So I am finally starting the process of designing a personal website that can help manage and organize my finances for me.

So obviously, the security of such data is paramount and for the heck of it, I want to design a webapp where it doesn't operate by the rules of "trust me bro" even though I will be the one designing it and most likely will be the only one ever to use it. Just want that experience of proper encryption setup.

Also, even if I am the one operating it, I'd like to set it up so that even if the database is compromised, none of my information is.

skip to bottom if you want to just see my 2 question

Did some reading online, between reading when StandardNotes does encryption as well as how it does it and some basic reading into encryption

• https://www.baeldung.com/java-aes-encryption-decryption
• https://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit

and the importance of not having a local unencrypted database like Joplin does

So all that got me curious how Google encrypts the user data it has and would up reading

• https://security.stackexchange.com/questions/269341/how-does-googles-on-device-encryption-work
• https://developers.google.com/workspace/cse/guides/encrypt-and-decrypt-data

and the basic take-aways seem to be:

• utilize encryption on a field before storing it in a database so that even if the machine gets compromised, the data won't be
• if you want to go even further, take the approach of StandardNotes, where it seems even the web server itself never touched unencrypted data it seems? Looks like all the encrypting and decrypting happens locally and only encrypted data is sent to the server

1. But that got me curious. It can't be argued that Google is not secure. they have the best minds working there to ensure just that. and yet its also well known that their respect for user privacy is non-existent. Which means that they've made sure to protect the data [email, google searches, google docs, google maps history] from hackers but they can themselves decrypt at least some user data for the purpose of data collection and selling ads.
   But if Google can decrypt the data and that implies they store the keys on a server from what I can tell from my reading, how it is protected if someone malicious gains access to the database? If that person got access to the database and the keys that Google uses to decrypt the data, wouldn't that compromise the data?

2. if I decide to design my webapp so that all the encrypting and decrypting happens locally, that means that if I were to decide to create a REST API for my application, that would also have to be taking in data in encrypted format, no? Cause if that takes it in plaintext, that means that my webserver would have to be responsible for encryption, which it needs the keys to do that with and if it can encrypt with keys it has access to, then it can decrypt too, no? or are websites that deal with encrypted databases and have REST APIs that can take in plain text information generally coded to be using asymmetric encryption? meaning its different keys being used for encryption and decryption? Or is API Token the key in an encrypted format? or have I misunderstood the whole thing?

I am planning to use Plaid API and have a spring boot backend but given that I will be storing my financial information (such as whatever the Plaid API needs me to store to use their endpoints as well as just the transactions on my credit and chequing account), the security of the data is obviously crucial. and I think my problem is I don't know what I don't know.

I have a basic idea of what kind of things I need to protect against.

1. WIll have to use Spring security (or whatever is best) for thing like protecting against xss and csrf
2. I need to ensure that the PostgreSQL database is encrypted

but beyond that, I don't know much about the nuances of each type of security and customizations I should be on the look-out for. wonder if there's a trustworthy resource for at least detailing for me the kind of security I need to implement on either the Spring or PostgreSQL side of things?

A lot of people want to talk about Reddit and that will likely continue. This is a place to post minor news updates, so that Reddit topics don't fill up the front page of ~tech.

(Up to you what counts as "minor.")

I have never been a leader at a big company (or anywhere...), and honestly I am pretty ignorant when it comes to money and business, so maybe that's why I feel this way but... isn't this what for-profit companies ultimately are supposed to do? (make money?)

Reddit is blowing up today over his internal memo, and that's when I kind of started to feel bad for him. Wouldn't an internal memo be expected at a time right now? Wouldn't it say that kind of stuff? I'm just curious but for others, if you were in his position, what would you do right now? Is there a better move to be made? What should he have said in that memo? I kind of feel bad for him. At the end of the day he helped create reddit, and it must kind of suck to watch your own project devolve and people come to hate you.

The thing about this API decision that got to me is how abrupt it was - 30 days or thereabout. That doesn't seem like very long. But aren't these decisions usually made by multiple people? (not just a CEO?) I also think it sucks that reddit app hasn't been made accessible to vision impaired folks. So maybe he sucks as a leader, but is that a reason to hate him?

I'd love to better understand.

Official Announcement

NYTimes Article

Apollo Apollo (well known iOS client) developer talking about the specifics. Sounds like the API will now be paid based on usage.

It's a bit easier to have an opinion after the Apollo developer revealed the specifics Reddit gave him. Other than the NSFW part, which seems odd considering the API will be one of the revenue streams that isn't advertiser supported, it seems reasonable, of course waiting on the final price per usage.

It was never going to be sustainable for Reddit's API to be fully free. It was just silly - you could use the whole site, which certainly costs money in both AWS fees and developers doing KTLO, and not see any advertisements via the API.

App developers will pass the costs along to the user, many will likely fold because it won't be commercially viable with the additional cost, but, well, that's the way of things.

Starting on Thursday night, Twitter cut off API access for some of the biggest third party clients.

From The Verge:

It’s hard to tell whether the third-party client outage is due to the API. Attempting certain calls from my individual Twitter developer account seemed to work, while Twitter’s own API explorer tool is currently broken.

It definitely seems like it is on purpose. For it to last this long without any update definitely makes it feel like it was done on purpose. Many developers' apps have started showing up as "suspended". In looking at my own account, I can see that both Tweetbot and Fenix are gone from my list of connected apps.

The Icon Factory (makers of Twitteriffic) have a blog post about it as well.

The complete silence from Twitter is completely baffling. Burning more than a decade of working with developers overnight seems incredibly stupid. As Paul Hadad, one of the makers of Tweetbot said:

Even during the darkest Twitter 1.0 days they were pretty open about what they were doing. I remember getting a call prior to the 4 quadrants token limit where they explained what was going to happen and answered questions. I wasn't happy but at least felt there was respect.