Leomuck

Thanks :) I'll have a look and get back to you if I want to go this path!

Now a little more in-depth response. Thanks again for your feedback, I could relate to all points you mentioned.

- You are totally right. The "Try it for free" could very easily hint at cost down the line. I have changed it :) - Cool that you understand so many languages :) And thanks for your suggestions. Looking into it right now. Translations is one of those things.. doing it by hand (not me, but someone with good language knowledge) is very time-intensive, but yea, AI can be hit or miss for it. - I'm definitely thinking about starting with a leaner set of features. My only fear would be that people forget there is more to it. But that should be solvable via UI. - Definitely going to add more info on export! That's a shortcoming right now which I aim to fix this week. - Regarding philosophy, I'll think about it. I'm not great at marketing (and don't even want to look at it as "marketing"), so I'm always a little unsure what messages belong where. But good to hear, that a more detailed part on this could be good.

Hey gooba, danke danke danke! I'll have a go through all your points tomorrow, greatly appreciated! Especially since when you work on something for so long, you just can't see things with fresh eyes anymore. So it really is great to get feedback like yours. So thanks again!

Yea, that's what I gathered as well. So what do you think about checking against compromised passwords?

Thanks for your opinion. I appreciate it. I think that makes a lot of sense. I also like the idea of passwordless, I'll definitely have a look at that!

Oh, and I missed the middle part of your post. Fair question! I do think it is quite sustainable. For that to make sense you might have to know me better, but my perspective is I have a good paying job, I have money and especially time to spare and I want to make things better. So I'm honestly happy to spend money AND time on this to be sustainable. I have a very capable root server to run this on and I have money already reserved to get another one. I'm getting by just fine and I'm more than happy to spend some hundreds of euros a month to make the world a little easier/better for people. I'm also happy to spend my time for this.

I did think a lot about monetizing it, but really I feel like that would skew the whole idea of the app. I want this to be for the community. We struggle enough with enshittification anywhere. I'm in a privileged position where I can build and maintain this. And it's available for self-hosting, so anybody can do so as well.

Now, if we were to hit an insane amount of users, the question might have to be tackled again, but that's far away and I think with the infrastructure I have and can get with my allocated "solidary" budget, It'd really have to get to insane amounts to actually be an issue.

So I'd like to think it is indeed sustainable. I'm doing this to be sustainable. I want to build something people appreciate and use. I'm happy to spend lots on it!

Hey gooba! Thanks for wanting to try it out. And sorry, you ran into this issue.

It appears Laravels throttling function doesn't work well with my reverse proxy setup. I have disabled it for now. I have just tried it out and registering works again.

Again, sorry for this. This is my first publication attempt and I fear some issue will only show this way.. however, I'm here and happy to fix everything on the fly :)

Yes, I did read up a lot about password security the last few years. But still, I'm worried a very secure policy restricts people from registering at all, see case above. What would you say is a good compromise?

Another thought I have discussed a lot is, this app is not something critical. It's not online banking, it saves very little about you (as little as possible), etc. - so what does this say about the compromise? If an account was to be compromised, an attacker would only have access to the todos, music, notes of a user. Now, todos and notes could be very telling, but I'm unsure about how much of a responsiblity I have as an admin to save users from this? Do you know what I mean?

Fair! I did think about this a lot. Initially, I also thought "8 characters of any kind" are fair enough. Then read a lot and decided a bit more security would be good. But honestly, given what you wrote, I did find myself happy that I had an account before this security measurement. So I guess, I'm of your opinion.

However, the app does not enforce lowercase/uppercase. It uses Laravels uncompromised() function which I think makes sense. It checks against https://haveibeenpwned.com/Passwords.

I'm happy to discuss length! But I think the uncompromised makes sense. But happy to hear any arguments!

If it makes it harder to register, that is still an argument and must be discussed against the argument of security. I'd love to hear other peoples thoughts here since security vs usability is always a complicated thing.

I’ve been building something over the last year, with probably 1000 hours going into it. A personal management app that does almost everything while being privacy-focused, no-bullshit, open-source and selfhostable. It’s called solyto.

