I have a lot of ideas like this, but I am super confused on the sustainability part. What ways are there to sustainably maintain such services?
Why the 'snippet' additional step when creating new fiddles?
Being able to do:
curl -X POST -d @test.json https://jsonbin.io/b/new
will be cool!
The link to your Twitter on the about page is broken by the way, it should have a protocol.
Are you saving these "bins" as files, and then serving them? Or are you putting them into a database? Mostly curious. :)
Relying on this is a very bad idea. The server could be logging everything and you'd never know. Heck, the server could be imaged at wherever it's hosted and you'd never know. The "burn after reading" feature is impossible to verify. It's just another "Take our word it's doing this" service.
If the website can spit out out a URL that you're then able to view your unencrypted data in, that website is no more secure than pastebin.com. And at least pastebin.com is explicit that everything is logged.
No, since TLS doesn't have anything to do with the original content being encrypted, such that the server can't read it. safepaste should combine TLS with this client-side encryption/decryption (as the hosted version does).
> Relying on this is a very bad idea...
Considering it's FLOSS, I don't think any of those points are valid. I agree that, for it to be more trusted, it should be self-hosted. So, self-host it! Verify it's not logging! Verify the "burn after reading" does the deletion! If you care at all about security, and hosting a secure service, that's going to be essential anyway.
Boiling down the FLOSS project to its provided hosted version is quite missing the point.
> If the website can spit out out a URL that you're then able to view your unencrypted data in, that website is no more secure than pastebin.com.
Given that the encryption/decryption happens entirely on the client side, this simply does not apply. The server knows the paste id, not the secret key. That's kind of the whole point. :)
- Edited for clarification
P.S Fixed the typo x)
When I copy and paste the access URL I see it starts with // - so the link doesn't go anywhere, is that the intended action?
"Entity" in "Unprocessable Entity" refers to request body and for GETs there is no request body: http://www.restpatterns.org/HTTP_Status_Codes/422_-_Unproces...
I've still never built a twitter clone...
sth like this
jsonbin.io/username/books/get/1
