12 ms·
Jazz – Apps with Distributed State
- candiddevmike 2y agoThis is JavaScript only from what I can tell.
- nielsbot 2y agoIt's TypeScript... but maybe TypeScript only?
- whalesalad 2y agohttps://chat.jazz.tools/#/chat/co_z7jXmhppcrqVpgcx4PxFs5Ljswd https://chat.jazz.tools/#/chat/co_z7jXmhppcrqVpgcx4PxFs5Ljsw...
- yawnxyz 2y agovery cool! I was there for maybe 2 minutes before HN took the system down :D
- theanzelm 2y agoInvestigating why it’s breaking, was there a lot of people in that room?
- whalesalad 2y agowhen it broke there were 3-4 people in it
- theanzelm 2y agoupdate: it's not the amount of people in it that broke this room https://news.ycombinator.com/item?id=41775047 https://news.ycombinator.com/item?id=41775047
- gocken 2y agoNot very cool if it breaks under hardly any load. You'd think they'd test their tech demos on more than a handful of people before launching. This doesn't give much confidence at all in their product.
- aboodman 2y agoI don't think you're on the right forum if this is your response to somebody launching something new and technically interesting.
- rattray 2y agonote the creator did not intend for the project to be posted to hn at this time
- theanzelm 2y agoLooks like it's not load that brought it down but someone posting a 340kb individual message that's triggering a bug because we didn't account for that sort of thing somewhere. The good thing is we now have an easily reproducible case, thanks HN :)
- meiraleal 2y agoTell me you never build anything without telling you never build anything
- frenchie4111 2y agoMild nit: your website hijacked the back button, I had to spam click back like 30 times to get back to this hacker news comment thread
- theanzelm 2y agoFounder here - do you mean the chat example? Or just the homepage itself?
- rozap 2y agohomepage itself, firefox on ubuntu
- rbattula 2y agosame for me safari on macos15
- slipgate55 2y agoI couldn't replicate this in Firefox 131 under W11.
- exac 2y agoOn Firefox 131.0 I clicked through the tabs with the demo code, then pressed my mouse's "back" button and it didn't work. So I manually clicked the back button and it directed me back to this page. Then I opened it again and clicked the back button and it didn't work again.
- 2y ago
- jessmartin 2y agoOver the past few years, I've worked on and used a bunch of different frameworks to try to solve for distributed state. Jazz feels like it has the right "shape" - the right primitives to quickly build an app with magical powers like offline, real-time collab, etc. If you can push the distributed state problem below the framework level, it becomes dead simple to build apps, which feels great.
- aliasxneo 2y agoAfter a cursory review of the docs, it conceptually reminds me of iroh: https://github.com/n0-computer/iroh https://github.com/n0-computer/iroh.
- authorfly 2y agoNeat work! Can the author provide any ideas around: 1) Differences from fire-svelte for core functionality? 2) For the beyond core aspects, like Group-WebRTC (great innovation btw), how will things like TURN/PEER servers work to manage the WebRTC connections?
- theanzelm 2y agoWhat exactly does fire-svelte do? For me it looked like a frontend framework but without synced or persisted state?
- authorfly 2y agoSvelte-fire* allows you to basically sync state between frontend use (with optional chaining operators) and your firebase/firestore backend. You can basically call stuff as a variable and it gets it from the database and likewise updates it. Specifically, once I load something (say a document), if I edit in on another tab, it will re-render on my original tab so long as the document it references (by key) is the same and firebase permissions allow me to read it as that firebase user. It means all my permissions and schema goes in firebase/firebase rules (e.g. users can only access their own documents of type "Car" but can read all documents of type "Road"). Which is quite handy to do stuff quickly that syncs across users and works as a single source of truth. It's an add on that works with Svelte (and Firebase). *(sorry, I got the wrong phrase)
- yohannparis 2y agoWhere are the information about the company? I cannot find an About Us, where they are based, etc?
- theanzelm 2y agoFounder here - we’re working on that page, so far there’s just info on me on https://gcmp.io/team https://gcmp.io/team But I was able to hire a couple really good first people recently! We’re based all over Europe. Let me know what else you’d like to know!
- azeirah 2y agoAre you looking to hire at all? This is the kind of technical work that I'm very interested in. I'm based in Europe.
