Hi y’all! I’ve been on my building grind outside of work and made some cool stuff. The biggest one by far though is this - Tutti! It’s actually being used by some of my friends :D.

The Idea

Every day, everyone in your group has to take one photo, live. Similar to BeReal, but not limited to a certain time of day. Until everyone in the group has posted, no one can see the photos. All they’ll see is a very blurred sample of each photo, including their own. The moment that everyone in a group has posted, the day “reveals” itself and the photos are shared. From here, you can react, comment, see when people posted, etc. Then the streak is incremented and the loop continues :). Each group you’re in has its own streak, photos, and comments too!

The name comes from the Italian word Tutti - meaning “all” or “everybody”. This meaning extends further into the musical world, where tutti is a direction for all parts of an orchestra/ensemble to perform together. Taking these two parts, I made the logo and the theme of the app!

Why

My friends and I used to use an app called Stripz that was pretty fun, but we all had grievances with it. When we heard rumors of it being shut down I decided to develop my own version for us!

Because I’m developing it, we all get to customize it to our liking - like the people who upload last are highlighted to call them out :). It leads to an interesting process for me too, since I receive random requests and have to verify if they can actually be implemented. Sol really wants gambling.

Research and Design

I did a decent amount of research before even starting the code. I collected a bunch of screenshots from Stripz. I wrote down the functionality, the bugs, the issues we had, then I chose my MVP. I wanted to cover the basics before the beta.

• One photo per person per group per day
• No late posts
• No updating images
• Missing a day breaks the streak and keeps the photos blurred
• Nudges are capped per person

I also focused on the security here, as it’s easier to start with a good foundation than patch it. The app receives a lot of data and I want to keep my friends safe :). The security highlights include:

• No public photo links - Every photo goes through a logged-in, permission-checked request. So guessing a URL gets you nothing
• Strict uploads - Every image is re-encoded on the server (which strips location data), size-limited, and stored under a random name
• Passwords - Hashed with argon2id behind rate limits
• Sessions - Random opaque tokens, stored hashed so a leak doesn’t expose logins
• Locked-down hosting - The database isn’t reachable from outside, containers have limited permissions, the app’s database user can’t change the schema, and deploys are pinned to exact image versions
• Deploying - Each push runs through over 500 unit tests, end-to-end testing, vulnerability auditing, and linting before being built

The Ongoing Beta

The beta started with four of us, and now there are eight active users! We’ve found a bunch of things to change, which has been great for me since I’m not normally an ideas guy. Since starting the beta, we’ve added post-times on revealed photos, emoji reactions, a color picker, a nudge-everyone button, and video support! There’s a bunch of stuff still in the backlog but I’ll get to it eventually lol.

Joining

Tutti is invite-only right now, so if you wanna try it just message me :). Otherwise, gg?

∠(^ー^)