Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wealthfolio: Private, open-source investment tracker

wealthfolio.app

Post reply on HN
Print view View original

11–20 of 281 posts

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#11

Post by jxf »

TexanFeller wrote: post #9

"Local Data Storage. No Subscriptions, No Cloud" This is what we need more often from our software, especially from software that works with sensitive data. I do typically want sync options though since I tend to use several different devices and it sucks not being able to reference information on the go from my phone. Sync options can include locally/self hosted options or use something like iCloud that don't depend…

> Sync options can include locally/self hosted options or use something like iCloud that don't depend on a software vendor's running a service though.

Don't most sync options depend on a software vendor running a service? (Your VPS hosting company, your SaaS handling cross-device syncing, your cloud provider, et cetera.)

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#15

Post by progforlyfe »

diggan wrote: post #5

First question from reading through the landing page is about this part: > Import your statements from your broker or bank. Exactly what brokers/banks that are supported should be listed somewhere and linked here, as that's a "make or break" feature for a lot of people I bet. Not much point in replacing my homegrown "Banks CSV export -> Data processing > Import into spreadsheet" workflow unless I just replace that la…

That's what I was wondering. It's a ton of work, but would love the auto importing / screen scraping features that Mint.com had. For a local desktop tool it even has the potential to support every possible service because they can't do IP blocking on end-users (versus the server-to-server model that Mint.com had, caused many services to IP block Mint's servers).

Unfortunately, depending on an open-source tool to do this is a double edged sword if it had these features, because we would be opening the risk of supply-chain attacks -- malicious actors getting commits into the repository code which cause the program to send your data elsewhere -- or worse, deplete accounts' funds.

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#16

Post by mr_mitm »

TexanFeller wrote: post #9

"Local Data Storage. No Subscriptions, No Cloud" This is what we need more often from our software, especially from software that works with sensitive data. I do typically want sync options though since I tend to use several different devices and it sucks not being able to reference information on the go from my phone. Sync options can include locally/self hosted options or use something like iCloud that don't depend…

If I can specify the data location, I could just use syncthing or dropbox or whatever. Syncing directories is mostly a solved problem.

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#17

Post by picardo »

TexanFeller wrote: post #9

"Local Data Storage. No Subscriptions, No Cloud" This is what we need more often from our software, especially from software that works with sensitive data. I do typically want sync options though since I tend to use several different devices and it sucks not being able to reference information on the go from my phone. Sync options can include locally/self hosted options or use something like iCloud that don't depend…

> This is what we need more often from our software, especially from software that works with sensitive data.

Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions. All sensitive data stored in local storage must be encrypted using a key stored in the server or somewhere on your hard disk. Otherwise, you're not reducing your risk, but substituting one type of information disclosure vulnerability with another.

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#20

Post by diggan »

progforlyfe wrote: post #15
diggan wrote: post #5

First question from reading through the landing page is about this part: > Import your statements from your broker or bank. Exactly what brokers/banks that are supported should be listed somewhere and linked here, as that's a "make or break" feature for a lot of people I bet. Not much point in replacing my homegrown "Banks CSV export -> Data processing > Import into spreadsheet" workflow unless I just replace that la…

That's what I was wondering. It's a ton of work, but would love the auto importing / screen scraping features that Mint.com had. For a local desktop tool it even has the potential to support every possible service because they can't do IP blocking on end-users (versus the server-to-server model that Mint.com had, caused many services to IP block Mint's servers). Unfortunately, depending on an open-source tool to do t…

> but would love the auto importing / screen scraping features that Mint.com had

I never used it, but didn't that ask you for the username/password in order to do its job? If so, I wouldn't touch it with a ten-foot pole.

> cause the program to send your data elsewhere -- or worse, deplete accounts' funds.

Again, seemingly because their shitty architecture would that even be possible.

There are modern (possibly only European?) standards nowadays that forces the banks to expose proper APIs for doing things like that. Would require a business entity to deploy to production (I think that's one of the requirements?) but otherwise wouldn't be a huge task compared to manually scraping stuff.

Post reply on HN