I've been frustrated for a while with what's out there. I'm a data hoarder and love to organize things, but I kept jumping from app to app - started with Notion, but was frustrated with speed and then privacy issues. Switched to Obsidian, tried to do everything there, but figured Obsidian is great at notes, but wasn’t meant for writing custom JavaScript code to build libraries. Tried AnyType, found it confusing. Tried lots of other apps and was annoyed by pricy subscriptions, useless AI features and lots of “you should do this” things. There are great open-source options for most everything, but being a software developer at work, I really didn’t feel like stitching together 6 apps to do what I want and also, I found that’s not accessible to everybody.

I just wanted an app that does what I need in my daily life, that is easy-to-use and no-bullshit. So I built solyto. It’s completely free, open-source, self-hostable and community-focused. I’ve been using it with a couple of my friends for half a year and have replaced pretty much every other app I’ve been using. I’d love for this to be useful to others as well and to be some kind of community project - people suggest or wish for things, I (or other contributors) build it and that’s that. No company shit, no money incentives, no other motives.

Solyto is available at https://solyto.app.

It does todos, notes, calendars & contacts (with DAV sync to your phone), music library, book library, games library, news, daily trackers, finance tracking, time tracking, well basically almost everything I could think of. And if a thing you’d like is missing, I’d love to build it!

If any of you would like to try it out, you can do so via the website or via GitHub for selfhosting. We have pre-built images, compose files, etc. If anything is missing, let me know!

Anyway, I'd love feedback on this. Any kind of feedback! And of course any questions are also welcome.

Cheers, Leo

Links: - App: https://solyto.app - GitHub: https://github.com/solyto/solyto - Self-hosting instructions: https://github.com/solyto/selfhosted - Discord: https://discord.gg/JbNPJHG6

Wtf. Just wtf.

No worries, I love to hear about alternatives and other approaches. I'll definitely have a look, thanks!

Good point indeed! I've been feeling Claude Code has gotten worse for a while now, read many articles on it, overall probably due to cost saving. But if you set your things up to depend on it, that becomes a huge issue.

Exactly! I know, some of those companies sometimes refund you, but if your livelihood depends on it..? That's a crazy situation to be in as a mere developer.

Yes, and you should! But not doing so resulting in this seems kind of over-the-top. Basically means an oversight can result in your bankcruptcy?

Used to be parents were annoyed by their kids for spending 100$ on SMS credits.. lol.

I'm a full-stack software dev, proficient in AI but also sceptical. I've found that staying away from the hype is key. Stop thinking about "WHAT COULD THIS DO", but rather try to find cases where LLMs actually benefit. I've seen so many projects trying to throw LLMs at things that could have been solved deterministically.

My personal opinion is: LLMs give you the power of language. So far we could define rules, based on structured data, we couldn't process unstructed data that well. Now we can use LLMs to take any kind of input and either create responses to it or transform it to structured data. That is a huge leap of advance. But also, there are a million cases where it's not necessary.

On the side, I'm working for a NGO caring about sustainable finance. They have a manually gathered database, they have lots of resources, but most users couldn't care enough to actually click through everything. So offering a chatbot to make that data available seemed reasonable. It works, quite well, and still most requests are so trivial you could have just blocked them.

On my paid job, I'm working for a german radio/tv broadcast station and they're trying to involve AI in solving simple internal user issues. It seems to work quite well. We've built a RAG system based on Qdrant and LlamaIndex and it provides all available information in a format users couldn't find before - because the systems were chaotic and complciated. So in my book, that's a good use case. Users in a very complicated environment with lots of information.

I've worked with OpenAI API, Anthropic API, Azure Foundry, local models, IONOS Model Hub, etc. One thing that keeps coming up is privacy and (in Europe) GDPR-compliance. Use the capabilities of LLMs without sacrificing data that should not go into the next training round.

Anyway, I think LLMs offer a lot of possibilities, but many people tackle them from the wrong side - "what could we do with this?" instead of "what problems do we need to solve?".

What I have asked myself the last few months: I've read about IPv4 becoming sparce a few years ago. I haven't read much about it lately. And I've thought maybe the advance of cloud computing and load balancer kind of mitigated the issue of sparce IP4?

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

Well what kind of meaning do you find in brute force? I'm not saying it's not effective. I just critisize the news that make it look like AI is the a revolutionary advance in security. It is not. It makes skills available to many more people which is cool, but it is based off of training - training on things people did. It doesn't magically find a new combination of factors that lead to a security issue, it tries things it's read about. That's not meaningless. It could even be democratizing in a way. I just hate all this talk that "this model is too scary to release in the world".