- theanzelm 2y agoI think we're good for now but please link your GitHub / most impressive project, or shoot me an email to anselm@gcmp.io
- yohannparis 2y agoThank you I really appreciate it. As an European, I am trying to use only database/sync services based in Europe using European datacenter. Is it the case for Jazz?
- theanzelm 2y agoIf you only share data with Europeans, it should only end up on the cache server in London and the main central server in Prague. I was planning to add a second main server in the US that would also receive everything but will think about how to keep data separate for users/companies that need that. In any case all the data is end-to-end encrypted, but I guess some of the metadata that is stored could still be considered sensitive for your scenario.
- softfalcon 2y agoI'm more than a little worried about the following all being `Coming Soon`: - Cursors & carets - Two way sync to your DB - Video presence & calls - both the Group and BinaryCoStreams All of these are the key reasons I would be evaluating this framework to handle my data. All of these are not fully implemented yet. It is these key topics of live reloading/updating data that make or break an app. In my opinion, if you haven't concretely solved these problems, you haven't really built a viable state framework for 2024. I really like the patterns they've implemented though, looks a lot like the same framework I just built on top of MobX, websockets, and React for a recent project. They're headed in the right direction, but I'm not sure they realize how much more work they have to go before this is fully fleshed out.
- theanzelm 2y agoIt is already persisting and syncing data (fully encrypted) between the cloud and other users. You can think of Jazz as a distributed database itself. The coming-soon badges are about interop with traditional systems and higher level features we will add later. The fundamentals are solved and you can build full multiplayer, local-first apps with it. Does that make sense?
- aboodman 2y agoDoes it store data persistently anywhere (on servers?). If so where?
- softfalcon 2y ago
- deleted 2y ago[deleted]
- pshc 2y ago> Jazz Mesh is currently free — and it's set up as the default sync & storage peer in Jazz How difficult is it to run my own backend? Edit: > Completely DIY Mesh. > Build your own network of sync and storage nodes. Handle networking, security and backups yourself. > Costs: > N × instance cost for your sync nodes. > Very high self-hosted egress costs. > High self-hosted storage costs. Compared to Mesh Pro at $79 for 30,000 sync-minutes (“Sync-minutes are counted on a per-connected-device, per-minute basis.”) per month… I bet the cost of self-hosted storage and egress is very low, actually, of course assuming you have the competence and time to DIY it.
- theanzelm 2y agonpx jazz-run sync Either locally or on your server. And then point the app to that! Edit: re pricing Super preliminary, curious to hear everyone’s thoughts
- earthnail 2y agoStorage seems reasonable, maybe even a bit too cheap, but the sync minutes look way too expensive. One problem is with end-user monetization: users are used to pay for storage, but not for how much time they can use your app. For a small storage-heavy indie app I have, I'd pay $79 for base price, $45 for additional storage, and $1500 for sync minutes.
- theanzelm 2y agoThanks, this is very helpful. If it's unfeasible for a small indie app then that's a bug in the pricing. If you have time, I'd love to hear about your app and work out alternatives (not just for you, but for everyone) anselm@gcmp.io anselm_io on Twitter Or book a chat directly: https://cal.com/anselm-io/talk-about-jazz https://cal.com/anselm-io/talk-about-jazz (everyone else who has opinions on pricing is welcome to do the same)
- pkrulz101 2y agoRandom one, but how do you find using Cal - Im keen to try it out?? I saw it on Onestack.cloud hosted for A$10 per 10 users per month which is pretty decent - our startup has a few founders and are pre-revenue, so means we couldn't really afford per user per month.
- theanzelm 2y agoFounder here - thanks for posting this! It’s getting late where I am so everyone who has questions please don’t be shy to ask, will elaborate in detail tomorrow!
- Humphrey 2y agoHow does the mesh (zero-server) work under-the-hood? What are some example of applications you see being possible with this library? Your site also mentions either using a central server or not having a server. The first idea that comes to mind (perhaps because of your chat example on the homepage) is a decentralised P2P messaging app - something like Messenger or WhatsApp but is completely free from central servers.
- theanzelm 2y agoThe underlying protocol is peer-to-peer sync, so the mesh is really just a bunch of geographically distributed servers that sync between each other as needed and act as "one giant syncing & persistence peer" for your app - mostly so you can sync stuff between devices even if they're not online at the same time, and to use it like cloud storage (I like to call it "S3 for collaborative data")
- s17n 2y agoThe first question I have when I visit the site is, how is this different from Firebase?
