6 ms·

Show HN: sdees – serverless decentralized editing of encrypted stuff

100 points by qrv3w 10y ago

throwawayReply 10y ago
Amusing to see a comment mention 14 work factor and the code is 12 rounds. Code and comments get out of sync so quickly. Out of interest, why the static salt in addition to bcrypt?
- arkadiyt 10y ago
  Not the author but if I had to take a guess I'd say they might have been trying to pepper the hash: https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography). It's not particularly useful here since if someone got access to your remote encrypted file and knew it was made with sdees, the pepper is public. However if the value was configurable by the user then it could provide an extra layer of protection against someone brute forcing the hash and getting your password. A better approach would be to not store a hash of the password at all. The author uses it to check that the user supplied the correct password when attempting decryption - instead you can decrypt the file using whatever password the user provides (getting either correct or garbage output back), and check for a magic value in the output.
  - qrv3w 10y ago
    Thanks! I will do that.
_paulc 10y ago
(In .vimrc) set cryptmethod=blowfish2 vim -x scp://.../...
- ende42 10y ago
  I was excited for a moment. Then found out neovim doesn't support -x. And this is why: https://github.com/neovim/neovim/issues/694 https://github.com/neovim/neovim/issues/694 (tldr; vim encryption is unsecure and thus removed from neovim for the time being). Would have been nice, though.
- ilanco 10y ago
  Didn't know VIM supported encryption, this is really cool. http://vim.wikia.com/wiki/Encryption http://vim.wikia.com/wiki/Encryption
olalonde 10y ago
Almost buzzword compliant, just missing the "written in Go".
- creshal 10y ago
  I thought it's Lisp week?
avindroth 10y ago
This is cool. I have been planning encrypting my personal data, but didn't realize the process of timestamping was this difficult. Glad I found the solution with the problem.
antocv 10y ago
How is this serverless when there is a server called remote in the example? Am I the only one around here? http://i3.kym-cdn.com/entries/icons/original/000/010/856/4fcdf2e118613355b500ba5d.jpg http://i3.kym-cdn.com/entries/icons/original/000/010/856/4fc...
- dmgd 10y ago
  Even the author doesn't believe it's really serverless: https://github.com/schollz/sdees/search?q=server https://github.com/schollz/sdees/search?q=server
  - ddalex 10y ago
    Server-less is the new paradigm where the server is in the cloud. More specifically, you're not maintaining any server, you just supply callbacks written in the language of your choice, and the infrastructure figures out how to package them in containers, deploy, run, scale and dispose when no longer needed.
    - antocv 10y ago
      Can you explain what you mean with "server is in the cloud", is it like literal placing a fog machine to make some kind of cloud around your servers or placing a server inside another server, such as a raspberry pi within a PC box? What is the cloud if not other peoples servers?
      - viraptor 10y ago
        > What is the cloud if not other peoples servers? It is, but taken literally and not helpful in infrastructure discussions. "Serverless service" as recently coined means you're not concerned with the server layer. Either the hardware one, or the "http request server" one. What you provide is functions that execute on some action. As long as the API is preserved it doesn't matter if it's one server of one/multiple providers, cloud deployment, room filled with monkeys at keyboards, linux running unicorn, windows running iis, or anything else. It's one level above "set up your services and upload code for specific server" PAAS. And two or so levels above "set up your own servers and services" IAAS. PS. I don't think sdees matches the definition of serverless as it's commonly understood.
Kubuxu 10y ago
Friend of mine is working on Cryptpad [1] which is encrypted collaborative web editor. There are multiple connection modes, most common websockets relay server but he is also working on WebRTC transport. Everything is modular so you can create encrypted applications as you see fit by changing transport, storage, crypto and frontend.See for example [3]. In case of using a relay server the content is encrypted so the server doesn't know what the content is. The source is open on AGPL license. --- [1]: https://beta.cryptpad.fr https://beta.cryptpad.fr [2]: https://github.com/xwiki-labs/cryptpad/ https://github.com/xwiki-labs/cryptpad/ [3]: https://beta.cryptpad.fr/poll/#173f2db91c58169a22a005ebb85c2377SLzcS+YkTZUkoXYpftGVvzVC https://beta.cryptpad.fr/poll/#173f2db91c58169a22a005ebb85c2...
- lgessler 10y ago
  Thanks for sharing this. I had an old hackathon project that seemed cool but didn't really have a good application (essentially, end-to-end encrypted Socket.IO implemented on top of Keybase filesystem: https://github.com/lgessler/kbrpc https://github.com/lgessler/kbrpc). Maybe I'll try to get it to work with Cryptpad.
orliesaurus 10y ago
i was expecting something using IPFS :D
- chme 10y ago
  Yes, or something like syncthing
cyphar 10y ago
Why not use GPG directly? I get the wish to not add more binary dependencies, but the recent couple of issues with Go's math and crypto libraries doesn't fill me with confidence. Not to mention that there's no real benefit to adding your own wrappers around the crypto primitives when GPG already exists.
- qrv3w 10y ago
  Initially I did. However, I tend to use lots of Windows computers, so I really wanted something where I didn't have to install Cygwin+GPG+rsync each time. The Windows release also bundles vim into the binary so you don't even have to have vim installed if you're using Windows!
  - xori 10y ago
    And as a Windows user I thank you.
    - srpeck 10y ago
      I had the same need, so I created a zero-install, client-side encrypted, browser-based editor using SJCL+CodeMirror in Vim mode: https://github.com/srpeck/encryptedgist https://github.com/srpeck/encryptedgist
kellros 10y ago
Nice. Slightly disappointed that the file being edited in the demo wasn't called "nuts" (https://raw.githubusercontent.com/schollz/sdees/master/branding/help2.gif https://raw.githubusercontent.com/schollz/sdees/master/brand...)
133777 10y ago
> "The remote computer is used only for file storage and does not require any server-side code." And thats serverless?
- throwawayReply 10y ago
  You're wondering what serverless means while I'm trying to work how how a central file-store is "decentralized".
repomies691 10y ago
How is this "serverless"? Quite clearly I have to configure a remote...
wtbob 10y ago
In emacs, one could use TRAMP and EasyPG Assistant: C-x C-f /rsync:user@host:/path/to/file One could of course also configure stuff such that one could type quite a bit less.
mrmondo 10y ago
Please stop using the term serverless, it may be decentralised but it is not serverless, so if you mean decentralised please use that term instead.

