Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ntfy.sh – Send push notifications to your phone via PUT/POST

ntfy.sh

Post reply on HN
Print view View original

151–160 of 306 posts

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#151

Post by pastage »

Ajedi32 wrote: post #139
EGreg wrote: post #87

Earlier quoted context omitted.

Why not end to end encrypt notifications with a public key? Both iOS and Android can run a completionHandler to decrypt them using a private key that can be stolen if the app is disassembled. But you can generate a private key per user, after install, and each mailbox publisjes a public key. The thing I find ironic is that the actual encryption is done in JS, which is served by a webserver so anyway you have to trust…

Ultimately there's no way around having the trust the client. The state of the art on that front right now is open source code with reproducible builds[1] and binary transparency[2]. Unfortunately none of that is currently implementable on the web for the reason you cited; the web server can just replace the entire application with any code it wants when you refresh the page. One possible path to fixing that is web p…

You can enable content security policy then hash all the javascripts and assets so only prebuilt and hashed stuff is allowed to be loaded in the web browser. There is no way to easily check that some one you trust did the hashing, but it is doable with an extension in the web browser.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#152

Post by jacooper »

methyl wrote: post #106
jacooper wrote: post #97

Earlier quoted context omitted.

If you would like to lower the cost more, I think switching to a cheaper cloud service like Linode or Hetzner would be the way to go.

I'm not sure if it's worth going any lower than $24/month

I mean from 24 to 10 is a big difference.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#153

Post by hamburglar »

Bluecobra wrote: post #111
methyl wrote: post #106

Earlier quoted context omitted.

I'm not sure if it's worth going any lower than $24/month

If I were to run my own personal instance of this that cost would be quite high. A free Oracle Cloud VM or $5 Digital Ocean droplet would be the way I go.

Well, of course. “$24 per month seems high for running my own personal instance that’s going to do a handful of notifications daily” vs “$24 per month seems high for running a public service that could very easily need to be scaled up quickly” are two very different statements.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#154

Post by webmobdev »

timtom39 wrote: post #120
webmobdev wrote: post #102

Earlier quoted context omitted.

You can probably cut down server cost by half. Have you tried with lower resources or have figured out a minimum requirement for the server? As an experiment I suggest - https://tinykvm.com/ - with FreeBSD or OpenBSD (Linux doesn't really do well with small amount of RAM).

Just gave the developer $50 so he doesn't need to reduce monthly costs. I like the service running well.

That is nice of you and you've helped them to cover server costs for the next two months. Server optimisations can help them reduce the cost further.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#155

Post by hamburglar »

binwiederhier wrote: post #51
CommitSyn wrote: post #40

Earlier quoted context omitted.

Neat project. Where does the funding come from?

It's quite cheap to run. It's just one small EC2 instance, and it's usually idling around a load average of 0.1 (though right now it's at 1, hehe). It costs me about $24/month. The Apple developer license costs $100 per year, so it's ~$400/year. As of recently, that's entirely covered by donations. I am incredibly humbled by the sponsorships. I would have never thought ntfy would take off like that. I love open sourc…

This is super cool. If you don’t mind saying, how many connections do you tend to keep open at steady state?

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#156

Post by Ajedi32 »

pastage wrote: post #151
Ajedi32 wrote: post #139

Earlier quoted context omitted.

Ultimately there's no way around having the trust the client. The state of the art on that front right now is open source code with reproducible builds[1] and binary transparency[2]. Unfortunately none of that is currently implementable on the web for the reason you cited; the web server can just replace the entire application with any code it wants when you refresh the page. One possible path to fixing that is web p…

You can enable content security policy then hash all the javascripts and assets so only prebuilt and hashed stuff is allowed to be loaded in the web browser. There is no way to easily check that some one you trust did the hashing, but it is doable with an extension in the web browser.

"Enable content security policy" is something done by the web server (via a header in the response), so that doesn't solve the problem.

In theory yes, you could probably create an extension that leverages Content Security Policy as a means of enforcing binary transparency. But at that point you'd basically just be implementing a slightly worse version of web packaging via an extension.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#157

Post by krn »

horsawlarway wrote: post #146
krn wrote: post #81

Earlier quoted context omitted.

> Are you working out the details on recovery and storage, handling lost devices, configuring a communication channel for sharing certs/keys, managing several crypto dependencies and libraries - all so that you can go "Hey - what's up!" in a notification to your phone? In 2022, there is no need to invent anything new about E2E encryption. There are many successful open-source examples, including Keybase and Firefox S…

>This is Hacker News, a discussion platform, and I am raising a question about software development in general. No - no you aren't. You're complaining about a feature in a product you've admitted you won't use. Which... is fine. At the end of the day - the feedback might be helpful or it might not, part of the journey of publishing software (or making anything, really) is figuring out what advice to listen to, and wh…

> But personally - I don't really find your point sensible. You have no use-case, you have no threat model [...]

My point is very clear and simple: all private communication on the internet should be E2E encrypted by default, unless there is a good reason not to.

> [...] say "if they are doing it, it must be easy" - Ignoring that they are literally using the difficulty of doing it as the distinguishing factor for their product.

I am not claiming that it's easy, but there has been plenty of open-source projects launched with E2E encryption by default in the past few years.

https://standardnotes.com/ is a good example.

https://stingle.org/ is another.

https://ente.io/ is one more.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#158

Post by duxup »

krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Is that really much different than anything else other than an faq?

No promises so they could be selling your info more than anyone else…

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#159

Post by binwiederhier »

SuperSandro2000 wrote: post #129

This needs account syncing from the backend. You need to describe to every topic in every browser/app/device you use and message deletions are not synced.

Indeed it does. That is the most requested feature after E2E encryption and publishing messages from the app itself. See https://github.com/binwiederhier/ntfy/issues/159 and +1 it if you want it too.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#160

Post by binwiederhier »

duxup wrote: post #158
krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Is that really much different than anything else other than an faq? No promises so they could be selling your info more than anyone else…

I am absolutely making promises. See the privacy policy: https://ntfy.sh/docs/privacy/

> I love free software, and I'm doing this because it's fun. I have no bad intentions, and I will never monetize or sell your information, and this service and software will always stay free and open.

If you're still paranoid (which is your right), go host it yourself, or wait until I finished implementing E2E :-D

Post reply on HN