The other day I was on github assisting a compiler developer replicate an accidentally-quadratic observed behavior in generated code and was asked if I was willing to privately share my full source code with his company. While that was ultimately unnecessary as it was easy enough to find a simpler example, it did get me wondering about how exactly was I going to do that:

1. github does not (to my knowledge) allow private messages

2. all communication had thus far occurred on the public record (or at least Microsoft's version thereof)

3. my peer did not publish any contact information in his public profile, and out of respect for his privacy I did not look elsewhere

In yet another case of life imitates art imitates life, while I was building this, another developer on this very forum was complaining about not being able to set up a public "dropbox" on the internet in the context of receiving bluesky invite codes which, according to them, were being immediately redeemed by bots. I can't speak to that, but their structure does seem to make them easy to regexp against.

My objectives were to build something that:

1. provides reasonable security against doxxing oneself to other participants

2. runs just about anywhere, even without an internet connection

3. requires no setup beforehand; since this turned out to be impossible, it was later relaxed to "no installation, but might benefit from it"

4. is easy to audit: no external dependencies other than the standard library

What I ended up with was this ~35KiB blob of js + html + css which (I hope) can be broadly summarized as "PGP for people who don't get invited to key signing parties". It is reverse-proxied via Cloudflare (I have a great ISP, but my aging homelab server probably can't handle any significant load) at:

  <https://plaintext.world/>.

If, for whatever reason, Cloudflare is a part of your threat model, the shasum -a 256 for the uncompressed file is:

  153e8022213bc565b5b914a263162920a6039251dd6da5a77b3a37f35de9b1a3  /var/www/html/plaintext.world/index.html

You'll find most of the relevant technical information on the page itself, though you may have to view-source: in the rather likely event that I've omitted something from the manual.

Since this is a technical, VC-backed forum, I'll add a couple more private FAQ entries that may be of interest to some of you, in exchange for the potential of free publicity. Due to HN posts being limited to 4k, you'll find them as a reply by yours truly.