9 ms·

Hi HN, The founder of YourNote here. YourNote is a user-first note-taking app. By user-first, we mean that user's personal data (which are the notes) are guara

Hi HN, The founder of YourNote here. YourNote is a user-first note-taking app. By user-first, we mean that user's personal data (which are the notes) are guaranteed to be secure and private if you use YourNote. This is achieved by using Blockstack and Gaia for user authentication and user data storage. So, at any point in time, user and only the user has access to their notes. Even if their Gaia storage gets hijacked, their data is encrypted using the keys only the user holds so it's basically impossible to access a user's data for a third party. This establishes two things. 1. Data Security 2. Data Privacy So with YourNote and Blockstack, we can be sure that we are good on those fronts. Another thing that makes YourNote interesting is that it uses open standard (markdown with frontmatter) for storing notes. So even if YourNote gets taken down, the user can still access their data using any text editor as the data is stored on their own storage. Also, if the user starts hating YourNote for some reason, they can export their data and either use a text editor for accessing them, or fork YourNote and make their own app. So basically, another thing that YourNote guarantees is - 3. Data Accessibility I believe these three things are very important for a note-taking app which stores data that is more "personal" and "valuable" to the user than photos, media, and other data. HN, I would love to know what you think about the idea and the product. I know that it's a long way to go before this can become something that people will readily jump ship on, but I hope it's a valid start.

Sujan 8y ago
What is Blockstack? What is Gaia?
- aviaryan 8y ago
  Blockstack is like a framework that allows people to create and access decentralized apps on top of it. It enables that by letting users created a decentralized ID that is stored on the blockchain (bitcoin) and giving users access to the apps based on that ID (like authentication). Gaia is a storage system built by the Blockstack team. It is different from IPFS and others in the sense that it allows the user to choose where they store their data. This storage location is called Gaia hub. This approach gives users absolute control over their data which is unlike other distributed storage systems. You can learn more about them here. https://blockstack.org/what-is-blockstack/ https://blockstack.org/what-is-blockstack/ https://github.com/blockstack/gaia https://github.com/blockstack/gaia
  - JeffMerlet 8y ago
    What happens if one day Blockstack and Gaia go definitely away?
    - aviaryan 8y ago
      Even if Blockstack goes away, you can still access your data (in encrypted form) as Gaia is nothing but a storage system that is a wrapper over existing storage providers (aws, google cloud, and more). Now, the question is how you will decrypt it. Blockstack stores auth information on the Bitcoin blockchain so I guess you will be able to access your Blockstack credentials as long as Bitcoin blockchain is accessible and you have access to your secrets. Also, Blockstack and Gaia are open-source so it's unlikely they disappear with no trace.
TekMol 8y ago
at any point in time, user and only the user has access to their notes I don't think that is true. When I use your app, you can do anything you want to my data. You might promise me that the Javascript you delivered to my browser is treating my data in a certain way. Storing it in encrypted form or whatnot. But that is just a promise. Reality is: you can ship me code that does whatever you like.
- joekrill 8y ago
  I mean, this is effectively called "life" (as it stands today). You have to trust people. You have to trust someone, at some point. That's why we have things like privacy policies and service agreements. There can ALWAYS be a malicious actor somewhere in the chain. Even if you were to hand write a clone of this app in assembly and compile it yourself: can you trust the compiler? Can you trust your CPU? Can you trust your monitor?
- aviaryan 8y ago
  That is true, and the only way to fix that is when users see the code and run it themselves (I plan to open source very soon). Apart from that, I don't think I can provide any other guarantees. No open source project can. If they are discovered doing something bad, they go rekt. That's how it usually is. So what's the point here? Should I not have a line like this in my copy? Another thing that can be done is that I distribute my application in such a way that its code is directly linked to the open source GitHub repo. It can be done by having some script as the distributable that clones and runs the source code (it's a very bad way though). It would be interesting to know if any other open source project in the privacy space is already doing something extreme like that.
  - beatgammit 8y ago
    Or more simply, just allow users to self host. Users can trust one version of the app, and then only update when they need a new feature, at which point they can choose to trust that version. However, that already exists. I can use NextCloud in this manner and the have a note app.
canadaduane 8y ago
Neat! I agree, and although it may not be clear what all of this means to everyone, this is the beginning of how "blockchain" (I use the word loosely) is going to prove its value. At Mainframe, we're working on something similar, called "Noted", and we offer some of the same guarantees but take it one step further: we rely on no centralized infrastructure at all, not even DNS. Congrats on getting this released!
- aviaryan 8y ago
  Thanks. I wonder how are you doing that? Is there any way I can learn more?
  - canadaduane 8y ago
    Sure! Check out https://github.com/MainframeHQ/js-mainframe https://github.com/MainframeHQ/js-mainframe. This is a browser-like desktop app that has ambitions to embed portions of itself at the OS layer some day (we call it "mainframeOS" right now, with that ambition in mind). We'll be making our first public release at the beginning of February. It will combine decentralized file storage, messaging, identity, and contacts in an easy-to-use API for dapps that operate from within its framework. I'd be very interested to hear your feedback. I'm @canadaduane on twitter and @duane@refactorcamp.org on mastodon.

