5 ms·

So it’s a “desktop” environment without any of the privacy or security of a desktop environment, written in javascript & css (ie cheap and slow), where all the

So it’s a “desktop” environment without any of the privacy or security of a desktop environment, written in javascript & css (ie cheap and slow), where all the data is stored on a cloud owned by a couple of dudes (they can snoop, sell, and cut off access to your data at any time), all without encryption? Am I missing something or this a TERRIBLE idea? How does it keep showing up over and over again? Just about any developer could build something like this in under a month, it isn’t some novel idea. I don’t mean to rain on a parade here I am always happy to see hobby projects, but the fact someone is investing in this and real money is being allocated seems ridiculous. The implications of anyone seriously thinking this is a reasonable cloud desktop environment are scary; people will get duped into being data harvested with no ownership of their data.

louwrentius 4y ago
This was also my thinking looking at the site. No way I was going to allow access to my microphone or camera. the truth is that in order to use this site, you need a working computer with a desktop anyway. So the only value would be is that you can access your stuff from anywhere on any computer. It’s just security nightmares all the way down.
- survirtual 4y ago
  Yeah, glad someone else sees it. There is a value proposition in having a synchronized desktop across every environment (phone, tablet, desktop, etc.) but this project doesn’t remotely capture what that would entail —- a wasm-based OS with a webgpu frontend, all locally computed. All synchronization / any data leaving would be encrypted locally with a key shared among local systems via a QR code, and the option to self-host the entire stack would be readily available. The encryption + self-hosting is bare minimum as a business, not the least of which is because it adds credibility to the entire system. Open source is also a requirement to verify nothing nefarious is going on. With that in place, it might be reasonable to have a cloud offering that is paid so most users wouldn’t need to self host. Systems should also be able to replicate data locally so if cloud access is ever shut down, they can continue functioning without much issue. I could build all that (and have built that + more, so it comes from experience) in a ~month — how is it that this project is getting funded, after lacking any of that after years? My guess? It is cheap & looks usable, and for some reason gained massive popularity, so it will dupe people into freely sharing their data which can be mined and monetized. Apologies if this isn’t the intention of the original creators, but that is what investors will use this for. If I am wrong, I recommend they implement what I suggested.
  - JKCalhoun 4y ago
    I think it's a cool project. It looks slick and no doubt was a lot of work. Would I ever use it though? Of course not. It in fact goes in the exact opposite direction of computing for me. I am increasingly moving away from any product that relies on WiFi/connectivity. So nice to have your own media (movies, music) and not have to worry about an always-on internet to be your streaming bottleneck (never mind the inefficiencies of requiring a personal, on-demand, high-bandwidth movie stream). But then to take and put all your tools and desktop in the cloud as well? I guess it's why I have no use for Chromebooks either.
    - Inhibit 4y ago
      I would posit that installing an open UEFI implementation and taking advantage of the A) Cost and B) ridiculously good power saving features of a used Chromebook with the OS of your choice is a good Chromebook use. But as a stock laptop I get your point.
- OOPMan 4y ago
  A thin client to use on your thick client XD
smoyer 4y ago
And yet, if I want to do something nefarious, connecting to this from Tails via TOR would be a pretty good way to hide my tracks.
robertakarobin 4y ago
I thought this was just supposed to be a cool little portfolio project by the developer. Now they have a "careers@" email address... implying this is a business? What is their product? This seems very peculiar to me.
Yajirobe 4y ago
> Just about any developer could build something like this in under a month Wh.. what?
- MasterScrat 4y ago
  A great article about how people think the could "build stackoverflow in a week" made the rounds a few years ago but I can’t find it again…
  - Firmwarrior 4y ago
    I guess most coders could make something that looks like stackoverflow but can only handle a few thousand users at a time.. It'd be easy to make a site where you post questions and comments, upvote and downvote things, and have some basic account page Or did they think they could handle all the scale and all the random small features on the site too?
- eulers_secret 4y ago
  A month has 160 work-hours in it, that could be upped to 280 if you’re insane and do 10 hours/day even on weekends. That’s a lot of time! I think I could clone this in that time. And I’m a Linux kernel programmer with little web experience. With modern tooling and documentation this kind of project is within reach for many.
