19 ms·
Show HN: Airborn – Private Google Docs Alternative
- twiss 9y agoHi HN! I made this. It has bulk import from Google Docs ;) thanks to a feature request from HN: https://news.ycombinator.com/item?id=15478479 https://news.ycombinator.com/item?id=15478479
- mandeepj 9y agoCongrats on shipping. I noticed a small glitch. Your demo page does not load properly during first time. If I refresh then it's working fine. Update 1 - I'm using Chrome 56
- tylerhou 9y agoJust curious (and no negative implications whatsoever): is "we made it so that only one person at a time can type in a paragraph. No longer can that annoying classmate delete what you just typed" code for "operational transforms are hard to implement, especially without a source of truth?"
- twiss 9y agoYes and no :) I did indeed not implement OT, but it's also a true story that I would create a Google Doc and share it, nobody knows what to write, I type a sentence, and my classmates delete it as a joke, to mess with me :) But yeah, feedback on the collaboration is welcome. Do you think editing one sentence with multiple people is necessary, and if so why? And on the other end of the spectrum, Word-style edit requests (which need to be approved before they are applied) are also sometimes necessary.
- z3t4 9y agoIt's good to have if you want to go peer2peer eg. not having a server in between. Btw, Google Docs don't use a OT, or only a simple one, it does depend on the server and that you are online. A writing style that I try to use is that I just type ... don't look up words, just write YYY where I can't find the right word to use, then I read the text and fix all spelling errors, sentences, remove unnecessary parts etc. That way you can be in flow. But instead of you doing the fixing later, someone else can do it for you - while you are writing!
- polskibus 9y agoDo you have a source on Google docs not using OT? I remember reading Google's description of Google docs with a reference to seminal OT paper.
- z3t4 9y agohttps://youtu.be/yCcWpzY8dIA?list=LL9RQYUX_WIjk8SAcyuarJEw https://youtu.be/yCcWpzY8dIA?list=LL9RQYUX_WIjk8SAcyuarJEw About 25 minutes in. And it is called OT, so I stand corrected. It does require a server though. I was confusing it with CRDT.
- dredmorbius 9y agoRequest: I'd like to post an item based on the website description showing the image of encrypted contents and hashed filenames. I cannot extract that image (useful collateral) from your page on Android given page presentation.
- twiss 9y agoHere's a link: https://www.airbornos.com/images/documents-encrypted.png https://www.airbornos.com/images/documents-encrypted.png
- dredmorbius 9y agoThanks!
- sfotm 9y agoAny plans to make self-hosting straight-forward? Granted, I haven't spent much time looking for it, but I've been looking for something similar to this for quite some time, and Nextcloud's Collabora isn't quite what I'm looking for.
- twiss 9y agoNot really, because of https://news.ycombinator.com/edit?id=15596604 https://news.ycombinator.com/edit?id=15596604. Why would you like to self-host? (Not implying that there are no valid reasons, just curious which reasons are important to you.)
- sfotm 9y agoNothing in particular, I just already have a server set up with a good amount of storage because I didn't want to pay year-to-year for something like dropbox to save photos and videos to. I'd also be interested in getting the documents to appear in my Nextcloud and vice-versa. At the end of the day, it's mostly about having everything in a central location with a good set of backups in place.
- twiss 9y agoI see. What are you missing in Collabora? There's also OnlyOffice for Nextcloud, which is quite a feature-complete editor, I think: https://api.onlyoffice.com/editors/owncloud https://api.onlyoffice.com/editors/owncloud
- SliderUp 9y agoI wanted to look into self hosting because it's the only way, for security reasons, my company could use it.
- notyourday 9y agoBecause if I'm going to bet on someone other than Google keeping my crap secure and accessible, I'm going to be betting on myself, not on some fly by night entity with a very limited runway.
- sushid 9y agoIt seems like holding down a key does different things in different language alphabets. I can't seem to hold down a key and have it type the same character repeatedly in English, however (e.g. press a, expect aaaaaaa... until key up).
- twiss 9y agoWeird. What browser and operating system are you using, and which locale/keyboard layout? (Not sure which of those matter, but it works fine for me.)