100 points by qrv3w 10y ago

Amusing to see a comment mention 14 work factor and the code is 12 rounds. Code and comments get out of sync so quickly. Out of interest, why the static salt in addition to bcrypt?

arkadiyt 10y ago
Not the author but if I had to take a guess I'd say they might have been trying to pepper the hash: https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography). It's not particularly useful here since if someone got access to your remote encrypted file and knew it was made with sdees, the pepper is public. However if the value was configurable by the user then it could provide an extra layer of protection against someone brute forcing the hash and getting your password. A better approach would be to not store a hash of the password at all. The author uses it to check that the user supplied the correct password when attempting decryption - instead you can decrypt the file using whatever password the user provides (getting either correct or garbage output back), and check for a magic value in the output.
- qrv3w 10y ago
  Thanks! I will do that.

_paulc 10y ago

(In .vimrc) set cryptmethod=blowfish2 vim -x scp://.../...

ende42 10y ago
I was excited for a moment. Then found out neovim doesn't support -x. And this is why: https://github.com/neovim/neovim/issues/694 https://github.com/neovim/neovim/issues/694 (tldr; vim encryption is unsecure and thus removed from neovim for the time being). Would have been nice, though.
ilanco 10y ago
Didn't know VIM supported encryption, this is really cool. http://vim.wikia.com/wiki/Encryption http://vim.wikia.com/wiki/Encryption

olalonde 10y ago

Almost buzzword compliant, just missing the "written in Go".

creshal 10y ago
I thought it's Lisp week?

avindroth 10y ago

This is cool. I have been planning encrypting my personal data, but didn't realize the process of timestamping was this difficult. Glad I found the solution with the problem.

antocv 10y ago

How is this serverless when there is a server called remote in the example? Am I the only one around here? http://i3.kym-cdn.com/entries/icons/original/000/010/856/4fcdf2e118613355b500ba5d.jpg http://i3.kym-cdn.com/entries/icons/original/000/010/856/4fc...

