Hacker News Reader

Hister supports token based, password based, and OIDC/OAuth authentications with optional multi-user handling. Details about user handling can be found here: https://hister.org/docs/user-handling

It also has a "public mode" where anyone can search the indexed content, but only authenticated users can add or modify it.

View on HN

It seemed like the public mode was the default when I set it up. If so, that’s a fairly dangerous default as keeping a “clean” history with no secrets leaked seems neigh impossible.

The default configuration binds only to localhost, and a fresh installation starts with an empty database/index. Could you clarify which specific attack surface you are concerned about in that scenario?

I’m not concerned about an attack scenario. I’m just saying that using the docker image, if someone (or their agent) isn’t careful, they could expose their browsing history publicly fairly easily. It might just be nice to default to at least a user and pass login rather than just wide open.

Reply on news.ycombinator.com