- theanzelm 2y agoOn a high level, it solves a similar problem: a full backend so you mostly only have to write a frontend. But Jazz does so in a completely different (local-first) way: it implements shared state on top of CRDTs and implements user identity and permissions based on public-key cryptography. This means you can create, store and share data from the client (even while offline) while still benefitting from cloud storage and real-time sync between devices and users by default.
- chr15m 2y ago
- graypegg 2y agoEdit: This IS being used to build a product, see reply below One thing I always find weird about these sorts of projects is I get the feeling this is a framework built up from scratch. I've always had really bad luck doing that. Extracting and refining something from a running application always feels like you catch the cases that actually matter. It's neat that it's quick to start, but I think that's mostly because the framework has only been evaluated by making tiny toy examples. Staying reaaaaally close to the framework code is sort of like painting with your nose against the canvas. At the scale of features you want to fit in: - live sync - authorization - video chat - an open connection to your DB, presumably meaning this is your main data fetching API you're basically building 20% of someones else's app that currently doesn't exist. Once it does exist, it'll only be a simple toy example for a short while. It's sensibly licensed though (MIT), and honestly, skimming the source, seems clean to work with! I hope people using this contribute back to it, to get over that starter-project hurdle.
- theanzelm 2y agoJazz is built specifically for a work-in-progress, but full app (essentially a Notion clone, TBA) and all the design choices are driven by that. Completely agree that this is the only way to create frameworks. Edit: also other people are building full apps with it too which I’ll showcase soon. https://learn-anything.xyz/ https://learn-anything.xyz/ is one example, https://invoiceradar.com/ https://invoiceradar.com/ is another.
- graypegg 2y agoOh neat! I stand corrected then! That's really cool! Definitely get that showcase up, I think it just helps to confirm this isn't one of those stealth-mode "solves everything" dev tools that disappears along with it's VC funding.
- salomonk_mur 2y agoThat first link is great. Thank you so much for sharing it.
- squidsoup 2y agoYou missed an opportunity to call the free tier of your mesh service "free jazz".
- theanzelm 2y agoGreat idea!
- bcye 2y agoAwesome project! fyi on latest Chrome the navigation items blog, releases, roadmap are aligned top/start instead of center for me
- theanzelm 2y agothanks for letting me know!
- cyanydeez 2y agoNice, but react.
- timolins 2y agoI love building with Jazz. It's so refreshing to build apps without thinking about backends. The number one thing I'm looking forward to is React Native support. Having local data that syncs is essential for many mobile apps, but there are no easy solutions yet. (Besides iCloud, which is limited to iOS/macOS) With Jazz, I can see a future where building syncing, cross-platform apps becomes effortless.
- theanzelm 2y agoThanks, Timo! Couldn't ask for better early adopters than you guys
- aboodman 2y agoVery excited to see this. I think this is currently the most promising of the fully-decentralized local-first systems I've seen.
- theanzelm 2y agoThanks, Aaron!
- bbojan 2y agoHow does this compare to Instant (https://www.instantdb.com/ https://www.instantdb.com/)?
- aboodman 2y agoJazz is decentralized. There is no central server. See: https://x.com/aboodman/status/1843045692736204802 https://x.com/aboodman/status/1843045692736204802
- aboodman 2y agoAlso Instant is a database (it has queries and so forth, more appropriate for bigger data). I would put Jazz at the document sync side of the spectrum: https://x.com/aboodman/status/1843042582672355834 https://x.com/aboodman/status/1843042582672355834
- theanzelm 2y agoThis is fair, thanks for chipping in, Aaron! With decentralised I always like to be very precise: - Jazz is decentralised in a "source of truth" sense. You mutate data locally and sync edits between participants until you reach eventually consistent history (and thus state, as per the underlying CRDTs) - the protocol is peer-to-peer - the way you use it typically is in a very centralised way. You use a central sync and persistence peer (either your own, or my distributed Jazz Mesh service) and every device syncs to that. That way devices don't have to be online at the same time to sync
- aboodman 2y agoMakes sense. This is a smart tradeoff.
- Ey7NFZ3P0nzAe 2y agoNice. Is there a way to add an rss feed? Can't seem to make the newsletter subscription work (could totally be my fault) Also, do you think there will be a way to use python with it?