dmgd 10y ago
Even the author doesn't believe it's really serverless: https://github.com/schollz/sdees/search?q=server https://github.com/schollz/sdees/search?q=server
- ddalex 10y ago
  Server-less is the new paradigm where the server is in the cloud. More specifically, you're not maintaining any server, you just supply callbacks written in the language of your choice, and the infrastructure figures out how to package them in containers, deploy, run, scale and dispose when no longer needed.
  - antocv 10y ago
    Can you explain what you mean with "server is in the cloud", is it like literal placing a fog machine to make some kind of cloud around your servers or placing a server inside another server, such as a raspberry pi within a PC box? What is the cloud if not other peoples servers?
    - viraptor 10y ago
      > What is the cloud if not other peoples servers? It is, but taken literally and not helpful in infrastructure discussions. "Serverless service" as recently coined means you're not concerned with the server layer. Either the hardware one, or the "http request server" one. What you provide is functions that execute on some action. As long as the API is preserved it doesn't matter if it's one server of one/multiple providers, cloud deployment, room filled with monkeys at keyboards, linux running unicorn, windows running iis, or anything else. It's one level above "set up your services and upload code for specific server" PAAS. And two or so levels above "set up your own servers and services" IAAS. PS. I don't think sdees matches the definition of serverless as it's commonly understood.

Kubuxu 10y ago

Friend of mine is working on Cryptpad [1] which is encrypted collaborative web editor. There are multiple connection modes, most common websockets relay server but he is also working on WebRTC transport. Everything is modular so you can create encrypted applications as you see fit by changing transport, storage, crypto and frontend.See for example [3]. In case of using a relay server the content is encrypted so the server doesn't know what the content is. The source is open on AGPL license. --- [1]: https://beta.cryptpad.fr https://beta.cryptpad.fr [2]: https://github.com/xwiki-labs/cryptpad/ https://github.com/xwiki-labs/cryptpad/ [3]: https://beta.cryptpad.fr/poll/#173f2db91c58169a22a005ebb85c2377SLzcS+YkTZUkoXYpftGVvzVC https://beta.cryptpad.fr/poll/#173f2db91c58169a22a005ebb85c2...

lgessler 10y ago
Thanks for sharing this. I had an old hackathon project that seemed cool but didn't really have a good application (essentially, end-to-end encrypted Socket.IO implemented on top of Keybase filesystem: https://github.com/lgessler/kbrpc https://github.com/lgessler/kbrpc). Maybe I'll try to get it to work with Cryptpad.

orliesaurus 10y ago

i was expecting something using IPFS :D

chme 10y ago
Yes, or something like syncthing

cyphar 10y ago

Why not use GPG directly? I get the wish to not add more binary dependencies, but the recent couple of issues with Go's math and crypto libraries doesn't fill me with confidence. Not to mention that there's no real benefit to adding your own wrappers around the crypto primitives when GPG already exists.

qrv3w 10y ago
Initially I did. However, I tend to use lots of Windows computers, so I really wanted something where I didn't have to install Cygwin+GPG+rsync each time. The Windows release also bundles vim into the binary so you don't even have to have vim installed if you're using Windows!
- xori 10y ago
  And as a Windows user I thank you.
  - srpeck 10y ago
    I had the same need, so I created a zero-install, client-side encrypted, browser-based editor using SJCL+CodeMirror in Vim mode: https://github.com/srpeck/encryptedgist https://github.com/srpeck/encryptedgist

kellros 10y ago

Nice. Slightly disappointed that the file being edited in the demo wasn't called "nuts" (https://raw.githubusercontent.com/schollz/sdees/master/branding/help2.gif https://raw.githubusercontent.com/schollz/sdees/master/brand...)

133777 10y ago

> "The remote computer is used only for file storage and does not require any server-side code." And thats serverless?

throwawayReply 10y ago
You're wondering what serverless means while I'm trying to work how how a central file-store is "decentralized".

repomies691 10y ago

How is this "serverless"? Quite clearly I have to configure a remote...

wtbob 10y ago

In emacs, one could use TRAMP and EasyPG Assistant: C-x C-f /rsync:user@host:/path/to/file One could of course also configure stuff such that one could type quite a bit less.

mrmondo 10y ago

Please stop using the term serverless, it may be decentralised but it is not serverless, so if you mean decentralised please use that term instead.