Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Orange Forum – Web 1.0 style forum written in Go

goodoldweb.com

Post reply on HN
Print view View original

131–140 of 178 posts

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#131

Post by zaarn »

masklinn wrote: post #123
tptacek wrote: post #21

Earlier quoted context omitted.

The math/random point is well taken. The hex.EncodeToString() point is a nit. Generate 128 bits of randomness, and then encode it however you'd like. The track record of people trying to get "generate random numbers in the alphanumeric range" isn't great; it's an opportunity to reintroduce bias. Start with a random token of sufficient size, then encode. The Argon2 vs. bcrypt thing is unhelpful. It does not matter wha…

> The Argon2 vs. bcrypt thing is unhelpful. It does not matter what password hash you use, so long as you use a hash designed for password storage (ie: not "salted SHA-2"). Bcrypt is fine. Does it not have the issue that it will silently truncate passphrases beyond 72 bytes? As far as I can tell OP does not check for that and the Go API they use makes no mention of it and was affected at some point[0]. 72 bytes is no…

This is the reason I usually recommend to pre-hash the password with something like SHA512 or SHA3. Dropbox takes this approach too.

On the other hand, 72 bytes is a lot, especially when you have decent bcrypt settings.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#132

Post by foxhop »

KajMagnus wrote: post #75
hasenj wrote: post #68

Earlier quoted context omitted.

> Like getting notified when someone @mentions or replies to you Really? _that_ is complicated? Serious question, do you find it complicated because you're still a beginner, or is there something I'm missing? What language(s) did you use?

Well this @mention is a bit more complicated than what one might think. For example: If someone creates a post, without any @mention, then edits it, and adds a @mention — then, do you detect this, when looking at the edits, and send a @mention notification now? And what if s/he edits the post again, and removes the @mention, then, do you remove the notification? Cancel the email if it hasn't been sent yet? And if the…

What if the @mention user decides to change his/her display name, now you need to parse @mention into a unique id and save that in the database with comment body and then translate it back when you serve it to the currently chosen @mention name...

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#133

Post by elnygren »

candiodari wrote: post #52

The irony is that because of the lean structure behind the server, this forum actually responds faster than most webfora that do use AJAX/SPA. Funny given that the whole purpose of AJAX/SPA was to reduce response time. That's it's reason for existing. Turns out it just complicates things ...

I think what you say makes no sense at all.

The idea of AJAX/SPA was to provide interactivity and a less technical UI that caters to the average Joe. AJAX/SPA moves some of the computation from the backend to the frontend so the service scales better for millions of users.

This forum is not going to be fast for millions of users (it might not even be for hundreds of simultaneous users) because the server has to render everything again for everyone.

Server side rendering is good for response times, that's why the SPA world went back to it (Google: react ssr). SPA is good for scalability and average Joe UI.

...and AJAX is there so we don't need to do a full page reload all the time. Again, not because of response times.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#134

Post by masklinn »

zaarn wrote: post #131
masklinn wrote: post #123

Earlier quoted context omitted.

> The Argon2 vs. bcrypt thing is unhelpful. It does not matter what password hash you use, so long as you use a hash designed for password storage (ie: not "salted SHA-2"). Bcrypt is fine. Does it not have the issue that it will silently truncate passphrases beyond 72 bytes? As far as I can tell OP does not check for that and the Go API they use makes no mention of it and was affected at some point[0]. 72 bytes is no…

This is the reason I usually recommend to pre-hash the password with something like SHA512 or SHA3. Dropbox takes this approach too. On the other hand, 72 bytes is a lot, especially when you have decent bcrypt settings.

> This is the reason I usually recommend to pre-hash the password with something like SHA512 or SHA3. Dropbox takes this approach too.

Yes, the issue is that you have to remember to do that.

> On the other hand, 72 bytes is a lot

From my own comment:

> 72 bytes is not a very high limit when SEA abugida use roughly as many symbols as western alphabets per word/phrase but each symbol takes 3 bytes (assuming UTF-8) rather than one.

> For instance "Gujarati script" is 15 codepoints and 15 bytes but and "ગુજરાતી લિપિ" ("Gujarati script" in Gujarati) is 12 codepoints and 34 bytes.

In two words, Gujarati (and many other SEA/Brahmic abugida e.g. Tai) is halfway there, a decent passphrase in an SEA script will blow right through.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#135

Post by adbachman »

hasenj wrote: post #119
Johnny555 wrote: post #97

Earlier quoted context omitted.

You're glossing over the fact that in order to have all of those complicated notification rules that users expect, you have to allow the user to set all of those complicated notification settings. You have to give them the ability to subscribe to threads, set notification preferences for a variety of items (channels, username mentions, keyword mentions, @here mentions, etc), set DND and exceptions, etc.

All of these are small things.

