Why not have the same route for the same content, and use HTTP methods like GET, POST, PUT, DELETE?

I wouldn't trust his conclusions about anything he wrote given he 100% vibe coded the tests that compare wasm to js.

Even if you are completely vibecoding and want to know wasm vs js, his results are specific to both the LLM and the version of the LLM at the time he ran the tests. There are dramatic changes from month to month going on in LLM's. So everything he did is kind of useless.

Hi, i'm an admin on the lemmy.ml instance where you also posted this.

You asked in your other post in !privacy@lemmy.ml (which I was going to delete for being privacy snake-oil, but someone else beat me to it):

what would you want from a tool like this to trust it?

For one thing, I would want the ability to download the whole thing (models included) in a single step, to be able to actually be sure I'm using this offline (without taking my computer offline).

Using this kind of "nothing is uploaded, we promise" application on a website leaves the user relying on the website to keep its promise: even if the javascript has been reviewed and doesn't usually upload a file, a user can't ever be sure (without going offline after loading the page, which is very inconvenient and also a fragile guarantee at best given webworkers and various other browser technology) that the server isn't sending some different javascript this time which will actually exfiltrate their secrets.

I also don't want an AppImage, because then I would need to trust you much more - an AppImage can do far more damage than a malicious webpage! And also I see your AppImage is only 170MB, so it obviously doesn't include all of the models... so it itself also needs internet access.

If what the site says is true, I should be able to host the whole thing with a local static webserver and access it using a browser which I deny internet access to (eg configure it to use a nonexistent proxy and let connections to 127.0.0.1 bypass the proxy, or, better, run it in a different network namespace where it cannot reach the internet at all). If you have some way to predownload all of the models for people to use this in an offline browser like this, you should make that clearer and easier to find.

But, beyond that, I think you've also got a long way to go before you can credibly suggest this as a security and privacy tool. I've only had a quick glance at what you've built so far, and the breadth of features is certainly amazing.

However your first (and so far only) tool which I actually looked somewhat closely at - "Secret Note Link", source code here - is misleading users by offering them an "expiry" feature which is trivially circumventable. This is obvious to any technically savvy user who thinks for a moment about the impossibility of enforcing an expiry policy in this context (where the data is stored in the URL and not on a server), but i think the overwhelming majority people seeing this feature will not infer its pointlessness and will assume incorrectly that it actually works. This incorrect assumption is reinforced by the fact that this privacy-cosplay expiration feature is for some inexplicable reason enabled by default, with a one day expiration.

It's also weird to be hyping the AES aspect of your "secret link" when the default setting is to use no passphrase (which, looking at the source code, I see means that you still encrypt but with a random key which you include in the url fragment alongside the ciphertext). Without a passphrase, maintaining the secrecy of the link is all that can keep the payload secret. Encryption provides no benefit whatsoever in that case; you may as well just gzip and base64 the plaintext and put that in the fragment instead instead of using AES.... or, just send the plaintext instead of sending a "secret" link at all (although given the way mobile phones work having a way to send base64-encoded text is maybe actually useful 🤡). The pointlessness of the encryption here is obvious to some people, but not to most of your target audience.

screenshot of 'Secret Note Link' as it looked at the time this comment was written

I think you should remove the expiry and no-passphrase key-concatenated-with-ciphertext features altogether, and ask your agent to review all of the other tools in light of this feedback to look for and remediate similar cases of snake oil.

I was going to remove your post from !privacy@lemmy.ml but leave the one in !opensource@lemmy.ml, but someone else removed both while I was writing this. I was going to say about the latter: I removed your post in !privacy@lemmy.ml but I'm leaving this one for now on the assumption that many of the tools that you have created are probably actually useful. fyi you should know that you're probably going to receive a lot of negative feedback posting this here (see the discussion in the post currently pinned at the top of this (/c/opensource) community).

I think you probably have good intentions so I am unbanning you from lemmy.ml (but not undeleting your posts to communities on this instance), and I'm posting this comment here in another community on another instance instead.

HTH.

Fair point, thanks. The write-up was too long and leaned on AI, and I should have kept it short. The difference from Flickchart is that Wochly covers TV shows as well as movies, and shows what's top-rated on the streaming services you actually have. If you want to try it, you can rank 3 titles with no signup: https://movie-app-nu-ruby-23.vercel.app/

I've been thinking about this, and I do think it's a great form of degradation. I would love to see more sites that are statically rendered, but under load dynamic features are removed.

Yeah, but then it's not static anymore. Your hosting options change, your threat model changes, it's a whole different game.

Static sites with things like CGI "endpoints" were a thing back in the day. There's no need for URLs to have a 1:1 mapping to the filesystem, you can have a half static and half dynamic site if needed.

I take it no source ? Is this all js ? What’s the backened? Are you using just canvas api?

Key word here being a static site.

That makes some sense. Much easier than I thought.

I might sound like a caveman stuck in 1995, but... Aren't forms just "send this info back to the server"? If your form points to an appropriate page you own (fill-the-form.php -> validate-form.php -> success.php), there's no 3rd party involved.

You'd use a reverse proxy like nginx to route requests to the server you want to respond with.

I'm looking into static generated sites again.. (never created one professionally), how do you handle forms without passing it off to third party?

I have interest in zola but wondering if anyone has hacked it to allow some backend manipulation. I know it kind of defeats the purpose but interested in some minimal backend use cases.

I guess you could pass off to something like backend(.) mysite(.)com

nobody cares about your website, its not the point here. if you want to go into technical detail on the specifics of a mysql search mechanic.. then do that.

correct; 'post not good'

• lowercase letters only
• spamming your web site
• no SQL content

1/10

I read a lot on printed papers these days

Well you are obviously not the norm XD

Though of course simple, fast pages are amazing. Or normal? They should be easy to convert to darkmode locally, use with a screenreader etc.

https://purecss.com/

im just posting about my web developement journy and though it was right to add the website im talking about

lol

i dont understand why so rude .. is the post not good?

Just going to drop a link to your site like a spammer? Not even going to do some performance comparisons to your slop vs the inbuilt statement?

Scroll driven animations 🙌

You should add an option to check ALL streaming services. Torrent users don't care where something is hosted

Pairwise ranking is definitely better than stars, but nobody wants to read your slop, sorry.

Google shows there are lots of these already: Flickchart, Canonova (slop), moup.app (also slop), popcornlist (possibly slop but they at least wrote their own prose so they get a pass, though it is an iPhone app only), pairckle (generic pairwise ranking, not slop!)

Also it doesn't sound like you have figured out how to actually do the ranking yet. Look up Bradley-Terry or TrueSkill.

As usually, the difficult bit is getting users.

All I know is they finally, finally fixed the Twitch emoji bug where it disappears when you type it in FF160 so that's the release I'm really excited about.