- theanzelm 2y agoI think the email newsletter is broken, sorry! Best way to follow it is Twitter and joining the Discord https://discord.gg/sesjU2W5 https://discord.gg/sesjU2W5 I haven't had someone ask for Python yet, but I want to eventually support as many environments as possible. Which use-case do you have in mind?
- ccorcos 2y agoNice abstractions. Though I worry they’re going to be too rigid for some applications. - how can I setup delivery receipts for messages in your chat app? I want to know if they got my message and when it was sent. - how can I create a chat group where the entire list of access permissions is not transparently available to everyone? For example, customer support: I don’t want to give out a list of every employee because a customer opens a chat that any employee and respond to. - how are you handling p2p sync to multiple devices with the same account? Are all of my devices made public to anyone I collaborate with? Or does one device always need to be online?
- theanzelm 2y ago- add a “read” property to Message that the other person sets - groups not only allow adding exact accounts, but also allow for “invites” which in your example only one employee could accept for a new support chat - devices aren’t synced p2p by default but through the syncing server like everything else. Right now, all devices in one account use the same keypair for signing, so people you collaborate with can’t tell (except that they’re using different anonymous session ids)
- stanislavb 2y agoAn interesting project and looks quite promising. I will be keeping an eye on it. The source code can be found here https://github.com/gardencmp/jazz https://github.com/gardencmp/jazz (TypeScript).
- Andrex 2y agoCurious how this compares with Meteor.
- theanzelm 2y agoMeteor works on top of a traditional backend (typically MongoDB afaik?) to give you full-stack reactivity. Jazz implements essentially a distributed database with permissions based on public-key cryptography, so you can meaningfully create, edit, share and store data on the client (even while offline), which gets synced to other users and devices (and stored in the cloud) whenever you're online
- azeirah 2y agoIs this synchronisation (theoretically) possible over p2p communication protocols like Bluetooth or wifi direct? I would more than love to have local networks that can be emergent and growing and shrinking in this way. Reminds me of my student days when I was traveling in the train, wondering why we couldn't have a p2p social network for people who are in this train _right now_
- theanzelm 2y agoyes! The hard part that Jazz doesn't solve is peer discovery. If you give Jazz a peer and a transport mechanism it will happily sync to it
- avodonosov 2y agoReminded me of the Google Realtime API, killed by google 6 years ago. https://developers.google.com/google-apps/realtime/overview https://developers.google.com/google-apps/realtime/overview This one is open source, thus hopefully a safer choice.
- theanzelm 2y agoEven with the high failure rate of startups, I hope I'll do infinitely better than Google's certain product death (plus yeah, it's open source)
- avodonosov 2y agoHow difficult it is to self host? Is backend (the mesh) also open source?
- theanzelm 2y agoyes a simple version of it is! npx jazz-run sync
- Doorknob8479 2y agoReally interesting. Looking over their github, seems that at its core is a CRDT JSON structure with encryption and permissions built in. Storage, transport and auth are agnostic, but they offer some flavors (sqlite, websockets, clerk, react, nodejs). We're interested in svelte and rust support for now. Looks like the local-first space is gaining traction. Probably this is the most interesting execution so far.
- theanzelm 2y agoThanks for sharing your overview and for the kind words. I recently hired someone who is a big svelte fan so we’ll have bindings for that soon. Rust is coming a bit later.
- gr__or 2y agoI'm jazzed about Jazz, I think Anselm got the priorities right and I'm excited to use it soon. If you get the chance to hear him talk about it, I highly recommend that too!
- theanzelm 2y agoThanks, whoever you are!
- elikarad 2y ago[dead]
- janpmz 2y agoMy first thoughts after visiting the webiste: People will be quick to create apps with this. But what happens if I want to implement something that is not supported by the framework yet? That is a common problem with frameworks in my experience.
- theanzelm 2y agoRight now we build features exactly when early adopters need them. What's an example of something you're concerned about?
- huhtenberg 2y agoOpening a demo chat app URL in Private Mode in Firefox results in perpetual "Loading..." screen and the following error on the console: Uncaught (in promise) DOMException: A mutation operation was attempted on a database that did not allow mutations.
- theanzelm 2y agoThanks for reporting, created an issue: https://github.com/gardencmp/jazz/issues/498 https://github.com/gardencmp/jazz/issues/498 In this case we should fall back to using in-memory state only
- Deen101 2y agoSounds promising.
