Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Airborn – Private Google Docs Alternative

airbornos.com

Post reply on HN
Print view View original

201–210 of 218 posts

Re: Show HN: Airborn – Private Google Docs Alternative

#201

Post by z3t4 »

polskibus wrote: post #161
z3t4 wrote: post #32

Earlier quoted context omitted.

It's good to have if you want to go peer2peer eg. not having a server in between. Btw, Google Docs don't use a OT, or only a simple one, it does depend on the server and that you are online. A writing style that I try to use is that I just type ... don't look up words, just write YYY where I can't find the right word to use, then I read the text and fix all spelling errors, sentences, remove unnecessary parts etc. Th…

Do you have a source on Google docs not using OT? I remember reading Google's description of Google docs with a reference to seminal OT paper.

https://youtu.be/yCcWpzY8dIA?list=LL9RQYUX_WIjk8SAcyuarJEw About 25 minutes in. And it is called OT, so I stand corrected. It does require a server though. I was confusing it with CRDT.

Re: Show HN: Airborn – Private Google Docs Alternative

#202

Post by alexeldeib »

twiss wrote: post #110
woranl wrote: post #109

Earlier quoted context omitted.

Oh yes, as if it was an offline app when initiated. Interesting. You should really make this more broadly available and perhaps build service around it. If you can make it security sounded, then I’m sold. Perhaps, it solves the trust issue of JavaScript. For the fun of it, maybe throw in some blocktrain tech or something to enhance that trust model of yours. Would love to see how this gets developed.

> Perhaps, it solves the trust issue of JavaScript. Yes, that is the intention :) > For the fun of it, maybe throw in some blocktrain tech or something to enhance that trust model of yours. Instead of using GitHub as a public log, it's possible to use a publicly verifiable cryptographic log: https://wiki.mozilla.org/Security/Binary_Transparency That would move the trust from GitHub to that public log. However, GitHub…

This is a really interesting train of thought that I wasn't familiar with. Thanks for pointing out Binary Transparency, and I'll be eager to see where your product goes!

Re: Show HN: Airborn – Private Google Docs Alternative

#203

Post by jimktrains2 »

twiss wrote: post #193
jimktrains2 wrote: post #188

Earlier quoted context omitted.

You're assuming the old version of the service worker will be there and running. That isn't a good assumption. It will normally be there, but it doesn't have to be. There will always be circumstances where I'm downloading it for the first time, even in the same browser and computer. Also, step 7 on https://w3c.github.io/ServiceWorker/#update-algorithm says that updating the service worker bypasses the service worker.…

That's blocked on https://github.com/w3c/ServiceWorker/issues/1208 . However, there's also an alternative option to make updating the Service Worker unnecessary, by making a "stub" Service Worker which downloads, validates and executes the rest of the SW code. Then, whenever the "stub" Service Worker updates, it's likely a breach and we can warn the user accordingly.

Code you can't update is normally an expensive liability in the case that it's not perfect. Also, then the stub service worker is subject to the same problem it's attempting to solve.

I'm still left in a situation where I need to trust you don't mess up.

You even say it yourself:

> (Of course, we can't prevent the update, but we can at least try to convince the user to close the web app before it steals their private keys.)

At that point, the game is up.

Re: Show HN: Airborn – Private Google Docs Alternative

#204

Post by jimktrains2 »

woranl wrote: post #199
jimktrains2 wrote: post #191

Earlier quoted context omitted.

> Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Unless this is an extremely rare event, a hacker could easily just piggy back on a recent change and inject a worker that does not alert on "updatefound".

I have a hard time understanding your criticism. How is what you described easy? Care to explain?

If the service is hacked and if the "update found" alert isn't a very rare event, users will not validate every single update against GitHub, and a place check would see an update, allowing the attacker to push code when an update is made. A good portion of users will run the infected code before the service is shutdown.

I never said it was easy. I said it was possible and doable.