  - Firmwarrior 4y ago
    As another kernel programmer who's dabbled in web shit, I think you'll be shocked at how time consuming and obnoxious the work is Yeah, one line of kernel code is more difficult to write than 100 lines of web code.. but you're going to be churning out 10,000 lines of web code, and every layer of abstraction you try to use will make everything crappier and more screwy This page isn't a normal website either, so a lot of those website toolkits won't be of much use
    - survirtual 4y ago
thiht 4y ago
Are you always a grinch? This is a cool thing to post on Hacker News. I, for one, am impressed it works as well on iOS Safari. It’s just fun.
- cowsup 4y ago
  Seems fun on the surface, but they're offering folks to write in to their "careers" email (see the Info icon). They also really seem to be pushing you to create an account, or use the QR code, to save your information for later use. I've seen instances of fun things like "Windows 98 in a browser" that were interesting projects. This seems to be someone trying to make a full-on product out of the concept, even referring to it as "cloud computing" on their Twitter account. They can't play both sides. It's either a fun little toy, or it's a serious product. "Puter" seems to be aiming for the latter, so they deserve the relevant scrutiny.
  - Nav_Panel 4y ago
    Ironically I'd find more value in "Windows XP in a browser" than in a custom OS. if it has filesystem access and can handle most of the underlying API. Reason being that I run Linux, so if I need to run a Windows program (which I occasionally do: I'm into video game music, and a lot of the tooling stack for manipulating files is dinky Windows programs developed by Some Guy in 2013 and never really maintained), I have the following choices: - dualboot (not doing that again, Windows 10 loved to eat my bootloader over and over and would get stuck in update loops) - wine, which requires a lot of configuration and has weird bugs, but is really good for more heavyweight apps (foobar2000 is still king) - virtualization, which also requires a lot of configuration. need to perform a full OS install, etc. I haven't found a way to easily spin up a virtualized windows box (I run Manjaro = Arch, let me know if you have an easy way. A while back I gave it a couple hours and couldn't figure it out, so I gave up.). A Windows-in-browser that runs "well enough" and can access my local filesystem would let me just run the damn app, do the thing I want to do, and then call it a day. Of course, I'm sure there's lots of details I haven't thought through here. But it feels like a potentially legitimate use case.
  - deleted 4y ago
    [deleted]
olingern 4y ago
Peak hackernews comment and sentiment. There's also a neat changelog https://puter.com/app/changelog https://puter.com/app/changelog
ent101 4y ago
Hey, creator here. I'm a little late to reply as I was getting some sleep. You're obviously entitled to your opinion about Puter. It's completely fine if you think this is a very terrible idea. I disagree but I guess only time will tell. But I just wanted to say that it's categorically false that Puter is trying to harvest data and sell it later. It's clearly spelled out in its Terms of Service and Privacy Policy. I'm not trying to dupe anyone into anything, just hoping to build a better cloud storage service...
- survirtual 4y ago
  I am not doubting business potential; I can give two expletives about you or anyone else making money. I care only about users / customers. A few things: 1) please read my other comment about encrypting / address encryption of data. 2) a ToS can be changed at any time in the future. If you value privacy, bake in client-side encryption ASAP. Use bcrypt + salt for the password hashing and use something like libsodium (https://libsodium.gitbook.io/doc/secret-key_cryptography/secretstream https://libsodium.gitbook.io/doc/secret-key_cryptography/sec...) to encrypt/decrypt. These are both available in js: Bcrypt: https://www.npmjs.com/package/bcrypt https://www.npmjs.com/package/bcrypt Libsodium: https://www.npmjs.com/package/libsodium https://www.npmjs.com/package/libsodium Off the top of my head, have a user enter a password, generate a random nonce, hash it with bcrypt, store that hash to localstorage. Create a secretbox stream with that hash and run any data being persisted through that stream. This will add some safety to userdata. 3) if you do well and get acquired your ToS doesn’t protect anyone but yourself / the new owners 4) the instant you start accepting VC money you will slowly have less and less say in any of this — make protecting customers your first priority asap.
  - ent101 4y ago
    I agree with you 100% on client-side encryption. I need some time to get it right but it's definitely a priority. It's coming soon. As for ToS and Privacy Policy. I didn't use an off-the-shelf document from the internet because I was trying to make sure it's clear the data is not being harvested in any way, but I guess I need to amplify that more. What do you suggest? I'm genuinely curious and would like to know your suggestions. Thanks again :)