- dalben 2y agoThis is absolutely fantastic! I have been looking on and off for something like this for years (some of the things I have used are CouchDB, command/event sourcing, and ditto.live). I have not been able to read the docs fully, but some questions: * How do you handle state that is too big to send to the client fully? In a chat application, does the client need to have the whole channel history, or is syncing a subset of that supported? * Does permissioning support partial CoValues? For example, "You can edit the contents but not the title of the 'blog post #11' object" * Do you have resources about the suggested data modelling? Things like how granular should a CoValue be and what the trade-offs are. * How do you handle deletion? Do you tombstone? Is there a way to fully scrub a value from history (to support, for example, GDPR's right to erasure)?
- theanzelm 2y ago- Jazz is built with granular syncing in mind. CoValues are meant to be small (think one level of a JSON tree) and then reference each other. You only resolve references and sync as far down as you need / in lists you can do pagination. - CoValues can reference CoValues that belong to a different group and thus have different permissions. In your example the title would need to live in its own CoValue and group compared to the content, which is a tiny bit more setup, but totally viable - no resources for data modelling yet, but the guide + example apps should give you a very good idea. If you have any questions, please ask on Discord! https://discord.gg/sesjU2W5 https://discord.gg/sesjU2W5 - deletion is typically soft-deletion with tombstones. Total erasure of entire CoValues is coming soon but should only be needed in compliance situations (such as GDPR)
- MrGreenTea 2y agoThis looks very like a promising addition to the local-first space. Thanks for your work! Are there plans for supporting dart/Flutter as well in the future?
- theanzelm 2y agoWe want to support as many environments as possible and are doing them in order of easiest & most requested - you are the first one to ask about Dart/Flutter React Native is released (experimental) After that will be really good support for Next.JS (Jazz for both SSR and client) A bit later will probably be a Rust port, which then also makes bindings to Swift/Kotlin/Go/... easy
- somishere 2y agoNot sure if this question belongs on this post but kinda interested in how validation and e.g data schema enforcement work in local first / distributed infrastructure. Assume this is built into the way you think about the model (and my mental model definitely isn't there yet), but having read the permissions part of the jazz docs (on/off?) and thinking about how client-first platforms like firebase do it with private rules on a centralised server .. I don't get it. Is it possible to do complex validation against e.g writes? Is it a natural state of CRDTs, somehow handled in the PKC, or just a side effect of the data models demanded of the setup? Any info or pointers to further reading would be ace!
- theanzelm 2y agoRight now, we're not doing complex validation very well, we basically rely on all clients having the same schema or backwards-compatible schemas and prevent errors at the type level. But because the schemas are runtime constructs as well, we might be able to do more complex stuff in the future. Basically any rule you can express as a function of (previous history, new transaction) -> is new transaction valid? can be a rule in theory, and each client will verify it in an eventually consistent way. For the time being, the Group abstraction with it's reader, writer and admin roles, plus composition of CoValues in different groups is sufficient for most permission-like rules, which is what most apps need most of the time. Let me know if that makes sense
- somishere 2y agoHey, thanks for the response. This does make sense. The group roles do seem relatively powerful. I guess what I'm probably getting at is how does it hold from a threat perspective? What is to stop an actor distributing something extra large or unscrupulous between nodes. TS is notoriously hard to use for validation within types (e.g. string of max length, number between), but clearly covalues go beyond this. Anyway, I'm writing this having not yet tried the framework. So I'll do that first and then do some further reading, and then jump onto the discord if I have more questions. Cheers.
- novoreorx 2y agoIt seems to be an InstantDB alternative that integrates more closely with React.
- theanzelm 2y agoYes, plus it’s actually local-first (works offline) and you don’t have to trust the syncing & persistence infrastructure because only encrypted edits are synced! Also you can use it as blog storage as well
- novoreorx 2y agoSounds interesting, is it SaaS-only or self-hostable?
- theanzelm 2y agoself-hostable! https://news.ycombinator.com/item?id=41777266 https://news.ycombinator.com/item?id=41777266
- fivestones 2y agoSo it if I already have an app using instantdb, how hard would it be to switch to jazz? Does it work in a very similar way? Or would it likely require a lot of code modification?
- jbkkd 2y agoHow do this compare (or differ) to PartyKit?
