Live data from Hacker News

Vesper 2.0 and Vesper Sync

vesperapp.co

21–30 of 52 posts

Re: Vesper 2.0 and Vesper Sync

#21
post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

No OS X version yet, but it's what they're working on next according to the last part of http://vesperapp.co/blog/vesper-2-0-and-vesper-sync/

Re: Vesper 2.0 and Vesper Sync

#22
post #19
post #16

Earlier quoted context omitted.

You are as weak as the weakest link in your system. The more you rely on 3rd party services the more likely you're going to be burned by them. If you have sync under your control, you can guarantee a certain level of user experience. Is it more work? Definitely. Is it worth it? It depends on what your priorities are.

You have this the wrong way around. If you roll your own sync service, then you become the weak link in the user's system. Given how much effort it takes to get this stuff right and to maintain the service, it is irresponsible to do it yourself unless there are features you cannot otherwise deliver. It's far better from the user's perspective for developers to use Dropbox or even iCloud, because the chances of them a…

If you've never heard of the horror stories, I invite you to read up on that. It's not about the company going out of business, it's about having issues with a "black box" that you can't possibly debug or fix.

The things you don't have control over will end up breaking your promise to the user.

http://www.theverge.com/2013/3/26/4148628/why-doesnt-icloud-...

http://arstechnica.com/apple/2013/03/frustrated-with-icloud-...

Re: Vesper 2.0 and Vesper Sync

#23
post #15

Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…

As the other posters have remarked, Brent's sync diary provides some of the concrete technical reasons why we rolled our own.

Big picture, though, we consider sync so essential to Vesper's long-term success that we wanted to control it. Dropbox is fantastic. We all rely on it personally. But we don't want Vesper to rely on it. I'm sure everyone here on Hacker News has a Dropbox account, and I'll bet most Daring Fireball readers do too. But we want Vesper to appeal to everyone, including people who don't know what Dropbox is or don't want it. (Plus, Dropbox doesn't work exactly the way we want it to work; we have code running on our servers, not just data stored on them. Vesper Sync works exactly the way we want sync to work.)

iCloud is very tempting too, because it puts all the onus of identity, privacy, and security on Apple's shoulders. But with iCloud, you have to choose between document syncing and Core Data -- neither of which is a perfect fit for the way Vesper is designed.

Lastly, we want to keep the door open for a web app version of Vesper, and a non-Mac App Store version for OS X. iCloud, by design, only works for apps distributed through the App Store.

We wanted to offer one and only one good way to sync. That meant rolling our own.

Re: Vesper 2.0 and Vesper Sync

#25
post #22
post #19

Earlier quoted context omitted.

You have this the wrong way around. If you roll your own sync service, then you become the weak link in the user's system. Given how much effort it takes to get this stuff right and to maintain the service, it is irresponsible to do it yourself unless there are features you cannot otherwise deliver. It's far better from the user's perspective for developers to use Dropbox or even iCloud, because the chances of them a…

If you've never heard of the horror stories, I invite you to read up on that. It's not about the company going out of business, it's about having issues with a "black box" that you can't possibly debug or fix. The things you don't have control over will end up breaking your promise to the user. http://www.theverge.com/2013/3/26/4148628/why-doesnt-icloud-... http://arstechnica.com/apple/2013/03/frustrated-with-icloud-…

This isn't about trying to defend iCloud's teething problems, so these links are irrelevant.

Yes, there are risks associated with using a 3rd party service. However if you don't use one, you are claiming that you can do better in architecture, implementation, and DevOps.

How many apps do you have? Let's say you have 30.

What percentage of the developers of these apps do you think will do a better job of sync than Dropbox or Apple?

Unless you think that number is in the high 90's, then your advice is a severe disservice to end users.

Re: Vesper 2.0 and Vesper Sync

#26
post #23
post #15

Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…

As the other posters have remarked, Brent's sync diary provides some of the concrete technical reasons why we rolled our own. Big picture, though, we consider sync so essential to Vesper's long-term success that we wanted to control it. Dropbox is fantastic. We all rely on it personally. But we don't want Vesper to rely on it. I'm sure everyone here on Hacker News has a Dropbox account, and I'll bet most Daring Fireb…

In other words, you agree that iCloud's attempt at vendor lock-in is bad for developers and consumers alike.

Re: Vesper 2.0 and Vesper Sync

#27
post #23
post #15

Genuinely interested in why you guys decided to roll your own cloud sync service instead of using something like dropbox or the like. I recently started using YNAB (youneedabudget.com) for OSX and iPhone, and one of the things I liked the most is how they used dropbox to sync flawlessly between devices. It's probably hard enough doing sync right even with the help of dropbox API, but it just seems to me that rolling…

As the other posters have remarked, Brent's sync diary provides some of the concrete technical reasons why we rolled our own. Big picture, though, we consider sync so essential to Vesper's long-term success that we wanted to control it. Dropbox is fantastic. We all rely on it personally. But we don't want Vesper to rely on it. I'm sure everyone here on Hacker News has a Dropbox account, and I'll bet most Daring Fireb…

That makes a lot of sense.

What I was thinking about was just how many times I gave up on an app because it made me "sign up" for something just to create simple documents, play a game (sometimes even ones that should work offline!), or take notes.

But, obviously, in your case it seems having more control clearly outweights these small problem-user cases. ;)

Congrats on shipping, good luck!

EDIT: Also, making syncing optional, as I just read you saying you would, makes this problem go away.

Re: Vesper 2.0 and Vesper Sync

#29
post #20
post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

We hash the password using pbkdf2. The actual code looks like this: crypto.pbkdf2(text, salt, ITERATIONS, BYTES, function... ITERATIONS is 1000, and BYTES is 32. Our code is descended from the code on this page: http://www.thejoyofcode.com/Exploring_custom_identity_in_Mob...

That's great; it's the answer I quietly predicted I'd get. If you're communicating to laypeople, you can say something like "we use a modern secure password hash".

Re: Vesper 2.0 and Vesper Sync

#30
post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

> There's no OS X app for this yet, is there? I'd use it for personal stuff if there was.

I haven't fully committed to Vesper b/c it lacks a desktop client. I'm glad it is on the horizon. Now I'm hoping this client will somewhat resemble NVAlt (Notational Velocity).

Post reply on HN