Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trouble with Diaspora

blog.steveklabnik.com

Post reply on HN
Print view View original

71–80 of 166 posts

Re: Trouble with Diaspora

#71

Post by aaronbrethorst »

steveklabnik wrote: post #64
Maro wrote: post #58

Earlier quoted context omitted.

"The mistakes are beyond amateur." Can you pinpoint them? I don't think it makes sense not to at this point..

Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...

Same thing is true with UsersController#update (http://github.com/diaspora/diaspora/blob/master/app/controll...). At least they had the good sense not to implement #destroy.

Re: Trouble with Diaspora

#72

Post by Maro »

steveklabnik wrote: post #64
Maro wrote: post #58

Earlier quoted context omitted.

"The mistakes are beyond amateur." Can you pinpoint them? I don't think it makes sense not to at this point..

Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...

How is that a fundamental problem? It takes two lines of code to fix.

This is an alpha release. People shouldn't be using it, that's all. They should've put in an artificial limitation like max. 2 users with max. 2 pics each per server to avoid people using it.

The whole thing being in Rails is much more of a turn-off for me.

Re: Trouble with Diaspora

#73

Post by mcantelon »

patio11 wrote: post #25
cilantro wrote: post #3

This code was released to developers as an incomplete preview. I'm not sure why people are holding it to the same standards as a finished product that's being released to end users. Seems like a pretext to talk trash.

Their product is released to end users, because the first thing every early adopter is doing with their shiny new host-you-own federated social network is sending out invites.

They state it's a preview and has security holes. It's not their fault people are stupid.

Re: Trouble with Diaspora

#75

Post by thinkalone »

jlgbecom wrote: post #9
msy wrote: post #7

They could've really saved themselves some grief is they'd been far more explicit about saying that it's Alpha and months from being production ready. All this 'there's bugs! omfg!' hoo-ha could've been headed off at the pass

They could have saved themselves some grief if they didn't over-promise in order to get money for a project before they had a single line of code.

A perfect storm of backlash against Facebook's privacy issues combined with major media coverage thrust them into the spotlight - their original ambitions for the project and fundraising goal of $10,000 were set before that happened. By no means do I see that as "over-promising in order to get money."

Re: Trouble with Diaspora

#76

Post by shajith »

daleharvey wrote: post #69
patio11 wrote: post #25

Earlier quoted context omitted.

Their product is released to end users, because the first thing every early adopter is doing with their shiny new host-you-own federated social network is sending out invites.

So they should develop the whole thing behind closed doors because some people are going to have to suffer the embarassment of having someone post "hahaha disregard that ... " on their mini facebook wall? Their code is out there, they have openly said it is full of bugs and they now have a hell of a lot of eyes, They will get a massive benefit from this being opened early and it really isnt their problem if people re…

Part of me wants to say 'Cut them some slack, they just put their work-in-progress code on Github like they promised!'[1], but I understand that most of the criticism stems from caring enough about the project to want it to succeed. At this point, they should be thankful for the attention and the guidance more experienced people are providing for free.

The question is, do the problems in the code establish beyond doubt that this team is not capable of delivering a final product that will see some level of acceptance? I really hope not.

1: I'm assuming that - I would hope they didn't think this was release-ready material.

Re: Trouble with Diaspora

#78

Post by ohyes »

Maro wrote: post #63
ohyes wrote: post #59

Earlier quoted context omitted.

"when following on from a relatively small, elegant, and successful system." I don't think that the second system effect applies, specifically given that it isn't elegant or successful yet. (In fact, most of the comments are that it is inelegant and a failure). Second system effect mostly reflects the evils of redesigning a perfectly good working product.

IMO the Wikipedia definition is too restrictive. SSE is common even if the first design wasn't small, elegant or successful.

I agree, rewriting software, even ugly but well debugged software, is bad.

(Debugging is 90% of software development).

But this isn't even debugged.

I write a prototype to learn the technologies for a given project all the time. It is the first step in my development cycle (How the hell does this stuff work?) I don't design it, I just start hacking.

Once I have an understanding of how the various pieces are able to fit together, then I make a design and put together the first system.

My point is that I don't think this is complete or well-implemented enough to comprise a first system. (And it isn't, it is an alpha).

Re: Trouble with Diaspora

#79

Post by 10ren »

jat850 wrote: post #60
10ren wrote: post #56

It's an MVP. Problem is, it's in an established market. Although this worked for open source in the established unix market, that wasn't a mainstream market. But note: only a tiny subset of users are going to switch initially anyway, so, in practice, it's not mainstream at all. Besides, expert coders will contribute; I've seen it happen. And it's infinitely better than the alternative, of getting everything right fir…

The "V" in MVP stands for viable. As is, the Diaspora code base is not viable. Not even minimally so.

The "P" stands for product, not code-base.

Logically, security and privacy are secondary: they are properties of some functionality/data.

Re: Trouble with Diaspora

#80

Post by kenjackson »

steveklabnik wrote: post #65
msy wrote: post #29

Earlier quoted context omitted.

Not really, in fact that article was exactly what I was thinking of, reading it it'd be easy to get the impression they were talking about production software after the first sentence. Bugs are fixable and I haven't found any serious design or protocol mistakes, nor seen anyone else point any out. Given that, I'd say they're doing pretty damn well.

Yes, there are: http://news.ycombinator.com/item?id=1699782

Without more details its hard to tell how big of an issue this is. I've been brought in on projects to fix security in the past, and in many cases, after thorough design and code review, we crafted up a modified design and implemented it in a week.

And these were in substantially larger systems.

With that said, I haven't looked at the code, so maybe the issue is more fundamental than that, but I haven't seen evidence of that yet.

Post reply on HN