Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Airborn – Private Google Docs Alternative

airbornos.com

Post reply on HN
Print view View original

141–150 of 218 posts

Re: Show HN: Airborn – Private Google Docs Alternative

#141

Post by twiss »

EGreg wrote: post #139
twiss wrote: post #128

Earlier quoted context omitted.

Here's a description of what we've done to solve that problem: https://www.airbornos.com/docs/security

That's interesting, but you're plugging holes in a waterfall I think. For example, that first visit which installs the service worker can already deliver bad code. Not saying you will do it, but it all relies on people trusting you not to do it. So statements like "we CAN'T read your stuff" are not true on the web. Luckily, most web users don't care about being hacked by the server - they care about owning their own…

> For example, that first visit which installs the service worker can already deliver bad code.

Yes, but that is also the case when you install a desktop app. That's why Airborn OS is open source, so that you can inspect the code.

Re: Show HN: Airborn – Private Google Docs Alternative

#142

Post by drewmol »

jonnycomputer wrote: post #126
EGreg wrote: post #118

Earlier quoted context omitted.

I for one welcome this decision. I would perhaps limit the locking to one sentence at a time (which may split into several after editing) rather than a paragraph, and with an optional timeout for inactivity. I am a big fan of open source alternatives to Google and Facebook (see Qbix). Do you mind if I contact you?

should give users the ability to lock specific regions by selecting them

I agree. This may be a useful and simple way to implement locking. Often when editing for things other than minor punctuation or spelling, individual sentences or paragrapshs often get split or combined as statements are rephrased or ideas reorganized.

Re: Show HN: Airborn – Private Google Docs Alternative

#143

Post by twiss »

jimktrains2 wrote: post #138
twiss wrote: post #105

Earlier quoted context omitted.

> If an attacker has access to your server, why should I believe that they wouldn't be able to update your github repository? I don't have my GitHub password/keys on the server. Why would I have them there? > I have to trust you _regardless_ of any of your technology, and that's the problem. Yes, but it's trust-on-first-use. There's a big difference between 1. Trusting me today when I say that the GitHub keys are not…

> I don't have my GitHub password/keys on the server. Why would I have them there? Because you only need an SSH key to push to github and it's not uncommon for people to leave those laying around (or to forward them with a connection!) on a server. The better question is not "Why would you have them there?" but "How do I know you don't have them there?" > Yes, but it's trust-on-first-use. There's a big difference bet…

> And when this changes? Must I audit the code every single time I load the code? Because yes, I need to do that to ensure you havn't changed anything.

No. The whole point of what I've done and made is to make sure you don't have to do this. The Service Worker checks all code that is coming from the server. If you've opened Airborn OS before on a computer, and don't see a notification saying that Airborn OS has been updated, it is guaranteed that it's still the same code. If it did change, you get a notification with a nice link to GitHub, where you can inspect the commits since last time. That code is guaranteed to be identical to the new code that you will be running if you refresh Airborn OS.

Re: Show HN: Airborn – Private Google Docs Alternative

#144

Post by pbhjpbhj »

rpedela wrote: post #100
twiss wrote: post #31

Earlier quoted context omitted.

The most significant ways in which it's a bit like an OS are 1. It has a Window Manager (try it out in the demo, you can drag around windows and such) 2. It has a File System, which does encryption and compression. This makes it so that the "apps" (documents and presentations, and in the future hopefully spreadsheets) don't have to know anything about encryption. This made it very easy to port the presentations app,…

Why not Airborn Docs? I wouldn't worry about the misspelling either. Google is a misspelling, lots of music groups are misspelled words, etc.

Misspellings are usually on purpose to provide distinctiveness as a in built defence against a trademark being claimed to be a term in the art or a generic term.

I like the name, -born (i.e. conceived) on the air - i.e. in an ethereal space. As opposed to the suggestions for "Airborne" which would be carried on the air, the use of "born" is better as it suggests genesis.

Re: Show HN: Airborn – Private Google Docs Alternative

#145

Post by twiss »

pbhjpbhj wrote: post #144
rpedela wrote: post #100

Earlier quoted context omitted.

