I just listened to a podcast episode of the Flying High with Flutter podcast [1] where Celest founder, Dillon, was on as a guest. He came across as capable, hungry to get Celest out into the world, and focussed on solving problems around running dart in the cloud. All the best, Dillon, I'm looking forward to see where Celest goes!
I appreciate the transparency on the issue, like how proposed solutions discussed publicly in an instructive way, e.g.:
> Other options that had been proposed early on included sanitizing the input. But this approach was described as "extremely tricky to get right (after all, vega failing at it is how we landed in this situation)."
Also interesting to see how implementation details bubble up to strategic considerations; e.g. how the decision to use iframes or not is linked to impact on mission.
I'm working on a tool for sharing things like API keys using encryption apis built into the browsers, https://www.oncer.io.
What I'm working on at the moment, and am sort of stuck on, on is how to make a web app doing in-browser encryption secure - since the server delivers the code that does the encryption in the browser, users sort of have to trust the server anyway to deliver that code. I would like to at least somehow, maybe through a browser extension, assure the user that the version of the web app running in the browser is at least is the same as the build output for a given release in the repo on GitLab/GitHub/the like maybe... then it's sort of like 2FA in the reverse direction, 2 sources (https server connection + extension doing code check) confirm that the real web app has been delivered to the browser.
Appreciate any thoughts on this head scratcher! Maybe there's some way to assure the web app code integrity I just don't know about! :)
Encrypted messages without history - for when you want to send an api key or password or the like and don't want it sitting in the recipients WhatsApp/Signal history, for example, or going over non-encrypted channels like email or Slack. And you don't want to set up a complicated encryption messaging thing. There are similar services already: e.g. onetimesecret, burnernote - but I wanted something that did encryption client side. I also wanted to set up channels, to send multiple messages between 2 devices without doing "trust on first use" for each new message.
The encryption takes place in the browser - if you're a developer: you can even use browser devtools debugging/network sections to confirm the private key never leaves your device.
I plan to work on the ux, and also further strengthen the encryption (e.g. does the signal protocol work for this...? will implement something that should provide some form of forward secrecy in any case), and make a Flutter-based client so it's super convenient to use on all platforms (maybe also enable things like nfc-based key change...).
Would be very interested to hear from anyone who would like to help! :)
[1] https://podcasts.apple.com/us/podcast/celest-the-flutter-clo...