Show HN: I made a free, ad-free and open source tool for sharing private notes
1–10 of 80 posts
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#2Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#3Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
If its really all open source, the way you know is to roll your own.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#4Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
> what guarantee do we have that the source code matches the deployed code?
What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#5Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
I don't know that there is an answer, but I'd think the FAQ should at least mention the concern.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#6FYI if I post 1MB of data it explodes and dumps a full stack trace. May not be something you want exposed.
SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'note' at row 1 (SQL: insert into `notes` (`note`, `password`, `user_id`, `token`, `updated_at`, `created_at`) values ...SNIP...Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#7Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
If its really all open source, the way you know is to roll your own.
If your threat model is the service roll your own. Otherwise, trust but verify.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#8I just want to say @gigamick these burn systems are powerful.
You might get divorced some day. You might have a business partner subpoena your old gmail account. ALL those emails/texts will be turned over, ALL those emails/texts will get leaked. Use something like this! Make the message burn after reading.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#9AES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a quick scan of the code[1] to determine whether it does that, but I couldn't locate it, possibly because my PHP comprehension is terrible.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#10Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
For an app that exists solely on the client it’s easy to provide a md5 hash that can be verified.
This was and still is a popular solution if you torrent to make sure you’re getting what the original seeder intended. The same philosophy applies here.
For back end apps it’s inherently not possible.