Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Airborn – Private Google Docs Alternative

airbornos.com

Post reply on HN
Print view View original

181–190 of 218 posts

Re: Show HN: Airborn – Private Google Docs Alternative

#181

Post by snewman »

twiss wrote: post #172
arkadiyt wrote: post #163

Earlier quoted context omitted.

Minor bug report: registering with a 64 character password fails. 32 characters seems to work fine. Also a feature request: please add the ability for me to delete my account/data from your servers.

It works fine for me with a 64 character password. Maybe the server errored out randomly that time. What browser are you using? If you shoot me an email with your username, I'll delete your account and files manually.

How will you know the person emailing you is actually the owner of that username?

Re: Show HN: Airborn – Private Google Docs Alternative

#182

Post by [deleted] »

dandare wrote: post #177
twiss wrote: post #2

Hi HN! I made this. It has bulk import from Google Docs ;) thanks to a feature request from HN: https://news.ycombinator.com/item?id=15478479

Oh my gosh, this looks like months of work, even if the editors are OS, the beautiful homepage, the billing, replying to emails and keeping everything up...

[deleted]

Re: Show HN: Airborn – Private Google Docs Alternative

#183

Post by [deleted] »

snewman wrote: post #181
twiss wrote: post #172

Earlier quoted context omitted.

It works fine for me with a 64 character password. Maybe the server errored out randomly that time. What browser are you using? If you shoot me an email with your username, I'll delete your account and files manually.

How will you know the person emailing you is actually the owner of that username?

[deleted]

Re: Show HN: Airborn – Private Google Docs Alternative

#184

Post by snewman »

z3t4 wrote: post #32
twiss wrote: post #24

Earlier quoted context omitted.

Yes and no :) I did indeed not implement OT, but it's also a true story that I would create a Google Doc and share it, nobody knows what to write, I type a sentence, and my classmates delete it as a joke, to mess with me :) But yeah, feedback on the collaboration is welcome. Do you think editing one sentence with multiple people is necessary, and if so why? And on the other end of the spectrum, Word-style edit reques…

It's good to have if you want to go peer2peer eg. not having a server in between. Btw, Google Docs don't use a OT, or only a simple one, it does depend on the server and that you are online. A writing style that I try to use is that I just type ... don't look up words, just write YYY where I can't find the right word to use, then I read the text and fix all spelling errors, sentences, remove unnecessary parts etc. Th…

Google Docs does use OT. Or at least it did about six years ago, and I doubt that has changed. Source: I cowrote the original implementation (which was not OT, it was a three way merge of complete HTML files), and I was around when a new team rewrote the entire app using OT.

Historical note: live three way merging of HTML files, being produced by content-editable div implementations in different browsers, which like to rewrite each other's coding decisions in arbitrary ways (suddenly all your BRs become Ps, whee!) is "fun" in a way that I don't really ever need to revisit.

Re: Show HN: Airborn – Private Google Docs Alternative

#185

Post by twiss »

snewman wrote: post #181
twiss wrote: post #172

Earlier quoted context omitted.

It works fine for me with a 64 character password. Maybe the server errored out randomly that time. What browser are you using? If you shoot me an email with your username, I'll delete your account and files manually.

How will you know the person emailing you is actually the owner of that username?

I'd send an email to the email address they signed up with to confirm.

Re: Show HN: Airborn – Private Google Docs Alternative

#186

Post by zingmars »

dingo_bat wrote: post #173
akx wrote: post #167

Earlier quoted context omitted.

I wouldn't call that minor. Sounds like there's something odd about the way passwords are handled. :/

Another oddity is a 64 character password.

He probably uses a password manager and generates them randomly. Nothing odd about that.

Re: Show HN: Airborn – Private Google Docs Alternative

#187

Post by jimktrains2 »

q-base wrote: post #155
jimktrains2 wrote: post #147

Earlier quoted context omitted.

I'm glad you think that. I still don't trust you, nor do I trust that you will never be breached in such a way that a malicious update will be pushed. Everything you're saying still depends on me trusting you. What if this is my first time loading? How do I know you're not serving up new files that don't contain checks to be visitors? Moreover, are you insinuating that you will never update any code and that expect t…

I have nothing to do with this product, and although you appear a little negative towards the OP, it still seems as though you have quite a lot of knowledge in this area. So you peaked my interest. What what you do to avoid the scenarios you highlight?

Everytime you load a webapp, you are trusting the server. Everytime.

In this case, the author is trying to take steps to make changes more visible, but at the same time they're making their own changes cause alerts as well. However, if the product stops serving such countermeasures for new users at some point, or plays a long con over say a year of really tiny, innocent changes that eventually break the system to check downloaded files, then we're no better than any other web app out there.

