Hacker News Reader

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Thanks! Yes, I agree. Someone already implemented a Firefox history data source; I don't think it includes the _content_ of the pages, but that could be interesting.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

I see... that might make it hard to keep all the data together, which is one of the goals. But I will give it some thought.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

I don't think sqlite runs very well on S3 file systems. I think it would also be insufferably slow.

I even encountered crashes within sqlite when using ExFAT -- so file system choice is definitely important! (I've since implemented a workaround for this bug by detecting exfat and configuring sqlite to avoid WAL mode, so it's just... much slower.)

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Timelinize doesn't import duplicates by default, so you can just import the whole new Takeout and it will only keep what is new.

But you have control over this:

- You can customize what makes an item a duplicate or unique

- You can choose whether to update existing items, and how to update them (what to keep of the incoming item versus the existing one)

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

A live demo would be great, but I'm not sure how to generate the fake data in a way that imitates real data patterns. That's originally how I wanted to demo things, but the results weren't compelling. (It was a half-hearted effort, I admit.) So I switched to obfuscating real data.

FreeMyCash looks great! Yours is the second financial application I've heard of; maybe we need to look at adding some finance features soon.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

> I want it to also be a nextcloud and zotero replacement, storing all my documents and books and documenting when I added, opened, edited them. I want it to store all notes that I write.

Sounds in-scope so far. Long-term, perhaps, and maybe optional add-on features rather than built-in, but we'll see.

> I want it to record and display all browser tabs I open, when I do so, everything I copy and paste, every key I press.

That is possible in theory, but for me personally that's just too detailed. :D I wouldn't need all that granularity, myself.

But hey, the vision is pretty similar. We are generating all sorts of data to document and understand our lives -- we don't even have to deliberately write a journal -- but we have no way of comprehending it. This app is an attempt to solve that.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Cool, yeah, the finance use case seems very relevant. Someday it'd be cool to have a Finance exploration page, like we do for other kinds of data.

Real-time/polling imports aren't yet supported, but that's not too difficult once we land on the right design for that feature.

I tinkered with a "drop zone" where you could designate a folder that, when you add files to it, Timelinize immediately imports it (then deletes the file from the drop zone).

But putting imports on a timer would be trivial.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Why sidecar metadata files? In general I've tried to minimize the number of files on disk since that makes copying slow and error-prone. (A future version of Timelinize will likely support storing ALL the data in a DB to make for faster, easier copying.) We'd still need a DB for the index anyway, which essentially becomes a copy of the metadata.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

A few latin names have been suggested, but nothing has stuck. The problem is they are usually difficult to spell and pronounce, which isn't really an improvement over the current situation :)

FindPenguins is cool! I don't use it myself, but anyone is welcome to implement a data source for it.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Ha, thanks it’s actually AJQuery, just a two line shim to gain the $ sugar. Otherwise vanilla JS.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Will be curious how you use it. I plan to integrate local LLM at some point but it’s still nebulous in my head.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Will have to look into that. Sounds like it could be expensive but maybe worth it.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Probably not hard. Timelinize's data sources have a standard API with just 2 methods [0], so it should be fairly trivial to implement depend on how accessible Immich is.

To clarify, you don't grant access to Google Photos, you just do the Takeout from https://takeout.google.com to download your data first.

[0]: https://pkg.go.dev/github.com/timelinize/timelinize@v0.0.23/...

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

For sure.

About 5-6 years ago, Timelinize actually used only the Google Photos API. It didn't even support imports from Takeout yet. The problem is the API strips photos of crucial metadata including location, and gives you nerfed versions of your data. Plus the rate limits were so unbearable, I eventually ripped this out.

But yeah, an app that runs on your phone would be a nice QoL improvement.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Yep -- a timeline is just a folder with regular files and folders in it. They're portable across OSes. I've tried to account for differences in case-sensitive and -insensitive file systems as well. So you can copy/move them and back them up like you would any other directory.

mholton Show HN: Timelinize – Privately organize your own data from everywhere, locally

Yeah. Major thorn in my side. I spent hours trying to automate that process by using Chrome headless, and it kinda worked, until I realized that I needed to physically authenticate not just once, but every 10 minutes. So, it basically can't be automated since 2FA is needed so often.

In practice, I do a Takeout once or twice a year. (I recommend this even if not using Timelinize, so you can be sure to have your data.)

mholton Revocation Confusion

Propagating the revocation information often takes about as long.

mholton Revocation Confusion

Yeah, revocation is a hot mess, it's always been broken, and OCSP Stapling was our only hope -- but then most web servers (but not all! guess which one) dropped the ball. (Clients at least honored Must-Staple.)

