frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

Open in hackernews

FOKS: Federated Open Key Service

https://foks.pub/
144•ubj•10h ago

Comments

maxtaco•2d ago
Max here, author of FOKS. I find it interesting how much glue is required to perform basic cryptographic operations, even in 2025. Imagine a very simple idea like encrypting a secret with a YubiKey. If it's an important secret, that you really don't want to lose, then now you need a second YubiKey as a backup, in case the primary is lost or breaks. But now how do you encrypt and how do you rotate the primary out if needed? To the best of my understanding, there aren't great solutions short of a system like FOKS. If not FOKS, I really believe a system like it ought to exist, and it ought to be entirely open, so that arbitrary applications can be built on top of it without paying rent.
eterps•2d ago
> TL;DR: FOKS is like Keybase, but fully open-source and federated

What features from a user perspective does it currently have in common with Keybase?

F.e. I remember Keybase mostly for secure messaging using public identities (HN, Reddit etc.), and sharing data/files.

maxtaco•2d ago
E2E-encrypted git. Keybase has KBFS, and FOKS has a poor man's equivalent, which is E2E-encrypted Key-value store.
eterps•1d ago
Thanks! Sorry for being lazy, but I was wondering how you share something using the E2E-encrypted KV store (it wasn't obvious in the website)? In kbfs, I remember it was as easy as putting it in a comma separated usernames path.
maxtaco•1d ago
It's not as seamless. You need to first make a team, then invite (or add) that user into the team, and then use `foks kv put --team <your-team>`. One key difference is that in Keybase, all user's profiles were essentially world-readable. FOKS aims for more privacy by default, so in order to add Bob to your team, Bob has to first allow you view his sigchain, so you can learn his public keys.

The add vs invite distinction referred to above is because servers can choose different visibility policies. You can set up a server at foks.yourdomain.cc, and set it to "open-viewership", which means that any user can see any other user by default. If you and Bob are both on that host, you can add him to your team without his permission. But other hosts, like foks.app, do not work this way, and Bob has to authorize you to view him.

dannyobrien•5h ago
Max! I'm so happy that you're doing this! I was a huge fan of Keybase, and have spent the last few years praying (and sometimes brainstorming funding) a decentralized, open source version of it. Looking forward to digging into the details of FOKS, but just wanted to say thank you and the Keybase team for all you've done -- including keeping Keybase going after the Zoom purchase.
pmw•5h ago
Max, this looks interesting and I'd like to follow the blog. Would you please add an Atom feed to the blog?
singpolyma3•2d ago
How does the "federation" work? I assume the actual team data is stored on a single foks server, the one the term is on, so I guess from there you basically have some lightweight SSO for team members using their server?
maxtaco•1d ago
Correct! Remote members of the team get access to shared team keys, and the team's data, even though they don't have accounts on that server. Knowledge of the team key suffices to allow a remote user to authenticate and transfer (encrypted) data to and from the server.

There is very little server-to-server communication, which simplifies the design and software upgrades.

WhatIsDukkha•6h ago
For context this is the original keybase guy coming back to make a workalike opensource version -

https://blog.foks.pub/posts/introducing/

marcopolo•6h ago
The fact that this already has git support is amazing. I can easily migrate my Keybase git repos with a single command.
pzduniak•5h ago
I used to use Keybase Git repos for file-based secrets management for my toy DevOps project. Either FOKS Git repos or native support in SOPS would be pretty damn cool!
hofrogs•5h ago
AI-generated images on the front page really take away from the trustworthiness of this thing..
kstrauser•5h ago
And in reality, someone making a personal project used a tool at their disposal to add pretty pictures to their website, said website not being a part of the project in any way.

If they vibe coded the app, sure, be skeptical. But there's no indication they did, just that they wanted images for their website, and they're a software engineer and not a graphics designer.

I put about as much weight in the origin of those graphics as which website editor they use. If they were advertising themselves as a web designer, sure, maybe that's relevant. That's not what they're doing here though.

hofrogs•5h ago
Not having any pictures at all is better than having AI pictures, in my opinion
brookst•4h ago
Perhaps it’s a filter to intentionally scope audience.
lijok•4h ago
And you’re not just having a kneejerk reaction?
kstrauser•4h ago
Why is that different from disliking their font preference? It's an aesthetic choice, made by someone who's not advertising their web design expertise, that's purely subjective.