So unless you're inspecting and verifying the code you actually download yourself, even with these countermeasures, you're no better than any other webapp with the need to trust the code you download _every_ time.

Now, you're always trusting a lot of things like your hardware, your compiler, your package maintainer's compiler, your package maintainer, &c (http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html). The difference, however, is that I only need to verify that trust each time I update my code, which I can do when I choose to (baring any incompatible server changes) and after I perform any audit I choose to. (With a web app, there is often no (straighforward) way to audit the code _before_ it's been downloaded and executed.

I know I've been negative about all of this to OP. I'm sure he's done a tremendous amount of work. It just makes me angry when people claim they've solved one of the largest, most important problems in cryptography, when all they did is just ask me to trust them in a different way. It also makes me annoyed that for a security-focused product, there are very few details about architecture and cryptographic choices on the product's security page.

I don't mean to denigrate the work OP has done. I just feel that they're being foolish in their security-related claims.

Re: Show HN: Airborn – Private Google Docs Alternative

#188

Post by jimktrains2 »

twiss wrote: post #151
jimktrains2 wrote: post #147

Earlier quoted context omitted.

I'm glad you think that. I still don't trust you, nor do I trust that you will never be breached in such a way that a malicious update will be pushed. Everything you're saying still depends on me trusting you. What if this is my first time loading? How do I know you're not serving up new files that don't contain checks to be visitors? Moreover, are you insinuating that you will never update any code and that expect t…

> What if this is my first time loading? Like I said, it's trust-on-first-use. This is no different from installing a desktop app. > How do I know you're not serving up new files that don't contain checks to be visitors? The Service Worker is installed on your own computer, and is still there the next time you open the web app. > How does the code prevent changes to the initial code loaded on a request? Which could i…

You're assuming the old version of the service worker will be there and running. That isn't a good assumption. It will normally be there, but it doesn't have to be. There will always be circumstances where I'm downloading it for the first time, even in the same browser and computer.

Also, step 7 on https://w3c.github.io/ServiceWorker/#update-algorithm says that updating the service worker bypasses the service worker. How do you then validate that new service workers haven't been meddled with?

Re: Show HN: Airborn – Private Google Docs Alternative

#189

Post by twiss »

jimktrains2 wrote: post #187
q-base wrote: post #155

Earlier quoted context omitted.

I have nothing to do with this product, and although you appear a little negative towards the OP, it still seems as though you have quite a lot of knowledge in this area. So you peaked my interest. What what you do to avoid the scenarios you highlight?

Everytime you load a webapp, you are trusting the server. Everytime. In this case, the author is trying to take steps to make changes more visible, but at the same time they're making their own changes cause alerts as well. However, if the product stops serving such countermeasures for new users at some point, or plays a long con over say a year of really tiny, innocent changes that eventually break the system to che…

> With a web app, there is often no (straighforward) way to audit the code _before_ it's been downloaded and executed.

Yes, often, but not in this case. With Service Workers, you can notify the user before the code has been executed, and in most cases prevent or delay the update as well. That's why on https://www.airbornos.com/register, there's a checkbox marked "Notify me before updating Airborn OS." If you check that, Airborn OS will literally ask you whether you want to update.

Obviously, you understand the problem and how web apps usually work, but you still don't seem to understand my proposed solution. I would appreciate it if you attempt to do so before you loudly claim that I am wrong. Please see https://developer.mozilla.org/docs/Web/API/Service_Worker_AP... for a description of Service Workers, and http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap... for a description of my proposed solution.

Re: Show HN: Airborn – Private Google Docs Alternative

#190

Post by jimktrains2 »

twiss wrote: post #189
jimktrains2 wrote: post #187

Earlier quoted context omitted.

Everytime you load a webapp, you are trusting the server. Everytime. In this case, the author is trying to take steps to make changes more visible, but at the same time they're making their own changes cause alerts as well. However, if the product stops serving such countermeasures for new users at some point, or plays a long con over say a year of really tiny, innocent changes that eventually break the system to che…

> With a web app, there is often no (straighforward) way to audit the code _before_ it's been downloaded and executed. Yes, often, but not in this case. With Service Workers, you can notify the user before the code has been executed, and in most cases prevent or delay the update as well. That's why on https://www.airbornos.com/register , there's a checkbox marked "Notify me before updating Airborn OS." If you check t…

Service workers don't solve the problem.

First, service workers themselves are updated outside a service worker, so that is code I can't easily intercept before it is executed. (And first page load as always.)

Secondly, I still need to trust you not to make a mistake or not not be malicious over a long period of time making small tweaks that look innocent but over a year cause harm.

Third, users will become fatigued if every update you make causes them to click ok.

Post reply on HN