Hacker News new | ask | show | jobs
by davefp 2255 days ago
Notify17 looks great, and I plan on giving it a go.

However, since their example is a curl with plaintext body, I question their assertion that "Whatever your content is, we will never know about it".

It sounds to me more like the content is encrypted at rest, which is important but I still have to trust that N17 isn't squirreling away a plaintext copy or accidentally leaking it via logs or something similar.

2 comments

Hi, Notify17 author here :)

I just wanted to point out that there is not a single part of the flow which is not encrypted at rest, and, apart from text-processing areas, in transit.

All user-content arguments sent to the hook endpoints (to generate notifications) are obscured for the whole flow of the notification generation. Which causes trouble when trying to debug issues, but oh well, I believe privacy is more important than anything else in this context.

I dream for this tool to be used by devops people (I'm mainly one of them!), so I value the privacy element in this project above all. It happens that I end up asking users "what the hell did you type there to break things to much" :D

For the matter of logs, I'm so happy about having used Go for this project, because I can mask fields here and there nicely (e.g. https://github.com/cmaster11/structs/blob/master/structs.go#... ).

One similar self-hosted solution is https://gotify.net/ , which also has Android and web apps and a similarly simple way to push messages using curl/http.
This looks great, but this is similarly not encrypted, right? Google/Apple will be able to read all my notifications, no?

The only way I've found to do encrypted notifications is using Signal and signald, through a library I wrote:

https://gitlab.com/stavros/pysignald

signald isn't as reliable as I'd like, but it works well enough. Still, if there were a simpler alternative, I'd switch.