- hasenj 9y agoOpening pubished documents seems to take a relatively long time? Example, page with no content except "This is a test" takes over 3 seconds to load. https://www.airbornos.com/pub#?f=c8d42cd38bfc2c26/87261eeee80726bf6eb9ed886ce7517c7435b1c267e4f50b48eae9582a6ef4c8 https://www.airbornos.com/pub#?f=c8d42cd38bfc2c26/87261eeee8... Even without any browser involved, just curling it takes 1.5 seconds on my mac time curl "https://airborn-usercontent.herokuapp.com/pub#?f=c8d42cd38bfc2c26/87261eeee80726bf6eb9ed886ce7517c7435b1c267e4f50b48eae9582a6ef4c8" (....) real 0m1.570s
- twiss 9y agoThanks for the report. Unlike the rest of the website, that url is not behind a CDN (although the document itself is), mainly because it's on a different domain (for security reasons). For me it's relatively fast, but I'm close to the server. I'll try to get it behind a CDN, too.
- arkadiyt 9y agoMinor bug report: registering with a 64 character password fails. 32 characters seems to work fine. Also a feature request: please add the ability for me to delete my account/data from your servers.
- akx 9y agoI wouldn't call that minor. Sounds like there's something odd about the way passwords are handled. :/
- twiss 9y agoIt works fine for me with a 64 character password. Maybe the server errored out randomly that time. What browser are you using? If you shoot me an email with your username, I'll delete your account and files manually.
- mejin 9y agoAny intentions on adding support for right to left languages? This is the only reason why I have a Windows 7 virtual machine with Office 13 installed. I am looking for alternatives.
- twiss 9y agoIf you select an RTL interface language, the UI becomes RTL. And in Chrome, you can select RTL in the editor in the context menu. Are you looking for something similar to that in Firefox, or are there any other issues with RTL?
- mejin 9y agoWhat I would like to do it write in both a RTL language and a LTR language: (second line is a translation of the first) Hello, world! שלום, עולם! However, the exclamation mark in the second line does not come at the end of the sentence. This is not good: https://image.ibb.co/b5dC7b/Screenshot_20171102_083647.png https://image.ibb.co/b5dC7b/Screenshot_20171102_083647.png This is good https://image.ibb.co/kAdjLw/Screenshot_20171102_083825.png https://image.ibb.co/kAdjLw/Screenshot_20171102_083825.png Changing the interface language didn't seem to help: https://image.ibb.co/k2gtDG/Screenshot_20171102_084103.png https://image.ibb.co/k2gtDG/Screenshot_20171102_084103.png
- twiss 9y agoIn Chrome, if you select the second line, right click -> Writing Direction -> Right to Left, it seems to do what you want. Does that help?
- mejin 9y agoYes, that works. (I can start using this more). As a suggestion maybe you should add the writing direction to the top options. I would not have thought to check the right click menu for anything other than cut/copy/paste, spell check and other less important things.
- dandare 9y agoOh my gosh, this looks like months of work, even if the editors are OS, the beautiful homepage, the billing, replying to emails and keeping everything up...
- twiss 9y agoThanks a lot! It has indeed been years of work, and while the Firetext editor existed as a mobile Firefox OS app, a big chunk of work has still gone into it. The presentations app is closer to how it already was, though.
- deleted 9y ago[deleted]
- piyush_soni 9y agoBug: Select some text, press delete. It doesn't delete anything, or deletes just one character at the cursor. It should deleted all selected text.
- twiss 9y agoWhat browser and OS are you using? It works for me.
- amenghra 9y agoGood timing with Google incorrectly flagging some Docs as abusive? (https://motherboard.vice.com/en_us/article/zmz3yw/why-is-my-google-doc-locked-terms-of-service-bug https://motherboard.vice.com/en_us/article/zmz3yw/why-is-my-...)
- ttul 9y agoWhen you were running an operation at Google scale, the challenge of fighting fraud is something that people who have not worked at that scale can only imagine. These guys will also encounter fraud at some point. And when they do so, I guarantee they will be no better at it than Google this.