But I'm happy about any feedback or critique, I might just be wrong honestly.

Honestly, if every software project ran an AI-based security check over their code, the software world would probably be more secure. Of course, there are lots of projects who don't need that, having skilled people behind it, but we've seen many popular software projects (even by big companies) who didn't care at all. So even a basic model would find issues.

Also, I find myself thinking more and more that the ability to pay for tokens is becoming crucial. And it's unfair. If you don't have money, you don't have access. Somehow, a worsening of class conflicts. If you know what I mean.

All the news regarding AI finding weaknesses or "hacking" stuff - is that actually hacking? Isn't it also a kind of bruteforce attack? Just throw resources at something, see what comes out. Yea, some software security issues haven't been found for 15 years, but not because there were no competent security specialists out there who could have found it, but most likely because there is a lot of software and nobody has time to focus on everything. Of course, an AI trained on decades of findings, lots of time and lots of resources, can tackle much more than one person. But this is not revolutionary technological advance, it is an upscaling of a kind based on the work of many very talented people before that.

Enshittification at its best. I used Postman for several years before it become unusable for me. Didn't actually think too much about it, tried several alternatives (ApiDog, Bruno), but none came to the comfort Postman gave me before that.

Now I understand if engineers spend lots of time on software, somehow they need to get paid. But I still believe, there is a more authentic and acceptable path than what most companies do - make people dependend, make the software worse, introduce subscriptions, force you into plans, etc.

I haven't found a good substitute yet. I use Bruno, I use ApiDog, but they feel a little cumbersome at times. Good enough, but not great. I'd had loved to stay with Postman, but I'm not paying that money for a an API debug client.

I do agree that the overall tendency towards cloud has made things much more complicated and expensive than they need to be in many cases. Cloud has its place, but so do simple server instances. Many projects won't reach any kind of scale that would exceed the capabilities of a medium-sized VPS. We're running a page with 600k users at work that could easily fit on a 30€ VPS. Instead, we moved to AWS and are now paying 800€ for it. No benefits whatsoever.

So yea, stick with what worked for decades if you don't see a reason not to. Also, I remember reading that StackOverflow runs on a bunch of super powerful root servers?

What the hell. First, I thought this was crazy. How could you do anything crazy with curl? But of course, curling a bash script opens lots of opportunities. Given the right permissions, you could run an enterprise Jira server via only a curl to a bash script.

Still cool that people find more ways to play doom, but calling it "via curl" seems a little missleading to me. "Playing doom via a simple bash script" would have felt more appropriate.

Oi! Fair. I didn't want to imply that access to water, shelter and food was less important. Not at all! It's crazy that we have more than enough for everybody and still people die from hunger, thirst, conditions. I was only trying to say that any effort in the right direction is appreciated. You are correct in pointing out other motives though. That's what I asked myself as well.

I find it quite irritating that the Linux Foundation posts this and gives Anthropic free marketing. Yes, they offer credits for open-source, and yes, it can help making open-source more secure, but still.. feels off. Like I expected such a blog post from Anthropic, not from the Linux Foundation.

> "Cameron Stanley, the Defense Department’s chief digital and artificial intelligence officer, who spoke at Palantir’s conference, said that what Maven was doing was “revolutionary.” Human involvement amounted to “left click, right click, left click,” he said."

Nice, that sounds really desirable. Now we can kill people with left click, right click, left click. Seeing how lazy we get when using AI and how we just move the thought process to AI, great times ahead!

What I'm taking issue in is the many opinions on how to build something really useful yourself. I love Obsidian, because it does what it does great - taking notes, easy and fast navigation, no bullshit. What I don't like is the urge to do so many things with it, todos, libraries, etc. Obsidian wasn't built for this. I had spent months improving my Obsidian setup when finally I realized I don't want to spend all this time on making a note-taking tool do something else. As a dev, naturally, I started developing my own stuff to be perfect for me, but not everybody can do that. Technical users might like spending hours implementing the perfect system for their lifes, but I think for everybody else it should be so much easier.

Is anything not potentially compromised these days? Wow.