OnVault Labs

I'm building OnVaultLabs, open, browser-based tools that don't need your data to function. You won't upload anything. You won't sign up for anything. You won't be tracked. Your files stay on your device, your usage stays private, your trust isn't required because nothing is being collected to begin with. Privacy by architecture, not by promise. If you're tired of trading your data for features, you're in the right place. Will keep you posted.

A .NET perf note from this week on the Blazor component library. Validation messages render with a per-severity attribute set (data-severity + ARIA role). Building the dictionary on every render (even though the values never change) adds up across a form with 50 inputs. The fix is boring and satisfying: Built once at type init, keyed with FrozenDictionary's read-optimized layout, splatted via @‘attributes. Every render after: a hash lookup and a splat. No per-render allocation, no per-render construction.

I've been building a Blazor component library on nights and weekends for a year and a half. Solo. The kind that gives .NET developers pre-built inputs, buttons, tooltips, dropdowns, form validation and way more as an open source initiative. The foundation and the core framework are mine. AI is helping with the last stretch: finding bugs, accelerating the UI, extending capabilities… so I can ship a complete first release. This week the tooltips/popovers/dropdowns foundation and the form-input validation wiring landed in their final shape. Plus performance tests that fail the build if components start allocating memory they shouldn't. Every future OnVaultLabs product will sit on this very soon.

We keep seeing "zero-knowledge" slapped on products that are still transmitting the data. The claim is "we don't look." The claim isn't "we couldn't." Zero-knowledge should describe a system property, not a policy. If your data is sitting on my server encrypted, I could turn on logging tomorrow. We’re building the Blazor component library that every future OnVaultLabs product will sit on, designed so the browser is the only place your data ever is. That's not a promise. That's the architecture.

@_overment Congrats! The way you framed at the end is more honest than most open-source releases in this category. Most overpromise on day one and rot under the weight… Bookmarked, reading tonight.

my “wonderlands” project is now open source. this is the next iteration of my “personal AGI” project, and I’m happy to share it with you guys. note: This isn’t anything like OpenClaw or Hermes Agent, although it’s in a similar category. You can simply consider this my sandbox, where you can find stuff that works for me.

@Proton_Pass Option A looks like entropy and isn't. Substitution patterns are the first thing dictionary crackers iterate.

Which of these passwords is weaker than it looks? A) Tr0ub4dor&3 B) xkQ9#mL2$v C) January2024! D) qwertyuiop A, B, C, or D? 👇

“CLI for personal, MCP for team” is actually a clean rule, and i think it cuts the same way for a different reason… every MCP server is another endpoint your context flows through. In the case of a team that's a managed risk, for personal it's an unmanaged one. The CLI is the privacy default by accident

mcp > cli im glad this debase is not as active anymore. i use both every day. they just serve different purposes cli for stuff the model already knows. git, gh, npm, docker, file ops. trained on man pages, and costs almost nothing in context. if im already signed in locally theres no reason to wrap it in anything mcp for most integrations. slack, notion, linear, twitter and its neat to have a protocol for all these integrations - add one server to my teams cursor and everyone gets access - auth once, persists, same locally and in cloud it also just feels better in cursor. rich icons, traceable, you can easily follow whats happening (tbh not reading that much) cli for personal, mcp for team (with oauth)

When did "upload your file to a stranger's server" become the default way to use software? Compressing a PDF doesn't need a server. Cropping an image doesn't need a server. Most of what runs in your browser tab could run on your device. We forgot the device was the point. Tune in…