.

[adql]

I don't think it's irrational, it rarely improves the service

[duped]

> Make keys, sell keys. The end. What's there to raise funding for? Build yet another password vault?

Liquidity for employees who exercised their options and investors who funded them before they had significant revenue, presumably.

[aidenn0]

Besides raising funding, a reason to go public is to give the investors a pay-day. Inasmuch as some of the investors are also founders/key people, them "cashing out" can involve them being less involved.

[hayst4ck]

I agree with this as well. Capitalist influence creates a powerful conflict of interest.

When it cuts down to it, which master will yubico serve? The customers or their shareholders?

Now Yubico has a fiduciary responsibility to their shareholders.

I frankly can't think of very many companies that are able to resist this core capitalist corruption. Even Costco is implementing shareholder over customer policies. 1Password? Google's "do no evil." Are there good examples of companies that stay customer first after going public?

[red_admiral]

This is not a matter of going public, but I note that when MS bought Github, there was a lot of concern over whether that would degrade the service's customer-friendliness. So far, that doesn't seem to have happened? You don't need a MS365 identity to set up a github account, for example.

Also not going public, but Fastmail was bought by Opera in 2009 I think but then bought themselves back out again, and they've continued to offer excellent customer service (including yubikey support of which they were an early adopter) all the time.

So I'd say there's precedent for companies staying customer-focused under capitalism if the stars align: it has to be a place where (1) staying customer-focused is a clear net positive for the domain they're working in, even from a revenue perspective and (2) the people running the company understand this.

I imagine this is much more the case for companies where the customers are specialists / power users (think: developers) or other businesses, rather than the general public. I hope that means yubico of all places is lower risk. Although I consider them one of the best if not the best in the market, were they to go under, there are alternatives (google's own titan keys are ok replacements for the end user, though obviously they don't have the yubico back-end infrastructure). FIDO/U2F etc. are standards and come with certifications, so I'd hope there's only limited room for maneuvre for any new yubico owners to mess up, and a sufficient threat of losing their business that they are not incentivised to try anything too shady.

[belter]

"Has GitHub Been Down More Since Its Acquisition by Microsoft?" - https://statusgator.com/blog/has-github-been-down-more-since...

"...What does the data tell us? In the two years since the acquisition announcement, GitHub has reported a 41% increase in status page incidents. Furthermore, there has been a 97% increase in incident minutes, compared to the two years prior to the announcement..."

[nine_k]

This may mean active internal changes, especially in the infrastructure. These may enable something great, or remove some internal source of pain.

The stats are not enjoyable though.

[xenophonf]

> You don't need a MS365 identity to set up a github account, for example.

Slow AIs ^W ^W Corporations work on a different scale than people. For example, you _do_ need a MS365 identity to play Java Minecraft now, nine years after Microsoft bought Mojang.

[adql]

Those look very much as an exception to the rule

[neilv]

For personal use, I just tried to buy a few pre-SPAC units, just in case. But they seem to no longer sell any plain non-NFC USB-A keychain models.

[nine_k]

Unless you're price-sensitive and want to avoid the NFC for tat reason, I don't see how the NFC version is worse. If you don't want NFC at all, a bit of foil or even wire should physically block it.

[gertrunde]

It is possible to disable the NFC function, if that would be satisfactory?

[panny]

>pre-SPAC

?

[INTPenis]

Referring to the yubikey merger with a SPAC company called ACQ.

[neilv]

Before this ACQ Bure deal, in case quality, features, trustworthiness, or pricing change.

[panny]

Okay, but the YK5 was available before this acquisition and is still the same key after. Not sure how the NFC part factors into your assessment. I assumed SPAC meant something technical about the key.

[gonesilent]

building a legal team to fight shareholder lawsuits!