Which is exactly the point the original poster was making. Software development on "simple" consumer apps is death by a thousand cuts.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#136

Post by dullgiulio »

elnygren wrote: post #133
candiodari wrote: post #52

The irony is that because of the lean structure behind the server, this forum actually responds faster than most webfora that do use AJAX/SPA. Funny given that the whole purpose of AJAX/SPA was to reduce response time. That's it's reason for existing. Turns out it just complicates things ...

I think what you say makes no sense at all. The idea of AJAX/SPA was to provide interactivity and a less technical UI that caters to the average Joe. AJAX/SPA moves some of the computation from the backend to the frontend so the service scales better for millions of users. This forum is not going to be fast for millions of users (it might not even be for hundreds of simultaneous users) because the server has to rende…

If it were to scale to millions of users, caching would help.

At that point, you'd have to cache the JSON responses just the same, so the complexity of cache invalidation would be there in the exact same way.

But you would still not have the additional load and bloat on the user browser.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#137

Post by dullgiulio »

aaron-lebo wrote: post #101
candiodari wrote: post #52

The irony is that because of the lean structure behind the server, this forum actually responds faster than most webfora that do use AJAX/SPA. Funny given that the whole purpose of AJAX/SPA was to reduce response time. That's it's reason for existing. Turns out it just complicates things ...

Turns out it just complicates things ... No, a good car is not evidence that the plane just complicates things, it's evidence that you've got a good car.

We should be arguing that most people use cars and don't need to take the plane for some simple CRUD apps...

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#138

Post by Ntrails »

KajMagnus wrote: post #75
hasenj wrote: post #68

Earlier quoted context omitted.

> Like getting notified when someone @mentions or replies to you Really? _that_ is complicated? Serious question, do you find it complicated because you're still a beginner, or is there something I'm missing? What language(s) did you use?

Well this @mention is a bit more complicated than what one might think. For example: If someone creates a post, without any @mention, then edits it, and adds a @mention — then, do you detect this, when looking at the edits, and send a @mention notification now? And what if s/he edits the post again, and removes the @mention, then, do you remove the notification? Cancel the email if it hasn't been sent yet? And if the…

It's a forum. Read the thread and don't have any such concept as a "mention". If you get quoted, you'll see it as you go through the pages. If you're really lazy just namesearch your handle (which may or may not change, may or may not be unique, etc) but basically participate don't just cherrypick.

I hate most modern forum software with a passion.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#139

Post by hasenj »

imron wrote: post #130
hasenj wrote: post #120

Earlier quoted context omitted.

How did you count 30? Are we looking at the same picture? I counted 9. - channel is muted and message not in a thread the user is subscribed to - user in dnd-mode and there's no dnd-override - this is a @channel mention but @channel mentions are suppressed - message is for a thread user is subscribed to but channel notification perf is nothing - notification preference for device is set to "never" - @here mention but…

> How did you count 30? Counting paths from the first node to the "NO" node rather than just counting total edges leading to the "NO" node. Many of the conditions you mentioned are themselves determined based on various other conditions, and/or only triggered if certain paths (but not others) are followed. > You can check these conditions sequentially and if any of them match, return false. Not so. For example, you c…

No matter. I transcribed that list in a matter of 5 minutes with no knowledge about the application (I haven't used slack in a long time). I'm not going to get it right in 5 minutes. It will obviously take time.

But, this is not the kind of thing that justifies, for example, having 20 engineers to work on this one problem for three weeks.

It's still a simple thing for one person to handle in a couple of days.

I don't get why people use feature lists as an excuse for why things take a long time and require many many engineers.

Re: Show HN: Orange Forum – Web 1.0 style forum written in Go

#140

Post by sitkack »

JoshMnem wrote: post #92
sitkack wrote: post #80

Earlier quoted context omitted.

Discourse uses too much memory on the client and crashes the browser. As you said, someone shouldn't need latest gen hardware to use the WWW. I personally don't have a lot of control in what the predominate platforms are on the internet, but I have remarked to myself in my bunker that Discourse is a first world echo chamber because no-one else can run it. Look at hacker news. It isn't pretty and it has lots of glarin…

I love HN's design. It's the "Craig's List school of design" -- simple presentation of information with no distractions. The WWW has been heading in a terrible direction (animation, over-saturated colors) over the past few years. People use too much JS and CSS3 because it's possible, not because it's a good idea. Have you tried turning of JS on Discourse forums? It should render a minimal HTML page via the elements.…

HN is no where close to Craig's List in terms of design. They are both minimal, fast and task driven, but Craig's is a work of art. HN is a roughshod hackers tool.

Frankly, it never occurred to me that Discourse could ever run w/o JS. Next time I am near my ipad, I'll definitely test it out. I'd use a combo of allow/deny. Remember when we used "gradual enhancement" ?

I think there should be a standard way for the client to request the low resource usage version of an app, the hack is say you are a phone or request the m.dot site, but it should just be in the accepts header.

Post reply on HN