Hacker News Reader

Comment by pmarreck | Hacker News Reader

There needs to be a thread on "newish online tools that everyone is starting to depend on or love" because I had never even heard of this domain/product until this news.

Apparently, neither did the Quip toothbrush people.

How is Quip better than good old Google Docs?

EDIT: Just looking at it, it looks very reminiscent of Apache Wave, which I was (unfortunately) a fan of. I wonder if it was inspired by it?

EDIT 2: It seems that Quip, unlike Google Docs, is end to end encrypted, which makes it possible to use on corporate intranets that normally forbid tools like Google Docs for security reasons. Hrm.

EDIT 3: Might as well plug the newest thing _I_'ve heard of. https://discordapp.com/ is a great voice chat client, intended for gaming but surely useful for productive ends. It's Erlang-backed, as well. Seems to have great connection quality and is just a nice, fun app.

View on HN

Preface: My team has been using quip for the past 6 months (and switched from google docs). The value is in the collaboration tools.

Quip has inline comments and document level comments, chat rooms, private chat, and the ability to tag people and documents anywhere. It's a really powerful collaboration mechanism especially for remote teams, and cuts down on emails.

It's extremely intuitive for digital natives, but completely turns how one views documents (as static and entirely separate from the comments on them) on it's head. It's less friendly to people who are long time MS Office users.

> Quip has inline comments and document level comments, chat rooms, private chat, and the ability to tag people and documents anywhere. It's a really powerful collaboration mechanism especially for remote teams, and cuts down on emails.

Google Docs has all of this (I've used all of it for the past 5-ish years). Is there something specific Quip does better?

> Quip has inline comments and document level comments, chat rooms, private chat, and the ability to tag people and documents anywhere.

I think Google Docs has all of the above.

Yea, its a clone with chat stuck on.

I don't like Quip. Too slow. Collaborative editing works much better in Google Docs. Can't do proper headings/subheadings or TOC. Just a few of the issues that jumped out at me.

Interesting.

Google Docs seems to cover most of this already, and is free.

The fact that a for-pay competitor to Google Docs (adding in in-context chat and everywhere-tagging) is finding success, is very interesting.

I wonder if there's a market for an end to end encrypted collab tool... all I could find was https://www.crypho.com/ which seems fairly basic.

I recommended using discord in order to do voicechat with the team I'm on. Most other teams use something like talky.io or appear.in.

Give me an application anyday.

I think it's a pretty well-done app!

That's basically Product Hunt

I'd like something that doesn't show apps when they are brand new, but features ones that stand the test of (a little bit of) time and have proven useful beyond the initial launch phase.

Maybe it's just me getting older...

Product Gather ? :)

Seriously, there are several sites that review apps, actually way too many of them.

One I've found myself using a few times is StackShare - http://stackshare.io/ . It's lacking ot the "review" side though.

Fair enough, I don't visit that site enough.

Just curious, in what way does Google docs not have "end to end" encryption?

It's HTTPS to them, then it's "inside their systems in some unknown form", then it's HTTPS to whoever else looks at it.

Basically, there's nothing preventing Google themselves from looking at your Docs data in cleartext. And that's bad for corps who want total privacy.

I think it is worth pointing out that 1) you have no idea what Quip does with the data once it gets past their web server 2) there is no mention of "end to end" in Quip's security document https://quip.com/ABbYAZsD8nbt

You can run Quip on premises, and it's functional without an Internet connection. So if the security picture matters that much there is an option (priced rather well, too).

There are a number of "shadow IT" single-admin Quip instances popping up both in systems I'm aware of and those I hear about from other folks, so I'm guessing it's easy to administer. I know it works without Internet connectivity because I saw someone install it in an environment that intentionally has no access.

I've always wanted Google Docs on prem so if Quip is it, that's interesting in itself especially for the security reasons. But, Google has incredibly stringent controls around user data after a particular press-involved incident involving an SRE, so while the paranoia of possibilities is well-founded, in practice they'd need a damned good reason (like a critical failure in the product) to even look. They can, and do, walk employees for getting this stuff wrong.

So theoretically, yes (good security mind), practically, not likely.

Thanks for pointing out it can be run locally. That's a win IMO.

What was the Google incident?

David Barksdale. To be clear, though, if one squints he did leave a positive legacy in many more forms and technical barriers on the way to a log entry. Not all him, but a lot.

Good lesson to learn for all of us with administrator access, too, about not even trusting inside folks. The DBIR is compelling here.

You're right. I read too much into the "Security/Privacy" section of their website.

So what's the real selling point, then? Like I said it seems like a hybrid of Google Docs and Google Wave.

That's essentially exactly what it is. Our team got a demo from them trying to determine the best tool for our use-case and we simply couldn't justify it over google docs for how we do things, especially since we were already setup on the google apps platform for our domain.

Yeah I didn't get his comment either. I read their security document. They use SSL to encrypt traffic in transit. That is all. It's not encrypted at rest or in any other fashion. Big deal almost everything is SSL these days during transit the big sales point that catches MY eye are products that encrypt your data at rest like tarsnap, where no one, including the state can access it. THAT is the only products I will use or trust. These guys mine your data just like Google. Don't kid yourself.

While you're right to be suspicious — of any hosted product, really, especially biz intel things like this and Slack — I think you got ahead of yourself in the last couple of sentences. A does not necessarily imply B there. (I'm not kidding myself.)

Answered here https://news.ycombinator.com/item?id=12207328 but in short, you're correct, I made a bad assumption.

The documents are still human readable when I edit them. I am left to assume that in quip, you edit the raw ciphertext manually.

Data at rest is not guaranteed to be encrypted.

I don't see anything in their site about end to encryption?

Ah, you're right. Perhaps I read too far into the "Security/Privacy" section here: https://quip.com/about/tour

One reason I prefer Quip over Google Docs is that it simply works a lot better. I have no end of weird issues in Google Docs where input freezes up or drops characters. In their own browser! Quip has been rock solid for me. Their desktop app works well too.

For working in teams I like how well shared document organization works.

I've never had any of these issues you've faced with Docs and I've been using it for over 6 years.

(Since you asked for it...) We've been working on something similar at Nylas, trying to build next-gen email. Lots of our users also use Quip, plus our app is open source. https://nylas.com/

This subthread is quite offtopic now, but I'm a happy Nylas pro user (and something of an email client nerd). Keep up the great work!

Definitely worth a look for those who haven't heard of it before.

Thanks for the kind words! :) Feel free to send me any feedback you have. (I'm one of the co-founders.)

Thanks for sharing that link! No mention of encryption or security on the features page is what personally turns me away. You don't even mention security :(

This is what frightens me in 2016. Apps are being developed where security is not the primary constraint. After everything we've learned about warrantless wiretapping, the NSA collecting everything, etc it's like nothing will wake some people up that they need to adjust to the new paradigm that security MUST be the primary constraint. Sigh.

https://nylas.com/security/ (buried under the More menu)

Thanks! I saw that after more digging. It still should be under features IMO. And they say in "Level 2" security data is encrypted at rest. Who holds the keys? They should make that clear. It should only be trusted if the end user holds the keys.

Reply on news.ycombinator.com