- ocdtrekkie 9y agoYou state that the problem of fraud is particularly challenging "at Google scale". There is a fairly easy solution: Don't do things at Google scale. Many of these nearly unsolvable social problems we've created, such as YouTube content moderation, are manageable, or simply don't occur, outside Google scale. Which begs the question: Is doing things at Google scale really something to aspire to? Has even Google solved the problem of doing things at Google scale if they have problems they cannot solve adequately at Google scale?
- jasonvorhe 9y agoBetter shut down access to your service after a couple of hundred users?
- JangoSteve 9y agoTo be fair, Google has a little more than 200 users.
- twiss 9y agoYou're probably right about that. But, I believe that reading and blocking private, non-shared, documents in a user's account is not the right approach to abuse. If it ever becomes necessary, Airborn OS could inspect publicly shared documents for abuse, too.
- wybiral 9y agoAs for the crypto, am I correct in seeing that it uses PBKDF2 to derive an AES key from their password. And then it uses SJCL's encrypt/decrypt methods?
- twiss 9y agoYes, that's correct. Unless Web Crypto is available, in which case it uses that.
- mr_toad 9y agoHow does password / key recovery work?
- twiss 9y agoWhen you create an account, it downloads a file which contains - Your username - Your password, encrypted with a random key. That random key (but not your encrypted password) is sent to the server. When you request a password recovery, we send you a file by email which contains that key and with which you can decrypt your password. That way, - We don't have your encrypted password - A random person / application can't grab your password from your computer - We verify that it's you who wants a password recovery (by sending you an email).
- deleted 9y ago[deleted]
- starkruzr 9y agoI see there's source, but don't see instructions for deploying.
- twiss 9y agoYeah. While possible, Airborn OS isn't really meant to deploy yourself. If you want that, you might be better off with nextCloud or similar. Airborn OS was built to have a service that you don't have to self-host, while still being just as secure as self-hosting: https://www.airbornos.com/docs/security https://www.airbornos.com/docs/security
- asynchronous13 9y ago> Airborn OS was built to have a service that you don't have to self-host, while still being just as secure as self-hosting This is a better tag line than what I got when I loaded the website.
- twiss 9y agoYeah, although I worry that the average user might not know what self-hosting is, or why it is secure.
- carlisle_ 9y agoI feel like "Even if we get hacked" as a marketing message might send the wrong signals.
- 2474 9y agoYeah, I would have chosen a better way to imply that.
- twiss 9y agoHmm. Do you mean it sounds like we'll get hacked any day now? Do you have a suggestion for better wording?
- ttul 9y agoThankfully, I don’t think this is a super strong selling position. Google has an incredible reputation for keeping its users safe and their information private. What you don’t know is whether google in fact stores your documents in an encrypted format at rest. If they do, then what exactly are you offering?
- ocdtrekkie 9y agoGoogle can and does read your documents (in an automated fashion). That's how they can flag documents for abuse/TOS violation, as they are currently having issues with today. The whole argument here is that Airborn OS can't read your documents, presumably at all.
- zie 9y agoA bit off-topic, but since Google's goal seems to be know everything possible about you, so they can sell better, more expensive ads and make more money, they presumably do more than just look for TOS/copyright violations. Otherwise I agree with what you said.
- codegeek 9y ago
- spacetexas 9y agoYou can't save as .doc or .docx so its a no go for any business. Something you will need to fix.
- deleted 9y ago[deleted]
- bengotow 9y agoThis looks great! Minor nits: In what way is this an OS? Also in the US, Airborn (e.g. to be in the air) is spelled "Airborne" and it's difficult to type it without the trailing 'e' without spellcheck fixing it automagically.
- twiss 9y agoThe most significant ways in which it's a bit like an OS are 1. It has a Window Manager (try it out in the demo, you can drag around windows and such) 2. It has a File System, which does encryption and compression. This makes it so that the "apps" (documents and presentations, and in the future hopefully spreadsheets) don't have to know anything about encryption. This made it very easy to port the presentations app, for example. 3. It has a Marketplace with apps (not that they are very useful). But yeah, since many people don't seem to like the name nor the OS-like UI, I'm considering dropping both. I'm just a bit concerned because there are many other companies named simply Airborne or Airborn. Also, integrating documents and presentations into a more unified UI would be a lot of work, since they're pretty much standalone apps today.
