submitted 1 year ago by da_g@feddit.it to c/opensource@lemmy.ml

67 comments fedilink hide all child comments

I mean Trilium is fantastic app, lots of potential but the developer is struggling on his own, maybe it's because it's younger than logseq or maybe because is open source compared to obsidian. I think it's the best note-taking/knowledge-base/second-brain i know it virtually could link everything you posses toghter to create a gigantic wiki, so much potential. Plus it has its own self hostable syncing server and web app. Guys give it a look and tell me what you think

top 50 comments

sorted by: hot top controversial new old

[-] Screak42@lemmy.ml 17 points 1 year ago* (last edited 1 year ago)

I’d want to love it…

but as ridiculous as it sounds, for something like this to be really useful to me I unfortunately need a mobile app. a web-app seems hard to realize for a real e2e encryption & sync - for my scenario :(

I’m aware how much effort this is already… it looks good but as much as I want to use it, I can’t due to my workflow requiring a mobile device app (iOS in my case)

but it does look really promising!

[-] da_g@feddit.it 3 points 1 year ago

Bro I get it, I actually need an android app but he's a single developer and h can't do all of that on his own. For now I write markdown files on my phone and import them when I can.

[-] ShaunaTheDead@kbin.social 1 points 1 year ago

It looks like it's built with Electron which should run natively on mobile. Porting it as a mobile app wouldn't be very difficult.

Edit: Upon further investigation, it actually has a built-in mobile frontend. You'd just have to run an instance on a server and access it from your mobile device.

[-] da_g@feddit.it 2 points 1 year ago

Yes it has the web app but a regular app would be nice

[-] Daeraxa@lemmy.ml 4 points 1 year ago

I've had a look at it before but I just prefer Markdown and I'm already heavily invested with a different application so really wouldn't want to move. There are some features I really like, for example the "clone notes" I think is a really interesting feature that essentially creates a note "symlink".

[-] da_g@feddit.it 1 points 1 year ago* (last edited 1 year ago)

Yeah, I was very invested in logseq before but then I just imported the markdown in and started using trilium and fell in love. To each their own

[-] XPost3000@lemmy.ml 4 points 1 year ago

Yeah, looks pretty cool, I'll probably check it out

[-] da_g@feddit.it 3 points 1 year ago

Thanks man, I really got invested in this project, I personally use it but I don't have the skills to help directly.

[-] kenblu24@lemmy.world 3 points 1 year ago

when I saw the title I thought it was this old thing: https://trillian.im/

[-] gornar@lemmy.world 2 points 1 year ago

Me too! Ex-trillian users....unite?

[-] ulu_mulu@lemmy.world 3 points 1 year ago

Good question, I never heard of it, but I checked it now, looks quite powerful, going to try it, thanks for sharing!

[-] itchy_lizard@feddit.it 3 points 1 year ago

How is this better than zim? Is this in the Debian repos?

[-] da_g@feddit.it 1 points 1 year ago

I can't compare, I never used Zim, sorry. If I remember correctly it is, I personally got it with flatpack.

[-] itchy_lizard@feddit.it 4 points 1 year ago* (last edited 1 year ago)

Ah, if it's only available on flatpaks, that's why few people know about it.

Flatpak is a very insecure method to download software BTW, you probably should avoid it

Edit: It's curious that I'm getting downvoted for stating a fact. It seems a lot of flatpak users don't understand security. But that's kinda the point: even the flatpak developers don't understand the difference between integrity and authenticity

https://github.com/flatpak/flatpak-builder/issues/435

Flatpak currently does not provide authenticity, and one developer made it clear that he doesn't understand why that matters in the above ticket that requested signatures of packages back in 2016. It's been 7 years and still they haven't fixed this. I don't think the flatpak team understands or cares about security.

[-] jlh@lemmy.jlh.name 3 points 1 year ago

Flatpaks aren't any less secure than any other installation option, where did you get that idea from?

[-] itchy_lizard@feddit.it 3 points 1 year ago* (last edited 1 year ago)

This is misinformation. Flatpaks are far less secure than installing from apt. All packages installed from apt are cryptographically signed. This isn't the case with flatpaks.

[-] jlh@lemmy.jlh.name 2 points 1 year ago* (last edited 1 year ago)

Hey, let's just have a discussion without calling each other misinformation. I have made my claim and you have made yours.

Now, it is true that apt packages are signed with GPG. However, the same is also true for Flatpak packages. https://docs.flatpak.org/en/latest/flatpak-builder.html#signing

You can see Flathub's GPG key by downloading https://flathub.org/repo/flathub.flatpakrepo and cating it.

When it comes to supply chain security, Flathub's centralized nature allows for additional security than traditional distro packaging, as packages can come directly from app developers. https://docs.flathub.org/docs/for-app-authors/verification

Of course, I would love to see also reproducible builds like nix, and/or SBOMs like Docker, but these are not very popular security tools at the moment.

[-] itchy_lizard@feddit.it 1 points 1 year ago* (last edited 1 year ago)

I'm not calling you names, I'm calling you out on misinformation. There is such a thing as facts, and it's important that we don't misconstrue them.

Optional signing of commits in git is not the same thing as mandatory signing of all packages.

Fact: If I download software with apt in Debian, It's 100% going to verify the cryptographic authenticity of that package. If the signature doesn't match, it won't proceed with the install (unless I choose to override the warning).

Fact: If I download software with flatpak, it may download maliciously modified software and install it without verifying its authenticity.

I'm not aware of any way to configure flatpak to force it to verify the signature of releases between download & install (so if the signature is unavailable or invalid, it does not install the software). Again, flatpak is not a safe way to download software, and I don't think it's possible to configure it to be safe.

