r/localfirst

Browser-based Encrypted File/folder Explorer

WARNING: for testing, demo and feedback purposes only. there WILL BE breaking changes. DO NOT USE FOR SENSITIVE DATA.

https://preview.redd.it/szqxz94s592h1.png?width=1522&format=png&auto=webp&s=066a0644fe6c34518c31decae041c8a28aa6e46f

it is clearly absurd for something like this to be used by anyone on their own computer to view local files. the goal of this project is to enable the viewing/navigating of files in browsers after exchanging over webrtc. i'm aiming for the experience to feel seamless for being able to navigate a folder structure on a remote device.

there are many browser-based office suites out there. this project aims to simplify the setup process by only using client-side resources; making it easy for users to get started.

https://ui.positive-intentions.com/iframe.html?globals=&args=&id=templates-filespage--native-real-folder&viewMode=story

unfortunately, it isnt open source, but i hope it helps to get feedback for improvements. in my project, the aim was to create an intuitive user experience for viewing files and folders in a browser.

a good way to test it out is to create a new empty folder on your computer and grant the webapp access to that folder. note: the filesystem api provided by the browser will limit the access to explicitly approved folders. some browsers also guard against access to important os directories on your computer and reject access automatically.

features:

  • mounting local folders
  • preview functionality for various filetypes
  • browser based office suite
  • encryption-at-rest
  • basic folder management

upcoming:

  • support for more filetypes
  • better implmentation around browser-based office suite
  • browser based file format conversions
  • PWA

future:

when this project reaches a reasonable level of features and quality, I will be integrating this functionality into my P2P messaging app to build towards a "more" browser-based Next-Cloud-like solution. It would would be integrated into this app: https://enkrypted.chat

IMPORTANT: Caution should always be used for all projects, especially like this. So I'd like to be clear that I am Al-slop-maxxing at scale. If youre looking for good code, clear docs or best-practices; you should look away now. While this is aiming to provide secure file-transfer and an intuitive office suite experience, I don't think it will ever be competitive against things like Next Cloud. It isnt audited or reviewed and i DO NOT want you to "trust me". I'd like to share for testing, feedback and demo purposes only. This is a technical demo of a unique concept. Feel free to reach out for clarity. Please use responsibly.

reddit.com
u/Accurate-Screen8774 — 3 days ago
▲ 22 r/localfirst+1 crossposts

Data breaches: After the headlines fade, the mess stays

tldr; Data breaches don't matter if you use local-first software.

She learned about the breach from a push alert, half asleep, phone glowing on the nightstand. By morning her inbox was a pile of password-reset emails from accounts she had forgotten she still had. Some were junk. A few mattered. One was the small business invoicing tool she used for side work. She changed what she could. She could not change the fact that her old passwords, tied to her email, were now a line in someone else's giant file.

Nothing about that week felt dramatic enough for a movie. There was no montage of hackers in hoodies. There was fatigue, embarrassment, and the quiet fear that she would miss one account and pay for it later. That is how a lot of people meet a data breach. Not as a headline. As Tuesday.

Breaches have become background noise. We scroll past them. Then real people spend evenings resetting passwords, watching for fraud, and wondering what else leaked that nobody has told them about yet. Empathy matters here. The story is not only "a database was exposed." The story is disrupted sleep, lost trust, and time stolen from people who did not choose to be part of someone else's security mistake.

If you take one idea from this piece, let it be this. Most harm from big credential dumps is not magic. It is attackers trying leaked email and password pairs across many sites. People reuse passwords. Companies store secrets in centralized systems. When those systems fail, the failure spreads farther than any one user intended.

So the honest pitch is not "never worry again." The pitch is shrink the attack surface and pick tools that fail less catastrophically for the kind of data you care about.

What actually helps

Use a password manager. Unique passwords per site turn one breach into a contained problem instead of a master key to your digital life.

Turn on two-factor authentication where it matters most, especially email and banking. A stolen password is much less useful if the second factor is not sitting in the same leak.

Assume reuse will burn you once. If you have ever reused a password, breach news is a nudge to rotate the important stuff and stop repeating patterns.

Ask a boring question about any app that holds sensitive notes or credentials. Where does my data live? If the honest answer is "on a company server," then a breach of that company is a breach of you. That is not fearmongering. It is how the architecture works.

A quieter architectural idea

Some products are built so the sensitive payload never sits in a central database waiting to be dumped. Local-first designs keep primary data on the device you control. Sync, when it exists, is a separate design choice. The point is not that any approach is perfect. The point is that where data lives changes what "getting hacked" even means for that product.

You still need a strong device passcode. You still need sane backups if you care about not losing data. No architecture removes the need for good personal habits. It does change who holds the crown jewels.

Don't get hacked. Be safe.

"Don't get hacked" sounds like a taunt. Be safe is the serious version. Safety is boring on purpose. It is unique passwords, second factors, and paying attention when a service tells you to rotate credentials. It is choosing tools that match how much you care about the information inside them.

If you have ever been the person staring at a pile of reset emails, you already know why this matters. You are not naive for wanting software that respects that stress instead of adding another central pile of secrets to the internet.

reddit.com
u/bishopZ — 3 days ago

Building a localFirst data studio.

Hi everyone, been looking for somewhere to post this, I have built something that I wish existed when I used to build crystal reports and early BI days and realised I'm. Bit out of touch. Supports CSV and Parquet, it has a built in csv/JSON to parquet convertor.

I wondered if anyone wanted to give it a go. It's no sign up required, no backend or servers. Just hosted on Cloudflare Pages.

It's a Data studio and conversion to tool. It uses duckDB WASM, OPFS private file system access, sharable dashboards and AI integration with Ollama (it needs to be running locally with origins set to *. I've had it running with Gemma4:e2b). Obviously it's really designed for desktop.

https://nanobi.ahm-labs.com

Any early feedback will be awesome! I do t usually build in public, but I thought I'd try it.

reddit.com
u/DEMORALIZ3D — 8 days ago