If this site were their product, maybe that'd matter. But why does that matter in this context?

chowells•4h ago
Because it shows a lack of respect for and understanding of the work graphic artists actually do. Now if that's your brand, great. You are communicating it effectively. If it's not your brand, it's probably worth considering the subtext in your presentation.
eadmund•2h ago
> it shows a lack of respect for and understanding of the work graphic artists actually do

No more than wearing off-the-rack clothes shows a lack of respect for and understanding of the work tailors actually do.

No more than wearing factory-woven cloth shows a lack of respect for and understanding of the work weavers actually do.

No more than heating a can of soup shows a lack of respect for and understanding of the work chefs de cuisine actually do.

In my cases as well as yours, one certainly can choose to spend extra for the luxury of the best to meet the want, but it is also fine to spend less and meet the need. In my cases as well as yours, judging someone for the value he assigns to a luxury is gauche.

XorNot•2h ago
It's free software. Graphic artists don't work for free.
progval•40m ago
It shows a lack of attention to detail when the illustration for "Merkle Trees" is not a forest (it has cycles). And "A Simple Key Hierarchy" could use an illustration of a real example instead of nonsense.
tln•3h ago
Those images (bootstrap, vault) are so tertiary to the both the article and the project.

I'm excited to try this out personally! Thanks for building this maxtaco

UltraSane•31m ago
Like it or not complaining about AI generated images now is like complaining about people using Photoshop or Illustrator to create images.
pmw•4h ago
To better wrap my head around how FOKS facilitates team collaboration, I'd like to see two comparisons:

1) compare to a team-shared Linux machine with SSH daemon. Each team member has a user account, and they can manage their SSH authorized keys, including keys stored on Yubikey. The team can share files and git repositories on the Linux machine's own storage. Some differences I see with this approach are the federated aspect and "append-only data structures that allow clients to catch dishonest server behavior".

2) compare to Radicle, a decentralized git service. Identities are keypairs.

With FOKS, how coupled is storage of git and secrets to the FOKS server?

maxtaco•3h ago
I'm not familiar with Radicle, but I'll check it out. For (1), consider the case of that server being hosted on AWS. Even though only members are authorized to SSH into it, the plaintext is still known to the cloud hardware, and can be exfiltrated that way. In FOKS, the server sees encrypted data only, so that attack is greatly mitigated. I would say that if the SSH server was hosted on one of the workstations of one of the team members, then the security advantages of FOKS would be much less.

The KV-Store and Git server are implemented as "applications" on top of the FOKS infrastructure, so they aren't coupled. They see a sequence of Per-Team-Keys (PTKs); they use the older ones for decryption and the newest for encryption. I'd really love to see all sorts of other applications built on top of FOKS but we might need to do some work as to nailing the right plugin architecture.

ethan_smith•4h ago
Federation in key services solves a critical problem: it prevents centralized control while maintaining the convenience of discovery and verification across organizational boundaries.
minitech•2h ago
Are all of this account’s comments AI-generated?
Retr0id•3m ago
Yes, I clocked it in another thread.

Digital Journaling Platform

https://ai-therapist-seven.vercel.app/login
1•taruschirag•2m ago•1 comments

Peter Boockvar's Substack

https://boockvarpeter.substack.com/
1•TechMacGyver•6m ago•0 comments

Turkey bans Grok over Erdoğan insults

https://www.politico.eu/article/turkey-ban-elon-musk-grok-recep-tayyip-erdogan-insult/
1•geox•7m ago•0 comments

Adding LSM trees to Postgres makes replication tough

https://www.paradedb.com/blog/lsm_trees_in_postgres
2•mathewpregasen•7m ago•0 comments

Rodish: Routing Tree Argv Parser

https://github.com/jeremyevans/rodish
1•thunderbong•8m ago•0 comments

From Scratch: Berry Patch

https://blog.perchbird.dev/posts/from-scratch-berry-patch/
1•fenkett•11m ago•0 comments

Integrity-Policy Header

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Integrity-Policy
1•todsacerdoti•14m ago•0 comments