- tomc1985 9y agoI hope your encryption scheme is a little more complicated than the blind faith in AES that the site's copy seems to imply
- thinkloop 9y agoNames barely matter, but yeah, the "OS" is confusing, airborn makes me think viruses and plagues, don't get any feelings of "documents", or "encryption", or "security" from it, and the namespace is overloaded, it will be hard to get rank. Otherwise I really like the project. I want all my data on all sites to be locally encrypted and backed up in the cloud. Documents is the perfect start, because there is very little server-side introspection needed. I'd like my friend graphs and contacts to be next. In terms of UI, start by copying google docs exactly, they did a fine job.
- rpedela 9y agoWhy not Airborn Docs? I wouldn't worry about the misspelling either. Google is a misspelling, lots of music groups are misspelled words, etc.
- krz8 9y agoTo solve this, [...use Service Workers] to install some code which can't be changed without setting off a warning to you. How does that work? Isn't a service worker started by plain JS code?
- twiss 9y agoYes, it is, but after that, it stays installed and runs before you open the web app the next time. In effect, this makes it trust-on-first use, just like if you'd install a desktop app which then had some secure update mechanism.
- woranl 9y agoCan service worker’s code ever be updated by the hacker? How does this actually work?
- twiss 9y agoYes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Of course, it would be better to only warn the user if the Service Worker changes if it doesn't match the version on GitHub, but that's blocked on [3]. Furthermore, there are some very edge-case situations where the Service Worker can update when Airborn OS is not open or not visible (e.g., in a hidden iframe [4]). That is why, when you register and check "Notify me before updating Airborn OS", it asks you for permission to send you notifications. Those notifications are currently only used to warn you when the Service Worker updates. [1]: https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegistration/onupdatefound https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegi... [2]: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Apps-using-Service-Worker http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap... [3]: https://github.com/w3c/ServiceWorker/issues/1208 https://github.com/w3c/ServiceWorker/issues/1208 [4]: https://bugs.chromium.org/p/chromium/issues/detail?id=773307 https://bugs.chromium.org/p/chromium/issues/detail?id=773307, but it's not a browser bug. I should file a spec bug, but I'm still waiting for a reply on [3], too.
- dmitrygr 9y agodoesnt work . Create presentation click insert image give it a normal 12 mpix image from my phone camera watch image not appear on slide try again, still no repeat until browser tab is out of ram and crashes image never appears on the slide
- ArchReaper 9y agoWhy does it have OS in the name? Is it an operating system? (This is a question I cannot find a direct answer to on their site) Their site makes it incredibly difficult to actually find out what this really is. The only text visible on my screen when the page loads are the lines "Airborn OS", "Even if we get hacked, they can't read your documents" and "Collaborate in real time" which tells me essentially nothing about why I'm here, what this website is, or what you're trying to sell/advertise. The only indication as to what this software actually does is in this Hacker News title. For contrast, Google Doc's homepage[1], the first two things I see are "Create [persuasive/adjective] documents" followed by "With Google Docs, you can write, edit, and collaborate wherever you are. For free." This tells me basically everything I need to know, as a casual user, to understand what Google Docs is and why I might want to use it. I hope this doesn't come across as overly critical, just some (hopefully helpful) feedback. [1] https://www.google.com/docs/about/ https://www.google.com/docs/about/
- Lerc 9y agoPeople assume that the thing you deal with at the front end is the operating system. Frustrating, I know. I have a vaguely similar project to Airborn OS. I called my project Notanos because everyone kept on calling it an OS.
- twiss 9y agoThe line that's supposed to tell you what it is is: "Create and edit files online, securely." Is that missing for you? (I admit it's smaller and less noticeable than the lines you quoted. I'll try making it more prominent.) A bit of explanation about the name here: https://news.ycombinator.com/item?id=15596668 https://news.ycombinator.com/item?id=15596668
- kinlan 9y agoI was confused too... Then I realised it takes about 10 seconds to appear as you animate the text in.
- tobyhinloopen 9y ago
- seizeheures 9y agoTheir interface is available in Esperanto. That's already a huge point for me.
