I have no idea what Vesper is and after looking at the website, I still have no idea.
Vesper is a simple, elegant notes app for the iPhone.
Strange that there is no "Rate this app" popup in the app...
Vesper 2.0 and Vesper Sync
11–20 of 52 posts
Re: Vesper 2.0 and Vesper Sync
#12Re: Vesper 2.0 and Vesper Sync
#13Re: Vesper 2.0 and Vesper Sync
#14Is there a way to export notes from the sync server to an open format? I don't currently use Vesper, but lack of such functionality would be a dealbreaker for me.
There is not, but it is on our list. We will get to it eventually, but it didn't make the cut for 2.0.
Re: Vesper 2.0 and Vesper Sync
#15Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like.
I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices.
It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling your own makes it two problems instead of one.
Care to share your reasoning? Thanks!
Re: Vesper 2.0 and Vesper Sync
#16Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…
You are as weak as the weakest link in your system.
The more you rely on 3rd party services the more likely you're going to be burned by them.
If you have sync under your control, you can guarantee a certain level of user experience.
Is it more work? Definitely. Is it worth it? It depends on what your priorities are.
Re: Vesper 2.0 and Vesper Sync
#17I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error.
My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement would be better if it said which one they used.
"Salted hashes" have been obsoleted, and are quickly attackable.
It is possible to build an app like Vesper and not have it be straightforward to be compelled by the authorities to build surveillance into it; with native clients as the only clients, some straightforward cryptography would get them there. I'd hope they'd at some point be interested in talking to cryptographers about how to do that right. But like I said, in the absence of sound cryptography, candor is a great substitute.
There's no OS X app for this yet, is there? I'd use it for personal stuff if there was.
Re: Vesper 2.0 and Vesper Sync
#18Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…
You might be interested in one of the team's writings on the subject: http://inessential.com/vespersyncdiary
There is a deep dive on the granularity of syncing that hints at why they aren't doing Dropbox file-level syncing: http://inessential.com/2013/11/05/vesper_sync_diary_3_immuta...
Re: Vesper 2.0 and Vesper Sync
#19Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…
You are as weak as the weakest link in your system. The more you rely on 3rd party services the more likely you're going to be burned by them. If you have sync under your control, you can guarantee a certain level of user experience. Is it more work? Definitely. Is it worth it? It depends on what your priorities are.
You have this the wrong way around.
If you roll your own sync service, then you become the weak link in the user's system. Given how much effort it takes to get this stuff right and to maintain the service, it is irresponsible to do it yourself unless there are features you cannot otherwise deliver.
It's far better from the user's perspective for developers to use Dropbox or even iCloud, because the chances of them abandoning or losing user data, or simply failing as a business, are much slimmer than those of an app developer selected at random.
Re: Vesper 2.0 and Vesper Sync
#20I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…
We hash the password using pbkdf2. The actual code looks like this:
crypto.pbkdf2(text, salt, ITERATIONS, BYTES, function...
ITERATIONS is 1000, and BYTES is 32.
Our code is descended from the code on this page: http://www.thejoyofcode.com/Exploring_custom_identity_in_Mob...