Re: Show HN: Airborn – Private Google Docs Alternative

#205

Post by fiatjaf »

2474 wrote: post #154
fiatjaf wrote: post #42

Earlier quoted context omitted.

Your current copy tells something very real and concrete to the user, gives him valid information. It is useful. All suggestions in this thread ("it is secure!") are just marketing gibberish, slogans without any meaning. If you intend to appeal to a large, stupid audience, maybe they're good, but it is a little dishonest.

While you are right, it wouldn't be that great of an idea for Honda to market their new airbags by saying "Next time you get into that accident, at least your face won't be smashed into a million pieces by your wind shield!". While what he has is fine, you can convey the same sentiment without saying "Even if we get hacked..."

Ok, but you don't have to say evasive things like "Honda airbags adds the safeness of air to your driving".

Re: Show HN: Airborn – Private Google Docs Alternative

#207

Post by gatmne »

twiss wrote: post #93
gatmne wrote: post #86

Looks really slick! You should consider adding word support. Support for office XML formats[1] are simple enough to hand-roll. [1]: https://en.wikipedia.org/wiki/Microsoft_Office_XML_formats

What extent of docx support is important, do you feel? Is just importing docx to html (the native format) sufficient, or should they stay as docx while editing? Should it be possible to export from html to docx?

As an end user, I don't care what format Airborn uses internally. What matters is that I can interact with documents and files sent to me by other people, which are likely authored using Microsoft Office, Libreoffice, and Google docs.

As a developer, I would ideally recommend to look into using a custom internal representation for a document and developing converters that convert between your representation and various formats. This way you won't be hindered by limitations of a specific format.

However, if you lack the resources to develop and maintain these converters yourself, look into the feasibility of leveraging LibreOffice by using a preexisting format like WordProcessingML as an internal format. You can then use LibreOffice to handle the conversion between the various formats you want to support. The downside to this is that you'll eventually outgrow WordProcessingML if you want to support futures not supported by that specific format.

Re: Show HN: Airborn – Private Google Docs Alternative

#209

Post by arantius »

twiss wrote: post #24
tylerhou wrote: post #14

Earlier quoted context omitted.

Just curious (and no negative implications whatsoever): is "we made it so that only one person at a time can type in a paragraph. No longer can that annoying classmate delete what you just typed" code for "operational transforms are hard to implement, especially without a source of truth?"

Yes and no :) I did indeed not implement OT, but it's also a true story that I would create a Google Doc and share it, nobody knows what to write, I type a sentence, and my classmates delete it as a joke, to mess with me :) But yeah, feedback on the collaboration is welcome. Do you think editing one sentence with multiple people is necessary, and if so why? And on the other end of the spectrum, Word-style edit reques…

This is an immediate non-starter for me.

I have had plenty of real-world situations, with Google Docs, whereby I have fixed someone else's spelling (or vice versa) as they have been typing. Working on sheets/slides where this isn't available has always felt awkward in comparison, and I wouldn't look to get more of it.

Re: Show HN: Airborn – Private Google Docs Alternative

#210

Post by woranl »

jimktrains2 wrote: post #204
woranl wrote: post #199

Earlier quoted context omitted.

I have a hard time understanding your criticism. How is what you described easy? Care to explain?

If the service is hacked and if the "update found" alert isn't a very rare event, users will not validate every single update against GitHub, and a place check would see an update, allowing the attacker to push code when an update is made. A good portion of users will run the infected code before the service is shutdown. I never said it was easy. I said it was possible and doable.

First, you said “easily”, so I thought it must be effortless. Second, only paranoids and security conscious individuals will ever validate against GitHub. Your average Joe really doesn’t care. I do however agree with you that security must be hardened as much as possible, but your hypothetical case is weak. It will work for any software that auto update. Browser? OS? Let me give you another one, what if a satellite flies over your head and capture your password as you type? Oh and how about your CPU? Should we start making our own hardware now? You know.. can’t trust anyone after all.
Post reply on HN