Mumu VS Signed Pages

Cautionary: I really liked Mumu, but the developer was a dick when it came to upgrades. His policy clearly stated that anyone who purchased in the last year would get a free upgrade, but when time came, and I asked for the upgrade, he told me (paraphrase) "No, I put too much effort into this release, you have to pay again", and it was already outrageously overpriced. I just check again, and he wants $50 for 1... Source: about 1 year ago

GetMumu a macOS app bootstrapped by Wilbert Liu has been acquired for 5 figures. Source: over 1 year ago

Yes. I’m building https://getmumu.com and the revenue is still growing strong over time. And it’s been fun to make something that earns money yet people love the product. - Source: Hacker News / over 2 years ago

Hey Redditors! As the Apple don’t give a f*ck about their emoji picker, I can’t be more excited that we eventually have a solution for it. And we shall call it.., Mumu X 😊 It's packed with things that give more power to your daily workflow. 🧠 5k+ GPT-3 powered synonyms 🤗 Personal synonyms 📌 Emoji bookmark 💥 Latest emoji support – currently 13.1 🗂️ Emoji groups 🎨 Skin tone changer 🗣️ Personal accent... Source: almost 3 years ago

There is "Signed Pages" by the debeloper of EteSync. It is a browser extension, that checks webapps based on signatures in the html file. The addon then warns the user if the signature is not correct or - if I remember correctly - the source changed. This allows you to be sure what webapp code was delivered. But it seems like it did not really get used outside of his own projects. - Source: Hacker News / 3 months ago

EteSync has implemented something called Signed Pages, this might be worth looking closer at. This uses PGP keys which is preloaded into the browser; but I suspect that will be a barrier too high for most non-tech users. Source: 12 months ago

There are also projects like signed web pages which can also help increasing the trust level to some degree. But that requires that you can download the source code and regenerate the verification hash locally - or have other trusted methods to verify the hash value hasn't been modified as well. The current concept is reasonably sane, but it requires too much from users currently to make it widely used. Source: almost 2 years ago

> The server can at any time start serving malicious payloads True, and I call this threat model "Beware Each and Every Fetch" (BEEF) in contrast to the more common TOFU model (although if you trust a desktop app to auto-update itself then these two models might not be all that different). In any case, I think you're being a little quick to dismiss the idea of server-hosted applications. It's true that browsers... - Source: Hacker News / about 2 years ago

Something like a browser extension for this does already exist, fortunately: https://github.com/tasn/webext-signed-pages. - Source: Hacker News / over 2 years ago