- 0x6c6f6c 9y agoIs this page not designed to handle 4K displays? The tiling background is really not great to look at
- twiss 9y agoThe website is not, but when you open the app, the background should cover your whole screen. I'll try to fix the website.
- jeremyt 9y agoI can't register. Getting "there was an error" message.
- twiss 9y agoCould you try again? It might be just the server erroring out under load. Also, only Chrome, Firefox and Safari are supported.
- morganvachon 9y agoIt breaks the back button (stuck in a reloading loop). That alone is enough to make me move on, regardless of the potential privacy benefits.
- twiss 9y agoYeah, it does that in Firefox, sorry about that. It works in Chrome.
- morganvachon 9y agoHopefully you can get it fixed in other browsers. My apologies for this, but I find it amusing that a Google services alternative works better in a Google provided browser. :-)
- gatmne 9y agoLooks really slick! You should consider adding word support. Support for office XML formats[1] are simple enough to hand-roll. [1]:https://en.wikipedia.org/wiki/Microsoft_Office_XML_formats https://en.wikipedia.org/wiki/Microsoft_Office_XML_formats
- gatmne 9y agoAlso, consider placing print preview near the print command, or vise versa. Having two locations that contain the same type of functionality can be confusing.
- twiss 9y agoGood idea, thanks!
- twiss 9y agoWhat extent of docx support is important, do you feel? Is just importing docx to html (the native format) sufficient, or should they stay as docx while editing? Should it be possible to export from html to docx?
- gatmne 9y agoAs an end user, I don't care what format Airborn uses internally. What matters is that I can interact with documents and files sent to me by other people, which are likely authored using Microsoft Office, Libreoffice, and Google docs. As a developer, I would ideally recommend to look into using a custom internal representation for a document and developing converters that convert between your representation and various formats. This way you won't be hindered by limitations of a specific format. However, if you lack the resources to develop and maintain these converters yourself, look into the feasibility of leveraging LibreOffice by using a preexisting format like WordProcessingML as an internal format. You can then use LibreOffice to handle the conversion between the various formats you want to support. The downside to this is that you'll eventually outgrow WordProcessingML if you want to support futures not supported by that specific format.
- symreg 9y agoHow does the encryption work? Does AirbornOS send a Javascript file for encryption that my browser executes? What if you get hacked and the hacker changes the Javascript file?
- jimktrains2 9y agoThe very premises that a hacker can't read my data is laughable. Unless I'm using a native app to do the decryption a hacker could gain access to my data as it leaves your server or if they can store the encryption credentials from my session and use them later
- twiss 9y agoWhen it leaves our server, the data is encrypted and not readable. To get your encryption key, they would need to execute code in your browser, and we describe how we protect against that at https://www.airbornos.com/docs/security https://www.airbornos.com/docs/security. Of course, we're only talking about when our server gets hacked. If your computer gets hacked, you have a problem regardless of whether you're using a web app or a native app.
- jimktrains2 9y ago> To get your encryption key, they would need to execute code in your browser, You mean like all the javascript you're sending me? > To solve this, we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps on all other code, and checks that it matches the publicly available version on GitHub. I really think you need to rethink your security here, because this just makes me even more sure that I don't trust you. It's actually a good bit laughable. If an attacker has access to your server, why should I believe that they wouldn't be able to update your github repository? (Why do I know you use different keys, don't put your private key on the server, &c?) I have to trust you _regardless_ of any of your technology, and that's the problem. If someone has your server, there is very little I won't put past them to also have access too. In sum, I think you're in for a world of hurt if you expect anyone who actually cares about security to trust you to never, ever make any mistakes. > Of course, we're only talking about when our server gets hacked. If your computer gets hacked, you have a problem regardless of whether you're using a web app or a native app. You're obviously just being needlessly argumentative about this. My meaning is obvious because of the context and the situation I described.
- pramodzion 9y agoLooks very old school and you use iFrame ! Must be a product from the 2000s but releasing now ?
- twiss 9y agoSandboxed iframes are a modern and useful feature to isolate and secure different parts of a web app: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if... But thanks for the feedback. The UI can definitely be improved further, but it would be a lot of work to make it look similar to e.g. Google Docs.
