Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I made a free, ad-free and open source tool for sharing private notes

burnernote.com

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#51

Post by gigamick »

jinseokim wrote: post #25

First of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix these): 0. This has XSS vulnerability. If attacker writes down this memo: do_the_evil_things() and passes to people, they might be unknowingly attacked(get tracked by attacker their IP/Browser fingerprint, mine cryptocurrencies for attacker, etc..…

XSS resolved but happy for you to tell me if it is or isn't!

Appreciate the feedback!

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#52

Post by slowmotiony »

gigamick wrote: post #35
snerbles wrote: post #18

Earlier quoted context omitted.

Can confirm this happens with Matrix/Element. Amusingly, the brief contents of the note are visible in the preview along with "This note has now been permanently deleted".

haha ok this is something I will remedy. As stated in other replies, the reason for posting here was to get feedback and improve the product (I just put to together over the weekend there)

Hello, the way that privnote deals with it is by showing a page asking "Do you want to read this note and burn it?". That will solve the issue of preview apps expiring your notes.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#53

Post by gigamick »

jmkd wrote: post #43

Issue: Forward and back buttons allow the note to persist (at least visually). Impact: Someone reads a private note on a shared computer, how long will it remain visible in history? Browser: Chrome 95

Excellent observation. Thank you!

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#54

Post by yessirwhatever »

durch wrote: post #39

Very zeitgeisty :), I've created something similar a while ago ( https://tmp.page ), the idea was to have expiring web pages, with a nice API. Our FEs are quite similar, yours is nicer tough :).

ITM citizen!

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#55

Post by teitoklien »

gigamick wrote: post #31
28uwedj wrote: post #22

DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.

This is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.

Your laravel php framework debug messages are being exposed to users.

Cool site tho, Have a lovely week.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#56

Post by jrexilius »

rakoo wrote: post #49

From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything. There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now ( https://zerobin.net/ ). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has ha…

Thanks for the pointer! Zerobin (PrivateBin) seems a much better implementation.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#57

Post by gigamick »

rakoo wrote: post #49

From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything. There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now ( https://zerobin.net/ ). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has ha…

This is awesome feedback and client side encryption is 100% on its way. I just put this together over the weekend and then put around places like this for feedback.

Client side is coming.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#58

Post by gigamick »

jrexilius wrote: post #56
rakoo wrote: post #49

From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything. There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now ( https://zerobin.net/ ). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has ha…

Thanks for the pointer! Zerobin (PrivateBin) seems a much better implementation.

Zerobin certainly is cool but for me the UI is really dated looking and in my opinion not at all minimalist.

I have client side encryption coming to Burnernote very soon.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#60

Post by annoyingnoob »

joemazerino wrote: post #7
annoyingnoob wrote: post #3

Earlier quoted context omitted.

If its really all open source, the way you know is to roll your own.

If your threat model is the service roll your own. Otherwise, trust but verify.

In this case, verify how? Ask and trust the answer?
Post reply on HN