louwrentius 4y ago

This was also my thinking looking at the site. No way I was going to allow access to my microphone or camera. the truth is that in order to use this site, you need a working computer with a desktop anyway. So the only value would be is that you can access your stuff from anywhere on any computer. It’s just security nightmares all the way down.

survirtual 4y ago
Yeah, glad someone else sees it. There is a value proposition in having a synchronized desktop across every environment (phone, tablet, desktop, etc.) but this project doesn’t remotely capture what that would entail —- a wasm-based OS with a webgpu frontend, all locally computed. All synchronization / any data leaving would be encrypted locally with a key shared among local systems via a QR code, and the option to self-host the entire stack would be readily available. The encryption + self-hosting is bare minimum as a business, not the least of which is because it adds credibility to the entire system. Open source is also a requirement to verify nothing nefarious is going on. With that in place, it might be reasonable to have a cloud offering that is paid so most users wouldn’t need to self host. Systems should also be able to replicate data locally so if cloud access is ever shut down, they can continue functioning without much issue. I could build all that (and have built that + more, so it comes from experience) in a ~month — how is it that this project is getting funded, after lacking any of that after years? My guess? It is cheap & looks usable, and for some reason gained massive popularity, so it will dupe people into freely sharing their data which can be mined and monetized. Apologies if this isn’t the intention of the original creators, but that is what investors will use this for. If I am wrong, I recommend they implement what I suggested.
- JKCalhoun 4y ago
  I think it's a cool project. It looks slick and no doubt was a lot of work. Would I ever use it though? Of course not. It in fact goes in the exact opposite direction of computing for me. I am increasingly moving away from any product that relies on WiFi/connectivity. So nice to have your own media (movies, music) and not have to worry about an always-on internet to be your streaming bottleneck (never mind the inefficiencies of requiring a personal, on-demand, high-bandwidth movie stream). But then to take and put all your tools and desktop in the cloud as well? I guess it's why I have no use for Chromebooks either.
  - Inhibit 4y ago
    I would posit that installing an open UEFI implementation and taking advantage of the A) Cost and B) ridiculously good power saving features of a used Chromebook with the OS of your choice is a good Chromebook use. But as a stock laptop I get your point.
OOPMan 4y ago
A thin client to use on your thick client XD

smoyer 4y ago

And yet, if I want to do something nefarious, connecting to this from Tails via TOR would be a pretty good way to hide my tracks.

robertakarobin 4y ago

I thought this was just supposed to be a cool little portfolio project by the developer. Now they have a "careers@" email address... implying this is a business? What is their product? This seems very peculiar to me.

Yajirobe 4y ago

> Just about any developer could build something like this in under a month Wh.. what?

MasterScrat 4y ago
A great article about how people think the could "build stackoverflow in a week" made the rounds a few years ago but I can’t find it again…
- Firmwarrior 4y ago
  I guess most coders could make something that looks like stackoverflow but can only handle a few thousand users at a time.. It'd be easy to make a site where you post questions and comments, upvote and downvote things, and have some basic account page Or did they think they could handle all the scale and all the random small features on the site too?
eulers_secret 4y ago
A month has 160 work-hours in it, that could be upped to 280 if you’re insane and do 10 hours/day even on weekends. That’s a lot of time! I think I could clone this in that time. And I’m a Linux kernel programmer with little web experience. With modern tooling and documentation this kind of project is within reach for many.
- Firmwarrior 4y ago
  As another kernel programmer who's dabbled in web shit, I think you'll be shocked at how time consuming and obnoxious the work is Yeah, one line of kernel code is more difficult to write than 100 lines of web code.. but you're going to be churning out 10,000 lines of web code, and every layer of abstraction you try to use will make everything crappier and more screwy This page isn't a normal website either, so a lot of those website toolkits won't be of much use
  - survirtual 4y ago

thiht 4y ago

Are you always a grinch? This is a cool thing to post on Hacker News. I, for one, am impressed it works as well on iOS Safari. It’s just fun.