Why not Airborn Docs? I wouldn't worry about the misspelling either. Google is a misspelling, lots of music groups are misspelled words, etc.

Misspellings are usually on purpose to provide distinctiveness as a in built defence against a trademark being claimed to be a term in the art or a generic term. I like the name, -born (i.e. conceived) on the air - i.e. in an ethereal space. As opposed to the suggestions for "Airborne" which would be carried on the air, the use of "born" is better as it suggests genesis.

"Born in the air" is indeed why I named it that, after I got the idea from the book by Kenneth Oppel with the same name.

Re: Show HN: Airborn – Private Google Docs Alternative

#146

Post by EGreg »

twiss wrote: post #141
EGreg wrote: post #139

Earlier quoted context omitted.

That's interesting, but you're plugging holes in a waterfall I think. For example, that first visit which installs the service worker can already deliver bad code. Not saying you will do it, but it all relies on people trusting you not to do it. So statements like "we CAN'T read your stuff" are not true on the web. Luckily, most web users don't care about being hacked by the server - they care about owning their own…

> For example, that first visit which installs the service worker can already deliver bad code. Yes, but that is also the case when you install a desktop app. That's why Airborn OS is open source, so that you can inspect the code.

Agreed but with a desktop app, the author can sign it and the OS verifies that signature. Sadly the Web does no such thing with the top level document.

Re: Show HN: Airborn – Private Google Docs Alternative

#147

Post by jimktrains2 »

twiss wrote: post #143
jimktrains2 wrote: post #138

Earlier quoted context omitted.

> I don't have my GitHub password/keys on the server. Why would I have them there? Because you only need an SSH key to push to github and it's not uncommon for people to leave those laying around (or to forward them with a connection!) on a server. The better question is not "Why would you have them there?" but "How do I know you don't have them there?" > Yes, but it's trust-on-first-use. There's a big difference bet…

> And when this changes? Must I audit the code every single time I load the code? Because yes, I need to do that to ensure you havn't changed anything. No. The whole point of what I've done and made is to make sure you don't have to do this. The Service Worker checks all code that is coming from the server. If you've opened Airborn OS before on a computer, and don't see a notification saying that Airborn OS has been…

I'm glad you think that. I still don't trust you, nor do I trust that you will never be breached in such a way that a malicious update will be pushed. Everything you're saying still depends on me trusting you.

What if this is my first time loading? How do I know you're not serving up new files that don't contain checks to be visitors?

Moreover, are you insinuating that you will never update any code and that expect that pop up saying you've updated the code to never appear? Do you expect people to check commits multiple times a week or a day?

So, ok, let's assume you're 100% trustworthy and a malicious actor changes the code and I get an error. Am I now forever unable to access my documents? How can I be sure that the code I'm running is really the code on GitHub after a breach? How does the code prevent changes to the initial code loaded on a request? Which could in theory manipulate the Dom before the service worker could attempt to verify the page, if I'm understanding you correctly.

But again, this all assumes that your 100% trustworthy, and you're not. You're just some person asking me to believe you'll never ever make a mistake or be coerced into a malicious action.

Also I haven't seen a mention of the aes mode you're using. Your security pages is laughably shirt given that it's literally your main selling point.

Re: Show HN: Airborn – Private Google Docs Alternative

#148

Post by StanislavPetrov »

mark242 wrote: post #137
StanislavPetrov wrote: post #132

Earlier quoted context omitted.

The odds of a house fire and my inability to access critical data is significantly lower than that of a cloud malfunction like the one that occurred today. https://www.washingtonpost.com/news/the-switch/wp/2017/10/31...

How many users wound up losing data because of that bug? In comparison, how many houses were lost to fire today?

How many people had deadlines or papers due and couldn't access their data? Many more than couldn't hand in their papers or make their deadlines because of a house fire.

Re: Show HN: Airborn – Private Google Docs Alternative

#149

Post by Myrmornis »

carlisle_ wrote: post #9

I feel like "Even if we get hacked" as a marketing message might send the wrong signals.

Not sounding like marketing material is exactly what makes it sound trustworthy to intelligent people. I can only assume that's the current target audience.
Post reply on HN