Is skiff a Saas? My fear is that E2E is incompatible with saas model. The powers will always bribe or coerce the vendor to push backdoored js for specific users. It’s happened many times. You can only trust your own servers.
---
Their site says:
> Everything on Skiff is end-to-end encrypted. Your most sensitive data is private, decentralized, and truly owned by you.
According to a previous blog post [1] they claim they're using a key pair for identification, which they seem to be creating and controlling, and I can't find any mention to back it up, or provide my own in their UI.
---
In their settings they also have a way to enable "decentralized storage through IPFS" but doesn't mention anything else and I don't understand what it does. It doesn't mention how files are stored, in which format, and how I can find their CIDs.
They go on to claim:
> Now, Skiff users can store files, static content, and more via the Interplanetary Filesystem (IPFS). Inside the settings page, users can enable or disable IPFS storage: Skiff users will be able to store files, static content, and documents fully decentralized on IPFS.
> In this model, all user data - still completely end-to-end encrypted - is viewable and accessible on a transparent ledger, instead inside a big-tech-owned database where it may be analyzed for advertisements and invasive analytics.
Not sure if they are calling IPFS a ledger, what they mean by transparent, and mainly how this stops them from analyzing your documents for advertisements and invasive analytics.
---
Their whitepaper [2] is pretty much a product description and implementation overview. From a quick glance it talks about a centrally managed service that people need to talk to, doesn't describe any sort of federated/decentralized protocol or sync protocol, nor documents the CRDT events that make up the documents.
Their github org [3] doesn't seem to have any implementations or documentation of their protocol and how one could implement something that that talks with Skiff.
---
I really really want to like Skiff, and if they hadn't mentioned "Decentralized" and "trully owned by you" I probably would like them even for being a Google docs competitor.
What am I missing? If someone could please point me to any docs/code around how any of their keypairs/ipfs/crdt/e2ee stuff work I'd really appreciate it.
---
1. https://www.skiff.org/updates/skiff-decentralized
2. https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2022...