- StanislavPetrov 9y agoThe whole idea of "cloud computing" is innately terrible on virtually every level. Those willing to entrust their data and the integrity of their data to any third party are either not very informed or not very smart(especially given the virtually daily reports of hacks, data breaches, and corporate malfeasance). This is especially true for word processing, which even the lowest capacity machines have the capability to perform without issue. If you value your data, your intellectual property, and your ability to perform technical tasks without disruption, you will be well-served to write all your own papers and documents on your own computer. Store them on your own hard drive and back them up to a flash drive that you physically control. Entrusting your data and your capacity to work to a third party should be avoided unless you have absolutely no other choice.
- mark242 9y agoThe odds of you losing your hard drive and flash drive in a house fire are significantly higher than the odds of you losing data on S3.
- taneq 9y agoThis response is about privacy, not offsite backups.
- guest 9y agoGot any actual numbers on that? In sweden as an example 100 people die of house fires each year (of around 10 mil), while most governmental agencies have been hacked containing the data of all those in the populous... Aka one databreach of a third party can result in alot more people get hurt than if you keep your data regionally (off site data storage is also no uncommon - aka store a backup in the garage or shed) meaning if the data was stored individually people would still be less protected than the gov. but collecting all that data would require something like 5 eyes and it's turn the data is alot more safe.
- StanislavPetrov 9y agoThe odds of a house fire and my inability to access critical data is significantly lower than that of a cloud malfunction like the one that occurred today. https://www.washingtonpost.com/news/the-switch/wp/2017/10/31/a-mysterious-message-is-locking-google-docs-users-out-of-their-files/ https://www.washingtonpost.com/news/the-switch/wp/2017/10/31...
- didip 9y agoThis app is making me ride the nostalgia train (circa 2005?) when AJAX was hot shit and everyone was making cloud OS. It has all the same elements: * window manager * apps * document editor * dock widget I wish you all the best OP!
- EGreg 9y ago"We (the makers of Airborn OS) won't be able to read them even if we wanted to." I take such claims with a huge grain of salt on the web. YOU serve the Javascript. YOU can change it at any time to phone home what I wrote. No point in trying to change it with the Web alone - that's how it's designed. The server must be trusted at all times.
- twiss 9y agoHere's a description of what we've done to solve that problem: https://www.airbornos.com/docs/security https://www.airbornos.com/docs/security
- EGreg 9y agoThat's interesting, but you're plugging holes in a waterfall I think. For example, that first visit which installs the service worker can already deliver bad code. Not saying you will do it, but it all relies on people trusting you not to do it. So statements like "we CAN'T read your stuff" are not true on the web. Luckily, most web users don't care about being hacked by the server - they care about owning their own data! :)
- twiss 9y ago> For example, that first visit which installs the service worker can already deliver bad code. Yes, but that is also the case when you install a desktop app. That's why Airborn OS is open source, so that you can inspect the code.
- EGreg 9y agoAgreed but with a desktop app, the author can sign it and the OS verifies that signature. Sadly the Web does no such thing with the top level document.
- twiss 9y agoYes, that's true, but the author (or intermediary-who-delivers-the-binary) can also.. not sign it (deliver an unsigned version). Often, you don't have many other options than to trust the binary the website is serving you.
- rpaulr 9y agoI just tried your demo, I think you need some improvements in your UI
- rambojazz 9y agoCan this be self-hosted?
- roemerb 9y agoPretty cool system. Considering making a VPS for this or something. Frontend can definitely use some work though.
- waytogo 9y agoOne killer feature I am looking for is numbered headers/styles. Something Google Docs still lacks and I need Word for.
- staticelf 9y agoCool project, one minor thing is that the background doesn't go very well to a wide-screen. I can see the image repeat.
- ggvgyy 9y agoshxt
- mcemilg 9y agoHow they simulate the OS? It is amazing!
- canadianwriter 9y agoCould people stop using that headline being typed out letter by letter thing? It's annoying as hell.
- carlhjerpe 9y agoNicely done! :)
- deleted 9y ago[deleted]
- astrix_pre 9y agoThe only indication as to what this software actually does is in this Hacker News title.