cowsup 4y ago
Seems fun on the surface, but they're offering folks to write in to their "careers" email (see the Info icon). They also really seem to be pushing you to create an account, or use the QR code, to save your information for later use. I've seen instances of fun things like "Windows 98 in a browser" that were interesting projects. This seems to be someone trying to make a full-on product out of the concept, even referring to it as "cloud computing" on their Twitter account. They can't play both sides. It's either a fun little toy, or it's a serious product. "Puter" seems to be aiming for the latter, so they deserve the relevant scrutiny.
- Nav_Panel 4y ago
  Ironically I'd find more value in "Windows XP in a browser" than in a custom OS. if it has filesystem access and can handle most of the underlying API. Reason being that I run Linux, so if I need to run a Windows program (which I occasionally do: I'm into video game music, and a lot of the tooling stack for manipulating files is dinky Windows programs developed by Some Guy in 2013 and never really maintained), I have the following choices: - dualboot (not doing that again, Windows 10 loved to eat my bootloader over and over and would get stuck in update loops) - wine, which requires a lot of configuration and has weird bugs, but is really good for more heavyweight apps (foobar2000 is still king) - virtualization, which also requires a lot of configuration. need to perform a full OS install, etc. I haven't found a way to easily spin up a virtualized windows box (I run Manjaro = Arch, let me know if you have an easy way. A while back I gave it a couple hours and couldn't figure it out, so I gave up.). A Windows-in-browser that runs "well enough" and can access my local filesystem would let me just run the damn app, do the thing I want to do, and then call it a day. Of course, I'm sure there's lots of details I haven't thought through here. But it feels like a potentially legitimate use case.
- deleted 4y ago
  [deleted]

olingern 4y ago

Peak hackernews comment and sentiment. There's also a neat changelog https://puter.com/app/changelog https://puter.com/app/changelog

ent101 4y ago

Hey, creator here. I'm a little late to reply as I was getting some sleep. You're obviously entitled to your opinion about Puter. It's completely fine if you think this is a very terrible idea. I disagree but I guess only time will tell. But I just wanted to say that it's categorically false that Puter is trying to harvest data and sell it later. It's clearly spelled out in its Terms of Service and Privacy Policy. I'm not trying to dupe anyone into anything, just hoping to build a better cloud storage service...

survirtual 4y ago
I am not doubting business potential; I can give two expletives about you or anyone else making money. I care only about users / customers. A few things: 1) please read my other comment about encrypting / address encryption of data. 2) a ToS can be changed at any time in the future. If you value privacy, bake in client-side encryption ASAP. Use bcrypt + salt for the password hashing and use something like libsodium (https://libsodium.gitbook.io/doc/secret-key_cryptography/secretstream https://libsodium.gitbook.io/doc/secret-key_cryptography/sec...) to encrypt/decrypt. These are both available in js: Bcrypt: https://www.npmjs.com/package/bcrypt https://www.npmjs.com/package/bcrypt Libsodium: https://www.npmjs.com/package/libsodium https://www.npmjs.com/package/libsodium Off the top of my head, have a user enter a password, generate a random nonce, hash it with bcrypt, store that hash to localstorage. Create a secretbox stream with that hash and run any data being persisted through that stream. This will add some safety to userdata. 3) if you do well and get acquired your ToS doesn’t protect anyone but yourself / the new owners 4) the instant you start accepting VC money you will slowly have less and less say in any of this — make protecting customers your first priority asap.
- ent101 4y ago
  I agree with you 100% on client-side encryption. I need some time to get it right but it's definitely a priority. It's coming soon. As for ToS and Privacy Policy. I didn't use an off-the-shelf document from the internet because I was trying to make sure it's clear the data is not being harvested in any way, but I guess I need to amplify that more. What do you suggest? I'm genuinely curious and would like to know your suggestions. Thanks again :)