111–120 of 129 posts
I’m wondering what sorts of use-cases people would use a personal key-value store for. Maybe it’s just a useful foundation for building other tools on top of, like a password manager.
But it's just a wrapper around SQLite. Skip the middleman and just use SQLite.
Earlier quoted context omitted.
That is true, its just not as widely used as I would have hoped.
I feel like that has changed over the past few years. Many restaurants in my area started using them for menus, and I recently saw them used to setup wifi while on vacation.
The only places I see qr codes is on my phone to share the WiFi password and on products to scan for compitions and from time to time on advertising at bus stoos
I have so many questions about this. Much of the architecture seems off to me. I like the concept, but it doesn't seem as secure as it could be. For the README, I'd hope to find a bit more information about the way data is stored and transmitted. For example, this seems to just be a SQLite database with values in fields? Is there a separate encryption key for the database itself? Otherwise anyone with access to the f…
> this seems to just be a SQLite database with values in fields?
Sqlite is used as a storage format ("SQLite competes with fopen()"). The key-value pairs are stored as a modified Append-Only CRDT. The LUB-Operation (to merge to states while syncing) is implemented here: https://github.com/maxmunzel/kvass/blob/e32fdabdc86b039f716c...
> anyone with access to the file would be able to see all data stored?
Yes, attackers with access to your fs are not part of my attacker model. I rely on disk encryption for that matter.
> Do the clients cache data locally? It looks like you're basically syncing from the server for every request. You're already making a round trip to the server for a request anyway, so why not keep state only on the server? I can understand an offline-only mode, but this would require a significantly more robust sync mechanism. If this was the goal, I'd love to see this discussed more in the README too.
The sync mechanism is actually pretty solid, as its based on CRDTs. One of the applications of kvass is central management of config files, so automatic syncing and offline fallback are important.
> What is the purpose of the ProcessID?
The Counter Variable implements a rudimentary implementation of Lamport clocks. To get a total order from Lamport clocks, you need ordered, distinct process ids. The process id's don't really need to mean anything and the Lamport clock is itself just a fallback for the case that the wall-clock timestamps collide (see the Max() function), so it's practical to just draw them randomly.
> I didn't see any authn/authz in the requests. You're also unmarshalling random data from the request w/o confirming that it is valid first. This seems risky to me and could potentially crash the server if I were to send it random data.
Authentication is provided by the GCM mode of AES. As I decrypt (and thereby verify) early, I can assume to work on trustworthy payloads. GCM is also non-malleable unlike for example CBC or CTR.
As suggested by losfair, I'll switch to PSK TLS as soon as it's available or just put HTTPS in front of the end-points. But that's not high-priority right now.
how about: echo "value" > ${home}/.db/key cat ${home}/.db/key > value scp -r ...
Earlier quoted context omitted.
That's interesting but you're better off going by the actual guidelines of the actual site and the many times they've been restated and commented upon by the actual moderators. Many relevant ones here https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... or here https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
sorry but you don't get to redefine the word "news". The site is literally called "hacker news". so by definition, its a news site. granted, its news specific to computing and technology, but news just the same. unless everyone in the world got together behind my back, and changed the entire english language, then its a news site.
What is the benefit compared to the private use of Redis? Redis is under BSD licence and continues to be very actively maintained and used.
I thought it’s a password store. Also bc of the name “v” pronounced Spanish = b, so key-bass, sounds like pass