Great explanation of end-to-end encryption, followed by "but we're too lazy to do that."
Not going to ever touch Supernotes now.
Not going to ever touch Supernotes now.
And yep, partly it is that don't have the time to dedicate to this. There are so many other features that I think would better serve our users than E2EE, so we're prioritizing those for now (table stakes in the notes game are very high). But if I had infinite time at my disposal, I absolutely would add some form of E2EE – though still not sure I'd make it the default as again, there are some things you can't engineer your way out of when you add E2EE.
The one that is most on my mind probably being irrecoverable data loss. If watching the cryptocurrency space over the last few years has taught me anything, it's that even if you beg people to take good care of secret/recovery keys, frequently they don't. And that's for stuff you can sell for actual money.
Irrecoverable data loss is a real pain in the ass that needs to be dealt with but it's the only way to achieve true privacy. Knowing you can't decrypt my data whether by your own will or coerced by your government (which may or may not care about privacy now or in the future) or at the whim of a North Korean hacker, keeps my mind at ease. Why on earth would I give that up? Google has Keep, Apple has Notes, they do a pretty decent job as far as basic notes app go. Sorry if this sounds like putting you down, I'm sure you put a great deal of work into your app and you seem passionate about it and I'm sure it's great. But because the table stakes in the notes games are high, you need to go above and beyond what your competitors offer. Not just great UX, but pushing _every_ boundary in the space, including by offering privacy. I feel like in 2022, privacy is non-negotiable. Make it optional if you feel you must, or don't, but don't suggest skipping E2EE is in any way a virtue.
Our current set of priorities means that E2EE is not going to be at the top of the list for the foreseeable future, so we want existing and potential users to be aware of that (and our rationale behind it). We prefer to have users that understand and align with our vision rather than trying to convince/trick people with different priorities to use Supernotes.
If you're not a paying customer and you are not willing to buy the product, what causes you to think they'll do what you think they should do on arbitrary principles (that you might still not buy the product even if they implemented it) rather than practicality of reality. Why should they listen to voices on the internet who aren't even their customers?
Expecting other people to do more for you without giving anything in return is some thing I don't like.
People tend to exchange and discuss ideas on HN and this is no different.
More to the point, sorting these sorts of things out is kinda what why your users are paying you. I would have been okay with "we want to make sure our users don't experience data loss, so we're still working on the right implementation of E2EE" (as long as you actually working on it). But outright declining to implement E2EE is user-hostile. As noted by the sibling comment, in 2022 privacy is non-negotiable.
(Also I don't think you're adequately considering the liability you're exposing yourself to by holding your user's data unencrypted. What if some HR exec decides to make a note with all their employees social security numbers, addresses, and contact information, and then there's a data breach?)
If you knew how hard it was to write E2EE you would be more respectful of others honesty.
In this thread you call people lazy and effectively claim they should roll their own E2EE crypto. And you write off using others non security software.
What if they aren't professional cryptographers? Would you still recommend that to?