If I'm the one spreading misinformation, then show me the documentation from flatpak that indicates that all packages are verified by their PGP key after download.

I think it's a fairly reasonable expectation that a software repo won't download malicious software. Flatpak doesn't do that.

[-] jlh@lemmy.jlh.name 1 points 1 year ago

The first link I sent says that flatpak does not allow users to override GPG and allow unsigned flatpaks unless they are root.

[-] itchy_lizard@feddit.it 1 points 1 year ago

That's not users of flstpak, that's developers. This applies to developers uploading to flstpak. There isnot security for end-users downloading from flatpaks.

[-] da_g@feddit.it 1 points 1 year ago

I don't think it is, I remember something like rpm, but im really new to Linux.

Why is that? Could you elaborate further? you peaked my interest.

[-] itchy_lizard@feddit.it 1 points 1 year ago

Cryptographic signatures of releases are not required for all packages in flatpaks. They are for packages installed in apt.

[-] da_g@feddit.it 2 points 1 year ago

Thanks for the heads up man, appreciate it.

[-] surrendertogravity@wayfarershaven.eu 3 points 1 year ago

I really can’t tell - does it work on top of Markdown flat files or not? Based on the mention of an exporter, I’d guess not.

Part of the reason I moved from TiddlyWiki to Obsidian was to get my writing into plain text files, so anything that doesn’t interface with the OS file system is off the table for me from the get-go. (Part of the reason I care about this is so that I’m not locked into a specific app and can use VS Code to browse and edit as needed, or build a static site from my files, etc.)

[-] da_g@feddit.it 1 points 1 year ago

Unfortunately no for now, it uses a database that renders it more powerful but can import and export markdown effortlessly. Editing directly in markdown should be a feature tho for those who want to use file systems

[-] iaamp@programming.dev 1 points 1 year ago

This could be a very important point for why it isn't more used. For example, i only use markdown files, which allows me to manage them in git, edit and navigate via VimWiki, and visualize in Obsidian.

[-] 7heo@lemmy.ml 3 points 1 year ago* (last edited 10 months ago)

expired

[-] da_g@feddit.it 1 points 1 year ago

I don't have the skills to properly answer, sorry.

[-] 7heo@lemmy.ml 1 points 1 year ago* (last edited 10 months ago)

expired

[-] da_g@feddit.it 1 points 1 year ago

He does, what is his @? Thank you for the information.

load more comments (4 replies)

[-] jason@social.mrnf.me 1 points 1 year ago

@7heo @da_g

---privileged flag, but its not recommended

[-] iaamp@programming.dev 2 points 1 year ago

Looks very interesting. Apparently it uses its own file format. This is a little bit of a problem, because it forces you to rely on this software to access your notes, even if an export to Markdown is possible. But often times these exports of large note databases are not tidy, they may be missing features/information that didn't export well.

So i personally would only ever use a note taking app that is based on text files. This of course is harder to manage, but can be done, like VimWiki or Obsidian have shown.

Maybe if it could be extended for text file as basic storage, it could get a broader user base.

[-] pe1uca@lemmy.pe1uca.dev 2 points 1 year ago

Does the note encryption use the same password for all notes? Or can each note have their individual password?

[-] da_g@feddit.it 1 points 1 year ago

I think each not can have their own password.

[-] da_g@feddit.it 1 points 1 year ago

You can encrypt single notes or entire subrtees with each their own password I think

[-] bionicjoey@lemmy.ca 1 points 1 year ago

Is this similar to Notion?

[-] anony-mous356@kbin.social 1 points 1 year ago

Seems like it misses some key features from Notion. Notion is awesome. Trilium seems cool too, but it's not enough to make me leave Notion.

[-] chamim@kbin.social 2 points 1 year ago

Have you tried Anytype? It's a combination of Notion and Obsidian, and it's end-to-end encrypted, and everything is stored on your device. Still in alpha, but it has a lot of features already. Because it's in alpha, they only give access to people who attend an online presentation of the app. But it's worth it. And as soon as it exits alpha, the plan is to open source it.

[-] AzureDusk10@kbin.social 3 points 1 year ago

A fellow Anytype user here. It went into beta a week or so ago! I believe anyone can sign up and start using it now.

It’s great. Similar to Notion but the way it structures notes is different. Bit of a learning curve if you want to use all of its features, but the basics are the same as Notion. It’s all end-to-end encrypted which gives me peace of mind. They plan to open source the code. Give it a try!

[-] Clairvoidance@kbin.social 3 points 1 year ago

Kinda weird that they already advertise it as open source when they haven't done that yet

[-] harky@kbin.social 2 points 1 year ago

Seems like it is on their roadmap to open the source next quarter. I'll keep my eye on it in the mean time. Looks very interesting

[-] chamim@kbin.social 2 points 1 year ago

That's amazing! Anytype is one of the greatest note-taking apps I've ever tried, and there doesn't seem to be anything it cannot do. So happy to see others using and recommending it.

I updated the Android app and noticed there's a new desktop version as well, but I'm having issues updating it on Linux, so I just assumed it's still in alpha.

[-] da_g@feddit.it 1 points 1 year ago

Damn seems very cool, I will give it a look, thanks man.

load more comments (3 replies)

[-] mulcahey@lemmy.world 1 points 1 year ago

On this topic... Why doesn't anyone talk about Standard Notes? It's free, E2E encrypted, has mobile apps, and supports Markdown (for a reasonable subscription fee). Kinda checks every box...

[-] boyi@lemmy.ml 5 points 1 year ago

Why not Joplin? It's free.

[-] da_g@feddit.it 1 points 1 year ago

In my experience there are a boat load of note taking apps that are fire but unknown, apparently only the mid one get famous, I really don get man, i can't wrap my head around this