Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Textdb.dev – simple data sharing for fun projects

textdb.dev

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#41

Post by _jal »

TedDoesntTalk wrote: post #30
bontaq wrote: post #27

Earlier quoted context omitted.

That's a cool idea, I'd definitely like to add the ability to create a little store with more safety, and that totally works with the goal of simplicity. I'll give it a shot.

It's a cool idea, but the old anti-pattern about security through obscurity applies.

People get this wrong a lot.

Security only through obscurity is no security at all. The argument was generally made in the context of secret, proprietary encryption algorithms. In this context, it was frequently true - security reduced to reverse engineering.

But security isn't a thing. It is a property of a system. And many secure systems strategically employ obscurity for multiple purposes.

Reciting a mantra is a poor substitute for carefully considering your problem domain.

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#42

Post by nickjj »

bontaq wrote: post #2

Made because I couldn't find a simple, no-sign-up service to sync a list of names for a command line tool. And resubmitted because yesterday I goofed and the curl commands listed didn't point to the right location, which really took the fun out of it. Favorite part of the project: trying out Phoenix's built in pub sub + live view (the live view subscribes to a data/:id topic, which the api write endpoint publishes to…

Hey, if you ever wanted to come on my podcast to talk about your tech stack (how it was developed, deployed, lessons learned, etc.) I'd love to have you on.

There's a few Phoenix episodes out currently, but none are using Live View yet. It would be really fun to talk about how someone is using it in production.

If you do, head over to https://runninginproduction.com/ and click the "become a guest" button on the top right to get the ball rolling.

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#44

Post by StavrosK »

josefrichter wrote: post #8

Whoever made this, I love you. I do a lot of prototyping in Framer, and this just make simple prototypes that communicate with one another hell of a lot easier!

You may also like this super simple MQ I wrote a while ago:

https://www.stavros.io/posts/messaging-for-your-things/

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#45

Post by gregmac »

bart__ wrote: post #37
TedDoesntTalk wrote: post #30

Earlier quoted context omitted.

It's a cool idea, but the old anti-pattern about security through obscurity applies.

I never really understood this argument, obscurity add an obvious layer of protection, not impenetrable of course, but still valid. Why is this different than an API key for example?

If compromised, you can change an API key. The key is like a password, and keeping that secret is important.

Where the "obscurity" aspect comes in, as an example, can be through the mechanism used to generate and validate that key.

Let's say you decide you don't want to or can't store the keys, and don't want a full pki system (public/private keys or certificates), so go with: sha256(clientid + userid + "hardcoded secret"). Your security now 100% relies on no one knowing that algorithm. If someone figures it out, you need to release a new version of your software, invalidate ALL API keys, and for that effort you still haven't done anything to prevent the same thing happening again.

A good test of this is: if someone has your source code, can they break your security mechanism? If yes, you're probably relying on security though obscurity. By contrast, if you're using asymmetric encryption to generate keys, it doesn't matter if someone knows that: if they don't have the private key, they can't do anything. (This leaves aside the issue of storing your private key or other secrets in source code, but I'd describe that as an operational failure rather than a fundamental design problem).

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#46

Post by [deleted] »

miki123211 wrote: post #24

It would be cool if it was possible to read the data not just by the ID, but also by the hash of the ID. That would let us serve stuff like version information and links to the latest version, without the fear that somebody is going to reverse engineer our app and replace the data with something malicious. We, as the app author, would have the full key, so we could read and write, whereas users would have nothing but…

[deleted]

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#47

Post by bontaq »

miki123211 wrote: post #24

It would be cool if it was possible to read the data not just by the ID, but also by the hash of the ID. That would let us serve stuff like version information and links to the latest version, without the fear that somebody is going to reverse engineer our app and replace the data with something malicious. We, as the app author, would have the full key, so we could read and write, whereas users would have nothing but…

It is done, lmk if it works alright. The read only hashes should be visible beneath the data editing view on a new one.

Re: Show HN: Textdb.dev – simple data sharing for fun projects

#49

Post by bontaq »

josefrichter wrote: post #8

Whoever made this, I love you. I do a lot of prototyping in Framer, and this just make simple prototypes that communicate with one another hell of a lot easier!

Hell yeah, I'm planning to keep it up for a good while and lemme know if something isn't working or you'd like a new feature. bontaq @ the google mail .com
Post reply on HN