Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Diaspora Developer Release

joindiaspora.com

Post reply on HN
Print view View original

171–180 of 202 posts

Re: Diaspora Developer Release

#171

Post by patio11 »

uptown wrote: post #163
danieldon wrote: post #121

Earlier quoted context omitted.

Well, there's at least one glaring security issue that should be obvious to any Rails developer.

Did you remember to bring enough knowledge to share with the rest of the class? What glaring issue are you referring to?

This is the problem with public disclosure: I could tell you, but it would practically write exploit code which you could point at any one of the "Try Diaspora now!" sites popping up and do very bad things.

Here, let me tell you what isn't a problem: you cannot type "system('rm -rf /')" into their username field on the signup form and wipe any machine with Diaspora installed because some idiot passed untrusted user input straight to exec. But if that were a problem, do you understand why mentioning publicly "Hey, the username field is passed straight to exec... that's sort of bad." is a bad idea? Because that lets any idiot immediately create wipe_arbitrary_diaspora_install.rb

There are several vulnerabilities in Diaspora right now. They allow very bad things. There are multiple public Diaspora installations. They are all vulnerable to very bad things.

I think releasing this was very, very premature.

Re: Diaspora Developer Release

#172

Post by danieldon »

uptown wrote: post #163
danieldon wrote: post #121

Earlier quoted context omitted.

Well, there's at least one glaring security issue that should be obvious to any Rails developer.

Did you remember to bring enough knowledge to share with the rest of the class? What glaring issue are you referring to?

It's interesting to see people on HN downvoting some for being responsible with information while upvoting those who advocate irresponsible disclosure.

Re: Diaspora Developer Release

#173

Post by bld »

bl4k wrote: post #112
xelfer wrote: post #12

They really need to do something about that name. They seem to be having trouble with it themselves: http://github.com/diaspora/diaspora/commit/708e9f88a55cc3713...

The name reminds me of the holocaust. It doesn't help that the color theme of the app evokes Schindler's List. You can bet for most non-US people that 'diaspora' reminds them of some sort of persecution their people have faced. It is also a word that is used in a lot of languages, I have friends who are Russian, Ukranian, Serbian, Lebanese, Armenian, Jordanian etc. who all refer to themselves being in the 'diaspora'…

And now the name has a positive connotation. Powerful, in a way, because so many cultures identify with it.

Re: Diaspora Developer Release

#174

Post by dRother »

xelfer wrote: post #12

They really need to do something about that name. They seem to be having trouble with it themselves: http://github.com/diaspora/diaspora/commit/708e9f88a55cc3713...

To the average person who hasn't encountered this word much, it is reminiscent of 'spores' and 'diarrhea'. Clearly, not the best branding.

Re: Diaspora Developer Release

#175

Post by dRother »

melvinram wrote: post #23

They are building social networking software which means that at some point the goal will need to be to get everyone and their mother on board. Because they built the app on Rails, they are now facing an uphill battle with distribution as there are not a lot of places that you can easily setup a Rails site. I love Rails but for this type of app, it might have helped them gain traction faster if it was built on PHP, o…

The fact that they are using rails demonstrates more newbie-style cluelessness, to me. Not even remotely a good choice. But, the sort of things 4 guys fresh out of college with no experience would think was the obvious choice.

Re: Diaspora Developer Release

#176

Post by ohyes »

alanh wrote: post #47
xelfer wrote: post #12

They really need to do something about that name. They seem to be having trouble with it themselves: http://github.com/diaspora/diaspora/commit/708e9f88a55cc3713...

For a lot of people, their name’s strongest connotation is Jewish persecution. To me, this is so awkward as to rule out the name for use in serious software.

I think a bigger problem might be that for the majority of people who use The Facebook, diaspora has absolutely no denotation. (And very little connotation).

Diaspora is at least an easy-grade SAT word.

Even for those of us who know the denotation, it gives absolutely no indicator as to what the product does. (It is instead a reference to how the product works... dispersed Facebook). From a marketing standpoint this is a problem.

Hopefully this will become 'the diaspora project', and they will come up with a new name for the actual results of it.

Re: Diaspora Developer Release

#177

Post by SoftwareMaven »

vault_ wrote: post #15

It seems to be AGPL licensed. I'm wondering how that will affect adoption.

I think CDDL would potentially be a better license. That would force returns on existing files in the project (keeping it from going closed), but if you have your own changes outside of those files, you should be OK (allowing you to commercialize your enhancements).

Re: Diaspora Developer Release

#178

Post by SkyMarshal »

DavidSJ wrote: post #155
SkyMarshal wrote: post #123

Earlier quoted context omitted.

"You can bet for most non-US people that 'diaspora' reminds them of some sort of persecution their people have faced." I like it for that reason. Edgy, accurate, and with the potential to repurpose/reframe the word in the minds of many. That kind of persecution also tends to cause the persecuted to bond even more strongly and proudly with their cultural identity, so the connotations are not all bad.

Sure, but this sounds like a cult of victimhood or differentness, and you'll find that these subcultures remain in the minority, in part because they define themselves as a minority.

The individual subcultures do, but taken altogether they could be quite large. Good point though, we'll see, hopefully that's not Diaspora's fate.

Re: Diaspora Developer Release

#179

Post by mathias_10gen »

warp wrote: post #122
bl4k wrote: post #109

Earlier quoted context omitted.

I think that since the community funded this project that the code should have a more liberal license so that the community can do what they want with it. The project also depends on MongoDB, which is also AGPL licensed, which raises the question of if paid hosting of a diaspora instance is 'commercial' and if it requires a MongoDB license from 10gen, I would think that it does. They should BSD/MIT license their own…

The AGPL (like the GPL) does not allow adding more restrictions. You do not need any further license to use AGPL licensed code in a commercial product, you just have to abide by the license terms of the AGPL. I assume the 10gen commercial license allows you avoid having to provide source code for your product to your users. (but the mongodb website isn't clear about that).

We try to be very clear about licensing: http://www.mongodb.org/display/DOCS/Licensing. Please let us know if there is something on that page that needs clarification.

I would like to make it clear that users of MongoDB don't need to opensource their product, only their changes (if any) to the MongoDB server itself. The commercial license is mostly for companies that have strict (if misguided) "no AGPL" policies. Most users do not need it.

Re: Diaspora Developer Release

#180

Post by mathias_10gen »

jarin wrote: post #149
bl4k wrote: post #109

Earlier quoted context omitted.

I think that since the community funded this project that the code should have a more liberal license so that the community can do what they want with it. The project also depends on MongoDB, which is also AGPL licensed, which raises the question of if paid hosting of a diaspora instance is 'commercial' and if it requires a MongoDB license from 10gen, I would think that it does. They should BSD/MIT license their own…

You can always use something like MongoHQ, they've already paid the commercial license and 16MB is plenty for mucking about on your own.

MongoHQ and other companies providing commercial hosting of MongoDB only need a commercial license if they modify the server and don't contribute back. We want to encourage hosting providers which is why we don't require buying a special license.
Post reply on HN