Desktop: [Feature Request] Option to choose to sync data without SN servers

[calvadosxo]

For context, i will cite user Callahad from the subreddit:

If the Standard Notes server was actively compromised (or the author was compelled by their government), then it could send you an edited version of the app which saves and transmits your decryption key when you type in your password. For example, Hushmail was compelled to compromise users' privacy in a similar manner.

I know it is possible for a high tech user to configure some complicated self hosting system with Standard File, but for normal users this is not a solution.

What would be nice is for the user to choose where the data to be synced is stored, for example right on the user local machine to be sync with mobile app using syncthing, or using other hosting service of choice like Google Drive and then sync from that on mobile app.

[joshuarli]

The Standard Notes syncing process isn't as simple as file synchronization (e.g. rsync) - the client/server relationship involves the Standard File protocol, which requires a self-hosted Standard File server if you don't want to use the default official server.

I don't think what you're describing is feasible.

[calvadosxo]

Using the backup function to send an encrypted backup to the cloud is easy at the moment with cryptomator. It just lack the automatic function. What if:

1) setup the directory where the local backup go unencrypted
2) setup that directory to be in a Cryptomator vault
3) setup that directory to sync with, say, Google Drive using google's sync program
4) make it so the desktop SN automatically sync with that unencrypted backup file in that local vault
5) make it so that the mobile SN sync with mobile Cryptomator

[mobitar]

The scenario described by the reddit comment really only applies to the web app. The desktop app would require a hard update to modify any behavior. Whereas the web app is loaded freshly from our servers every time.

As for modifying the sync location, the desktop might be able to change the default data directory, but that's about it. You wouldn't be able to sync that data directory with mobile as the format is desktop-specific and abstracted from the SN app.

[calvadosxo]

Aren't hard updates frequent, like a few times a year? A user need to update the desktop app to make sure it got the security updates anyway.

[mobitar]

Right, but this isn't really a relative problem as much as it's a general software problem—software updates introduce changes. Our changes are always open-source, so that helps. But here we're talking about "If the Standard Notes server was actively compromised"—in this case, if our server was compromised, our desktop and mobile apps would not be. Only the web app would potentially be.

[calvadosxo]

Ok that's what I was thinking then.

So to bypass all these potential security risks, would it be possible to sync local data without using you servers and without needing to be IT professionals that can mount and maintain servers? That way, apps like Littlesnitch could make sure the potential compromised hard update is not talking to the internet.

[mobitar]

It's not possible now, but is an interesting idea. Would require some major changes to the architecture. I'll keep this in mind. How would you sync with mobile?

[calvadosxo]

I am thinking of Syncthing coupled with cyptomator, or any public hosting like Google drive and cryptmator. Cryptomator will have a new feature to support third patry apps to give access to the vault files, so that would be perfect if Standard Notes Android could coordinate with it.

[mobitar]

Encryption wouldn't really be the problem, as it would be easy to set use a local app passcode to encrypt the file. But, interesting, I'll keep this in mind.

[calvadosxo]

Oh yes you're right :)

[meguroyama]

Hi, I'd like to add my 5 cents here. In some environments ( people with local NAS or NFS share ). Ability to sync live from a single file on the local network ( with password to lock ) would be fantastic. Currently this is the only reason I am currently not using this tool everywhere instead of just using it personally.

And I'd like to add that running the local server ( though also an option ), using just a file stored on a network share would be a fantastic feature.

[gynet]

@mobitar Thanks for you effort for standardnotes, the app and all The extensions are all great. The only thing blocking me to use standardnotes is missing the ability to sync with directory offline, it would give users more flexibility. With the feature, I think more ppl will like using standardnotes and may want be a extended user.

[mobitar]

@gynet regarding offline sync, you do currently have this option:

Use the app without an account. This will save all data locally, and backups will be created automatically in your home directory. You can manage the backups location via the top-level Backups menu. If you add a local passcode, then these backups will be automatically encrypted.

You can even change the backups directory to a synced folder, like Dropbox or something similar. This way, you have added redundancy.

[calvadosxo]

Is it possible to sync to webdav with the mobile app yet?

If so, there would only be two things left to keep me from using SN:

1) I have to pay the same sum of money to use the extensions and use it offline without the SN server as someone using the SN server. Maybe make another price for people who wants to use offline SN with extensions? After all, not using the SN server is costless on your side, server wise.

2) nested tags and folders are not yet on mobile app

By the way, congrats on the development, it's pretty awesome that you managed to introduce so many new great features in 2018 :)

[mobitar]

@calvadosxo It's not possible to do _actual_ sync to anywhere but our open-source server. The mechanisms I describe above are only to store daily backups, but not real time sync. Whether third-party sync will be possible at all remains to be seen :)