Project ideas from Hacker News discussions.

Hardware Attestation as Monopoly Enabler

📝 Discussion Summary (Click to expand)

Eight prevailing themes from the thread

  1. Attestation reinforces lock‑in and threatens an open web
    “This is a really good thread on _why this technology is becoming a problem for “open” anything.”_ — ChuckMcM

  2. Public will is overridden by corporate power
    “So a vote happened, and when it didn’t go their way, huge company threatened a huge lawsuit that the township and citizens couldn’t afford, to get their way anyway. Standard corporate bullying tactic in America.”ryandrake

  3. Remote attestation is used to enforce anti‑competitive control, not genuine security
    “Attestation purports to prove the code is running on an ‘_approved’ device… but Google only lets its own certified devices pass.”_ — nullc

  4. Building decentralized alternatives is hampered by network effects
    “In terms of headcount, and especially those who are working on this hostile stuff, Big Tech is not even that big compared to the rest of the population.”userbinator

  5. Technical “solutions” like ZKP cannot salvage the underlying problem
    “Hell yes. I was going to post the same comment. I don’t give a flying fuck how it’s implemented. Remote attestation is inherently evil.”userbinator

  6. Activism matters, but political response is weak
    “I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not.”pjmlp

  7. Digital‑ID plans tie European sovereignty to US duopoly
    “The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly.”wgh (referencing the cited article)

  8. Alternatives exist but are blocked; support is needed
    “I think it's an error to demand the alternatives be as good— they’re good enough to use.”nullc


🚀 Project Ideas

OpenAttest

Summary

  • Decentralized, vendor‑neutral device attestation that any OS (including GrapheneOS) can generate and any service can verify.
  • Removes reliance on Google Play Integrity and Apple DeviceCheck lock‑in.

Details

Key Value
Target Audience Security researchers, privacy‑focused developers, alternative OS maintainers
Core Feature Cross‑platform attestation API + public verification service
Tech Stack Rust backend, WebAssembly front‑end, PostgreSQL, libsodium ZKP, OpenID Connect
Difficulty Medium
Monetization Revenue-ready: subscription

Notes

  • Would let HN users bypass Google‑only Play Integrity requirements and keep using open ROMs.
  • Sparks dialogue on open attestation standards and possible collaborations with privacy‑conscious services.

SelfSovereignID

Summary

  • User‑controlled verifiable credentials stored locally, enabling identity proof without central registries.
  • Grants individuals the ability to issue, revoke, and port their digital identity across services.

Details

Key Value
Target Audience Privacy advocates, citizens in repressive regimes, blockchain enthusiasts
Core Feature Offline‑first credential wallet with ZKP‑based verification
Tech Stack Electron front‑end, Node.js backend, IPFS for storage, circom ZK circuits, W3C VC spec
Difficulty High
Monetization Hobby

Notes- Directly addresses “run your own country” sentiment by giving people a sovereign identity primitive they can actually own and trade.

PeerVault

Summary

  • Peer‑to‑peer decentralized cloud storage marketplace where users rent spare disk space and bandwidth.
  • Eliminates dependence on Amazon, Google, and Microsoft while providing censorship‑resistant storage.

Details

Key Value
Target Audience Developers of S3‑compatible apps, indie devs, privacy‑centric companies
Core Feature Marketplace with smart‑contract escrow and audit‑proof proofs
Tech Stack IPFS/Filecoin stack, Solidity escrow contracts, Rust microservices, TLS
Difficulty High
Monetization Revenue-ready: pay‑per‑GB usage fee

Notes- Mirrors discussions about building “separate web” services that avoid corporate platforms; could be the infrastructure for alternative web apps.

OpenCaptcha

Summary

  • Open‑source CAPTCHA replacement that authenticates humans using federated identity attestations rather than JavaScript puzzles.
  • Fully privacy‑preserving and works without Google reCAPTCHA or Apple Verify.

Details

Key Value
Target Audience Web developers, accessibility advocates, anti‑surveillance community
Core Feature Challenge‑response flow using decentralized attestation tokens
Tech Stack WebAssembly crypto library, WebAuthn, SQLite, Flask API
Difficulty Low
Monetization Hobby

Notes

  • Directly answers frustration about being locked out by Google’s reCAPTCHA loops; could be adopted by HN users seeking alternatives.

VC_Attest

Summary

  • Service that issues verifiable credentials (VCs) for device integrity to third‑party apps via an open attestation API.
  • Allows apps to verify any device’s security posture without needing Google’s Play Integrity.

Details

Key Value
Target Audience App developers, fintech, regulated industries
Core Feature VC issuance based on hardware attestation, signed by a public PKI governed by a DAO
Tech Stack Golang microservice, Cerberus PKI, DID method, PostgreSQL
Difficulty Medium
Monetization Revenue-ready: per‑credential fee

Notes- Provides a concrete technical path for

Read Later