Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Airborn – Private Google Docs Alternative

airbornos.com

Post reply on HN
Print view View original

191–200 of 218 posts

Re: Show HN: Airborn – Private Google Docs Alternative

#191

Post by jimktrains2 »

twiss wrote: post #84
woranl wrote: post #83

Earlier quoted context omitted.

Can service worker’s code ever be updated by the hacker? How does this actually work?

Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Of course, it would be better to only warn the user if the Service Worker changes if it doesn't match the version on GitHub, but that's blocked on [3]. Furthermore, there are some very edge-case…

> Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2].

Unless this is an extremely rare event, a hacker could easily just piggy back on a recent change and inject a worker that does not alert on "updatefound".

Re: Show HN: Airborn – Private Google Docs Alternative

#192

Post by jimktrains2 »

twiss wrote: post #152
EGreg wrote: post #146

Earlier quoted context omitted.

Agreed but with a desktop app, the author can sign it and the OS verifies that signature. Sadly the Web does no such thing with the top level document.

Yes, that's true, but the author (or intermediary-who-delivers-the-binary) can also.. not sign it (deliver an unsigned version). Often, you don't have many other options than to trust the binary the website is serving you.

It also happens far less frequently and I can do it at my leisure, or even just compile it on my own.

Re: Show HN: Airborn – Private Google Docs Alternative

#193

Post by twiss »

jimktrains2 wrote: post #188
twiss wrote: post #151

Earlier quoted context omitted.

> What if this is my first time loading? Like I said, it's trust-on-first-use. This is no different from installing a desktop app. > How do I know you're not serving up new files that don't contain checks to be visitors? The Service Worker is installed on your own computer, and is still there the next time you open the web app. > How does the code prevent changes to the initial code loaded on a request? Which could i…

You're assuming the old version of the service worker will be there and running. That isn't a good assumption. It will normally be there, but it doesn't have to be. There will always be circumstances where I'm downloading it for the first time, even in the same browser and computer. Also, step 7 on https://w3c.github.io/ServiceWorker/#update-algorithm says that updating the service worker bypasses the service worker.…

That's blocked on https://github.com/w3c/ServiceWorker/issues/1208. However, there's also an alternative option to make updating the Service Worker unnecessary, by making a "stub" Service Worker which downloads, validates and executes the rest of the SW code. Then, whenever the "stub" Service Worker updates, it's likely a breach and we can warn the user accordingly.

Re: Show HN: Airborn – Private Google Docs Alternative

#194

Post by johnlbevan2 »

twiss wrote: post #52
Filligree wrote: post #44

Earlier quoted context omitted.

My main use case for Docs is collaborative fiction writing. There's no concept of "paragraph ownership"; there will be two or more people editing the document, and we'll go over it a half-doze or more times, editing as we go. The ability to make arbitrary changes is essential for this.

There's no permanent paragraph ownership in Airborn OS either, but it's locked for about 10 seconds when you edit a paragraph. Or are you saying that the two editors would be editing the same paragraph at the same time?

Sounds really pragmatic. Two people editing exactly the same thing at the same time sounds confusing; not just really hard to implement. i.e. Why would anyone want someone amending as they type. This approach makes the user experience simpler and simplifies the implementation. I like it :).

The only scenario where I can see this being a bad decision would be for bots. For example, if you had a spell checker loaded which ran as a separate user rather than under your own session; so the spell checker couldn't auto-correct words until you'd finished typing the sentence. Here I'm imagining something like Rosie the translator bot from the original Google Wave demo... But I don't think you have bots anyway, so this won't be a concern for the present anyway.

Re: Show HN: Airborn – Private Google Docs Alternative

#195

Post by teddyh »

Myrmornis wrote: post #149
carlisle_ wrote: post #9

I feel like "Even if we get hacked" as a marketing message might send the wrong signals.

Not sounding like marketing material is exactly what makes it sound trustworthy to intelligent people. I can only assume that's the current target audience.

Intelligent people are too few and decentralized to ever be the target audience of a successful company.

Re: Show HN: Airborn – Private Google Docs Alternative

#196

Post by notyourday »

twiss wrote: post #61
sfotm wrote: post #49

Earlier quoted context omitted.

Any plans to make self-hosting straight-forward? Granted, I haven't spent much time looking for it, but I've been looking for something similar to this for quite some time, and Nextcloud's Collabora isn't quite what I'm looking for.

Not really, because of https://news.ycombinator.com/edit?id=15596604 . Why would you like to self-host? (Not implying that there are no valid reasons, just curious which reasons are important to you.)

Because if I'm going to bet on someone other than Google keeping my crap secure and accessible, I'm going to be betting on myself, not on some fly by night entity with a very limited runway.

Re: Show HN: Airborn – Private Google Docs Alternative

#198

Post by freeone3000 »

twiss wrote: post #61
sfotm wrote: post #49

Earlier quoted context omitted.

Any plans to make self-hosting straight-forward? Granted, I haven't spent much time looking for it, but I've been looking for something similar to this for quite some time, and Nextcloud's Collabora isn't quite what I'm looking for.

Not really, because of https://news.ycombinator.com/edit?id=15596604 . Why would you like to self-host? (Not implying that there are no valid reasons, just curious which reasons are important to you.)

Google locked me out of my documents. I have more trust in Google to provide a service than you. If Google does not reliably provide the service, I'm moving the service on-prem.

Re: Show HN: Airborn – Private Google Docs Alternative

#199

Post by woranl »

jimktrains2 wrote: post #191
twiss wrote: post #84

Earlier quoted context omitted.

Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Of course, it would be better to only warn the user if the Service Worker changes if it doesn't match the version on GitHub, but that's blocked on [3]. Furthermore, there are some very edge-case…

> Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Unless this is an extremely rare event, a hacker could easily just piggy back on a recent change and inject a worker that does not alert on "updatefound".

I have a hard time understanding your criticism. How is what you described easy? Care to explain?

Re: Show HN: Airborn – Private Google Docs Alternative

#200

Post by aagha »

amenghra wrote: post #3

Good timing with Google incorrectly flagging some Docs as abusive? ( https://motherboard.vice.com/en_us/article/zmz3yw/why-is-my-... )

The worst part is that there seems to be little to no recourse. Unless your a GSuite user, you have no support number to call and have to wait until the issue resolves itself. If it does.
Post reply on HN