Short certificate lifetimes is the ultimate way forward, and thankfully it's already available through Let's Encrypt, via the "shortlived" profile.

With a certificate that lives < ~7 days, there's virtually no need to revoke. Some clients/browsers will still move to revoke certificates within minutes or hours of their own choosing (see, that's the other frustrating thing, revocation is really just whatever you want), but I hope we'll only see that on internal PKIs, since doing that for public sites is essentially censorship.

mholton Ultra efficient vector extension for SQLite

Thank you, that's always nice to read! I will pass this along to our maintainer team.

mholton Ultra efficient vector extension for SQLite

> [sqlite-vec] works via virtual tables, which means vectors must live in separate tables and queries become more complex.

Not really, you can just call the distance function directly and your vector blob can be in any regular field in any regular table, like what I do. Works great.

More info: https://github.com/asg017/sqlite-vec/issues/196

mholton Configuration files are user interfaces

This is why Caddy has config adapters: bring any config file language you like, and Caddy will run it. It's built-into the binary and just takes a command line flag to switch languages: https://caddyserver.com/docs/config-adapters

mholton Not all browsers perform revocation checking

The citation is that that is Hanno Böck.

mholton Not all browsers perform revocation checking

This page is to demonstrate that revocation is broken. There is no central revocation authority. Anyone can publish a revocation list, whether it's a CA or client vendors or Joe from his mom's basement.

I'm using the term "revocation list" loosely, as it can be as simple as a list of public keys to distrust. Client software can use any revocation list they want, AFAIK.

mholton Not all browsers perform revocation checking

That's because Apple uses their own CRLs, pretty much exclusively.

mholton Not all browsers perform revocation checking

Revocation has many meanings. No central revocation authority is actually enforced by the BRs, as far as I know. Clients can do whatever they want. The CA can say a cert is revoked but no one has to care. Clients can also say a cert is revoked and then all their client instances start rejecting it. Most clients work this way now, like Safari -- they just distribute their own CRLs.

mholton Not all browsers perform revocation checking

> Sounds like letsencrypt is being quite premature by turning off OCSP.

Not really, since they now offer six-day certs, which makes revocation effectively irrelevant: https://letsencrypt.org/docs/profiles/#shortlived

mholton Not all browsers perform revocation checking

Context: WebPKI revocation is broken. It didn't have to be [0], but it always has been, and likely always will be, now that the industry is moving to short-lived certificates.

Let's Encrypt is now offering a profile for 6-day certificates: https://letsencrypt.org/docs/profiles/#shortlived

With such short-lived certificates, revocation effectively becomes a non-issue.

[0]: OCSP Stapling (esp. with Must-Staple) is actually pretty effective at distributing revocation information in a timely, secure, private manner. There were no real downsides to the spec, which is why Caddy has supported automatic OCSP stapling since, gosh, I think 2016 or so. The problem is that most other web servers didn't -- and still don't -- implement it well [1], making OCSP (without the stapling) a persistent privacy problem. Additionally, many client vendors want to choose what certificates count as "revoked" now, so they use their own CRLs, making OCSP entirely useless, since they only check their own CRLs.

[1]: https://gist.github.com/sleevi/5efe9ef98961ecfb4da8 -- most servers have such a bad implementation of OCSP stapling that it makes sites less reliable, not more.

mholton Native ACME support comes to Nginx

Integrated ACME clients have proven to be more robust, more resilient, more automatic, and easier to use than exposing multiple moving parts: https://github.com/https-dev/docs/blob/master/acme-ops.md#ce...

To avoid a splintered/disjoint ecosystem, library code can be reused across many applications.

mholton Native ACME support comes to Nginx

There was quite a bit already, about a month ago: https://news.ycombinator.com/item?id=44889941

mholton Purposeful animations

Apple could learn a thing or two from this. Too often I'm waiting for their silly animations to finish. Just a moment ago I swiped to scroll the view to the bottom, then immediately tapped the button when it came into view, but I had to tap it multiple times until the bouncing stopped.

That's just one example because it just happened, but this happens ALL the time. I know Apple can do better. My Android phone felt so much more responsive (the 120hz screen helped, I'm sure), simply because the animations were snappier.

Other examples that come to mind real quick:

- Swiping up to switch apps. That one is awfully slow. (Actually, most gesture-based activities are painfully slow!)

- Dismissing notifications (esp. on Mac)

- Opening the drawer thing

- Revealing the dock

- Sometimes I see animations stacked upon each other. One animation has to fully complete, then another one, THEN I can finally use my computer again.

It's ironic that I have to go to Accessibility settings and disable these things to make my device accessible.