Sujan 8y ago

What is Blockstack? What is Gaia?

aviaryan 8y ago
Blockstack is like a framework that allows people to create and access decentralized apps on top of it. It enables that by letting users created a decentralized ID that is stored on the blockchain (bitcoin) and giving users access to the apps based on that ID (like authentication). Gaia is a storage system built by the Blockstack team. It is different from IPFS and others in the sense that it allows the user to choose where they store their data. This storage location is called Gaia hub. This approach gives users absolute control over their data which is unlike other distributed storage systems. You can learn more about them here. https://blockstack.org/what-is-blockstack/ https://blockstack.org/what-is-blockstack/ https://github.com/blockstack/gaia https://github.com/blockstack/gaia
- JeffMerlet 8y ago
  What happens if one day Blockstack and Gaia go definitely away?
  - aviaryan 8y ago
    Even if Blockstack goes away, you can still access your data (in encrypted form) as Gaia is nothing but a storage system that is a wrapper over existing storage providers (aws, google cloud, and more). Now, the question is how you will decrypt it. Blockstack stores auth information on the Bitcoin blockchain so I guess you will be able to access your Blockstack credentials as long as Bitcoin blockchain is accessible and you have access to your secrets. Also, Blockstack and Gaia are open-source so it's unlikely they disappear with no trace.

TekMol 8y ago

at any point in time, user and only the user has access to their notes I don't think that is true. When I use your app, you can do anything you want to my data. You might promise me that the Javascript you delivered to my browser is treating my data in a certain way. Storing it in encrypted form or whatnot. But that is just a promise. Reality is: you can ship me code that does whatever you like.

joekrill 8y ago
I mean, this is effectively called "life" (as it stands today). You have to trust people. You have to trust someone, at some point. That's why we have things like privacy policies and service agreements. There can ALWAYS be a malicious actor somewhere in the chain. Even if you were to hand write a clone of this app in assembly and compile it yourself: can you trust the compiler? Can you trust your CPU? Can you trust your monitor?
aviaryan 8y ago
That is true, and the only way to fix that is when users see the code and run it themselves (I plan to open source very soon). Apart from that, I don't think I can provide any other guarantees. No open source project can. If they are discovered doing something bad, they go rekt. That's how it usually is. So what's the point here? Should I not have a line like this in my copy? Another thing that can be done is that I distribute my application in such a way that its code is directly linked to the open source GitHub repo. It can be done by having some script as the distributable that clones and runs the source code (it's a very bad way though). It would be interesting to know if any other open source project in the privacy space is already doing something extreme like that.
- beatgammit 8y ago
  Or more simply, just allow users to self host. Users can trust one version of the app, and then only update when they need a new feature, at which point they can choose to trust that version. However, that already exists. I can use NextCloud in this manner and the have a note app.

canadaduane 8y ago

Neat! I agree, and although it may not be clear what all of this means to everyone, this is the beginning of how "blockchain" (I use the word loosely) is going to prove its value. At Mainframe, we're working on something similar, called "Noted", and we offer some of the same guarantees but take it one step further: we rely on no centralized infrastructure at all, not even DNS. Congrats on getting this released!

aviaryan 8y ago
Thanks. I wonder how are you doing that? Is there any way I can learn more?
- canadaduane 8y ago
  Sure! Check out https://github.com/MainframeHQ/js-mainframe https://github.com/MainframeHQ/js-mainframe. This is a browser-like desktop app that has ambitions to embed portions of itself at the OS layer some day (we call it "mainframeOS" right now, with that ambition in mind). We'll be making our first public release at the beginning of February. It will combine decentralized file storage, messaging, identity, and contacts in an easy-to-use API for dapps that operate from within its framework. I'd be very interested to hear your feedback. I'm @canadaduane on twitter and @duane@refactorcamp.org on mastodon.