- theanzelm 2y agoPartykit is mostly an abstraction on top of Cloudflare Durable Objects and offers simplified Websockets for room-like multiplayer. Jazz is a framework for building apps around locally mutable collaborative values which are granularly synced (you don't have to worry about data transport or coordinating sync between collaborators, you just set permissions and edit data)
- jcmontx 2y agoIs this like a client-first actors framework? (i.e. Orleans)
- theanzelm 2y agoYes, from my quick understanding of Orleans! In the web world, this is starting to be known as "local-first"
- rtcoms 2y agoCan I make end-to-end encrypted application using it? Currently making apps using convex.dev, how would you describe differnce between Jazz and Convex ? Convex have their own db, would Jazz work with any database ?
- olvn 2y agoanyone thinking about hanging their hat on writing decentralized, local first, crdt-driven software should also consider the complexity of changing your schema when there are potentially thousands of clients with different opinions of what that schema should be. some interesting research has been done[1] in this domain but i haven't seen any library of this ilk that supports real-world schema evolution in a way doesn't make me really, really wish i had a proper backend to lay down the law. the fact that migrations are in a "coming soon" state makes me wary of using jazz, and i wonder how they would approach this problem with the library as it is now. [1] https://www.inkandswitch.com/cambria/ https://www.inkandswitch.com/cambria/
- Feathercrown 2y agoCouldn't you just use api/schema versioning?
- Elucalidavah 2y agoYou could of course effectively create a new database whenever you make a new schema. But that's not exactly convenient for the users.
- mentalgear 2y agoI think he meant up/down data transformation migrations, not entire new dbs or collections.
- theanzelm 2y agoIt’s a tough problem! I think 90% of it is solved with GraphQL/ protobuf like rules (“only ever introduce new fields”) There are some edge cases where you might loose easy access to some data if two clients migrate concurrently, but we’re hoping to provide patterns to mitigate these Edit: Right now it all depends on you to implement migrations “the right way” but we hope to provide guardrails soon
- klabb3 2y ago
- nmca 2y agoSeems very promising! Couple of qs: 1) How high is the pubkey overhead / isn’t this a lot of cryptography? 2) How do migrations work?
- mrbluecoat 2y agoReminds me of https://github.com/amark/gun https://github.com/amark/gun
- pcthrowaway 2y agoIf both projects merge they can call it Spirit Finger Guns
- beorno 2y agoI guess it would be nice to see a comparison with other CRDTs (Automerge, Yjs, Loro) and syncing frameworks/databases (PowerSync, RxDB, SignalDB, InstantDB).
- theanzelm 2y agoThere might be a vendor neutral comparison page between technologies soon that we’ll be part of
- mentalgear 2y agoKudos on the vendor-neutral ! Too many vendors doing their own "comparisons" which only list the features their tech excels in.
- didip 2y agoWhat about Golang support?
- mentalgear 2y agoKudos to your work - I have been following the project for a while and it's impressive what you have build mostly by yourself and without any of the usual VC funding!
- theanzelm 2y agoThank you! Disclaimer: as of recently I have funding but the approach will stay the same!
- mcrakhman 2y agoHi! So wondering how did you solve collaboration issues using CRDTs exclusively. So I suppose that for a db you have an encryption key and then you have users with different rights, some of which can remove the other ones (let's call them admins or whatever). If your db has a certain encryption key then it should be known to all current members. Also if you remove a person he/she should not be able do decrypt new messages in the db. So suppose you have 4 people, Alice, Bob, Clark and David, where Alice and Clark are "admins". A network partitioning happens and Alice removes Bob, so Alice changes an encryption key to X and sends a message to everybody, concurrently without knowing about the Alice's removal Clark removes David and also changes and encryption key to Y and sends a message to everyone. So in this case if we allow the generation of new keys to happen simultaneously (without consensus) one of the deletions will not be effective, because what we wanted is both Bob and David to be removed and not know the new encryption key for the db. But now Bob knows Y and David knows X. Thus neither X, nor Y can be the encryption key, because it is known by one of the deleted persons. Sorry for the long explanation, but I am wondering what is your solution to such a problem.
- d-z-m 2y agoLooks cool! a bit of crypto hygiene though, I'd recommend passing the ECDH output through a KDF before using it in xsalsa20-poly1305. Also, if you're using xsalsa20 anyway, why go through the trouble of doing incremental n0nces? One of the main benefits of opting for an extended-n0nce construction is that it simplifies n0nce handling greatly. Why not randomly generate the 24 byte n0nce and forget about the tricky and error prone project of ensuring n0nce uniqueness?