ldubost

I'm not sure which export you are talking about ? We have xlsx/docx/pptx import export (one by one).

What we don't have is local syncing with your computer.

Ludovic, from the CryptPad team

Thanks on behalf if the team.

Ludovic

Drive might be 'useless' to you in it's form because you want more from CryptPad (more features in it, more local sync, more anything), but it is very useful to organize your docs that you work on in CryptPad. It also allows shared folders and so on.

What's interesting is that surveying our users did not show local sync as hugely demanded. Mobile access comes up the highest.

We do believe having an API is valuable and a good selling point. It's also a great way to get an ecosystem to help us extend the product. Now it's also more responsibility to maintain compatibility. We want to be able to continue to upgrade services (in particularly cryptpad.fr). Apps using the API would need to continue to function or by security be locked out. This is a lot more work for the small team.

Ludovic from the CryptPad team

Interesting point. We should add some warnings about this.

Ludovic, from the CryptPad team.

We never pretended the drive has local syncing. The drive is extremely useful for people to organize their documents inside CryptPad.

It is possible to create folders with any file types in it. Shared folders can be also created.

The workflow you describe with syncthing involves local synching.

We are not saying that syncing locally is not interesting. It's just a lot more work on top of the editor work, the online sharing, the e2ee, etc.. We work with the capacity we have. Also as I said, syncing opens the door to version compatibility issues, risks of mistakenly deleting data of your drive and high volume just for storage. This means for our hosting service (cryptpad.fr) management of much higher volumes. We are not even sure the 1gb free storage policy is sustainable for that use case. But we are working on a path towards this as we have plans for a CryptPad API.

Ludovic, from the CryptPad team

"Signal has sacrificed ease of use in favour of security by refusing to release a web app for some time.. they're doing pretty OK in terms of number of users. I think it's also fine to choose a different balance and favour ease of use more, but concessions to security based on your team's priorities should at least be acknowledged."

Again you mention Signal, a org bootstrapoed with a promise of 100m$ and way more funding than us. They have apps for iOS, Android, Linux, Mac, Windows. Are you realizing the comparison you do ?

You say our concessions to security should be acknowledged. Check our white paper.. We do mention code hacking on the server. When did we say we protect you from your computer setup ?

You want us to warn users about links more visibly. Fine, make reasonable proposals ?

You want us to make desktop apps.. We want that too.. We tell you it does not fully solve the issues you mention.

You want us to drop web apps like Signal who does not do that. We tell you this would kill CryptPad.

Yes the way you overstate the issue instead of telling activist to run their own servers, with a browser they control on an OS they control, is indeed hurting. You mention users are not knowledgeable. This FUD reduces the trust in our work. Sure I understand you are trying awareness.. Which for us ends up being social pressure.

Open Source is simple.. Don't complain, code... Contribute...

Ludovic

Disclaimer: I'm the CEO of the company doing CryptPad.

The problem I have, is that you say the word "vulnerability" for CryptPad when we never promised to protect you from a badly configured computer.

If there is a vulnerability, it's unsecured browser syncing which would be exposing your browsing history to Google. Google Docs has anonymous links which are in that history too.

BTW I could not find any info about browser companies exposing the synced browser history. As far as I know It's encrypted on Chrome and Firefox. But maybe I'm wrong as I believe if people want to be sure why would they use browser sync ?

Note that in addition to passwords there are also Access configs where the server can block access to documents to specific users. This is an additional security which mitigates the issue of links that would be opened on a bad browser. Sharing links through CryptPad as also the recommended way to never have URLs opened by your browser.

When I mentioned PR, you could also fork and run your server with higher security settings.

If a team does not respond to your vision, you can indeed bitch about that team, or you can come and give more proof of your vision. Documentation also help ? Why not document that browser syncing would be risky for activists ?

So take this as a call to be constructive. Make a github issue and propose something that helps. Maybe indeed add a message and a link to more documentation about good and bad ways to use shared links.

About "> empower laypeople to collaborate on documents with reasonable confidence that nation-state actors won't be able to passively surveil those documents", did you read our white paper ?

Ludovic

I'm from the CryptPad Team.

We did not use this sentence. It's the person that posted this that wrote 'Google'

However we believe CryptPad can be part of the solution for both Google and Microsoft

Now the targets are different. Google has most of individuals and B2C. Microsoft is more the larger companies

At this point CryptPad seems to have more tracking on the individual market.

For companies, there are different approches like self-hosting. E2EE in companies is a niche market for which collaborative editing is new.

So 'Google' as an exit-target is probably yo the right goal

We have started working on that.

The load time currently depends on the size of your drive/share folders etc..

Public links are now bypassing some actions. We hope to bypass more in the future

Ludovic

Your last paragraph is quite insulting to the work we do, suggesting intention to trap people ? Did I read this right ?

I'm not really sure i want to continue the conversation unless you retract this. Our team is working hard on many fronts and does not deserve to be treated like that.

If you believe it's critical that the "link situation" be resolved, where is the pull request, or even the specification of the necessary change ?

Ludovic