My Digital Minimalism Journey

https://sym.bearblog.dev/digital-minimalism/
1•sym5731•18m ago•0 comments

Libinput 1.29 Improving Scroll Wheel Responsiveness for Most Devices

https://www.phoronix.com/news/libinput-1.29-RC
1•Bender•20m ago•0 comments

Updating an old Ubuntu to a supported version

https://anonymoushash.vmbrasseur.com/2025/07/old-ubuntu-upgrade.html
1•vmbrasseur•20m ago•0 comments

Windows 11 clean install guide: remove bloatware and optimize performance

https://sym.bearblog.dev/win11-install/
1•sym5731•21m ago•0 comments

New Burning Coal Seams Revealed Across Wyoming's Northern Border

https://cowboystatedaily.com/2025/07/10/dozens-of-new-burning-coal-seams-revealed-across-wyomings-northern-border/
2•Bender•22m ago•0 comments

Barksdale Airmen Help Secure New Drone Restrictions Across Louisiana

https://www.afgsc.af.mil/News/Article-Display/Article/4238511/barksdale-airmen-help-secure-new-drone-restrictions-across-louisiana/
1•Bender•23m ago•0 comments

Grok 4 answers controversial questions by searching what Musk has to say

https://twitter.com/jeremyphoward/status/1943436621556466171
5•ks2048•26m ago•1 comments

Binding Application in Idris

https://andrevidela.com/blog/2025/binding-application/
1•matt_d•28m ago•0 comments

Retro-gaming YouTuber PatmanQC has died, aged 53

https://www.vanhoe.com/obituary/Patrick-Davis
1•shdon•28m ago•0 comments

Readeck

https://readeck.org/en/
3•billybuckwheat•30m ago•0 comments

The Return of the "Elderly" Pop Star

https://www.cantgetmuchhigher.com/p/why-are-pop-stars-getting-older
1•jnord•31m ago•0 comments

The simplest GenAI setup I've used actually worked

https://Lyzr.ai
1•kuoki•31m ago•0 comments

Don't Eat Honey

https://benthams.substack.com/p/dont-eat-honey
1•bookofjoe•33m ago•1 comments

Show HN: Context Compass – Track Claude chat token usage before hitting limit

https://chromewebstore.google.com/detail/context-compass-for-claud/fmbipbgbfoganenegfmkmlidljbfnkhf
1•raydawg88•35m ago•0 comments

San Francisco firm fined $215M for illegally using Russian oligarch funds

https://sfstandard.com/2025/06/13/russia-ukraine-sanctions-putin-venture-capital-peskin/
7•2OEH8eoCRo0•36m ago•0 comments

Musk Says Grok Chatbot Coming to Tesla Vehicles by Next Week

https://www.bloomberg.com/news/articles/2025-07-10/musk-says-grok-chatbot-is-coming-to-tesla-vehicles-by-next-week
2•JumpCrisscross•38m ago•4 comments

Classic rail routes through the Alps reopen

https://www.theguardian.com/travel/2025/jul/10/classic-rail-routes-through-alps-reopen-austria-switzerland-italy
1•divbzero•39m ago•1 comments

First 74,369-gate circuit validated on IBM back end

https://twitter.com/CTibedo/status/1943409135090892865
1•GeometryKernel•41m ago•0 comments

Ask HN: Why isn't mobile phone service restricted to emergency numbers only?

1•amichail•45m ago•4 comments

Using Large Language Models to Infer Problematic Instagram Use

https://www.mdpi.com/2079-9292/14/13/2548
1•PaulHoule•47m ago•0 comments

Robinhood's Crypto Trading Promotions Probed by Florida AG

https://www.bloomberg.com/news/articles/2025-07-10/robinhood-s-crypto-trading-promotions-probed-by-florida-ag
2•Bluestein•49m ago•0 comments

Italy's Mosaic School

https://www.bbc.com/travel/article/20250707-inside-italys-secret-mosaic-school
1•andsoitis•53m ago•0 comments

A Doctor Said Israel's War Is Fueling Health Crises in Gaza. UCSF Fired Her

https://theintercept.com/2025/06/05/gaza-israel-san-francisco-ucsf-doctor-professor/
16•heavyset_go•55m ago•0 comments