I don't want to disclose too many details
I thought the idea of a developer release was to do exactly this.
Trouble with Diaspora
91–100 of 166 posts
Re: Trouble with Diaspora
#92Earlier quoted context omitted.
I don't think anybody is "holding it to the same standards as a finished product." I haven't read the code myself, but the OP is claiming "really, really bad security holes", and calls out the encryption code. Security is not something that can be bolted on after the fact; it needs to be baked in from the start, in a product like this. And, remember, security/privacy was Diaspora's raison d'etre. No one expects the f…
Security is not something that can be bolted on after the fact In fact, this is how it happens in the vast majority of cases, including the case of Facebook.
"It can't be bolted on after the fact" doesn't mean it's impossible to take an insecure codebase and make it secure. It means that you can't leave it to the last thing and then just toss a few security things into your product. It means you have to rearchitect major pieces of the product, possibly all the major pieces, possibly switching around what the major pieces are entirely. If you want to show that in the "vast majority of cases" that happens, you need to start by establishing not merely that a particular codebase went from "insecure because nobody hardly thought about security" to "reasonably secure", but that the transition was easy.
Facebook probably isn't the best starting point because anything working at that scale is a challenge no matter what.
(Edit: Though if one measure's Diaspora's eventual size if it reaches its goals and considers what percentage of the man-hours have been put in to date, this is still early in the process and major rearchitecting of every component was inevitable anyhow, so hopefully with one of those they can install some security too.)
Re: Trouble with Diaspora
#93it's insulting to refer to them as kids and criticism like this is only helpful if you give examples: this article does not do that, just making wide sweeping statements about "how bad" it all is. i had a quick look at github, it didn't look like it stunk, but i don't know ruby nor the framework they use. they didn't appear to use pbkdf2 or similar to derive their crypto keys, so that isn't good. but at least they di…
I call everyone 'kids,' it's not meant to be offensive. I'm 24 myself.
The 'here's why' part gets tricky with security stuff. I don't want to be complicit in people trashing accounts. And if you read, I did submit patches.
And they are making up their own protocol. It's currently not documented.
Re: Trouble with Diaspora
#94This is the problem: college students are terrible programmers. There aren't enough consequences for writing bad code in college. In industry, you learn very quickly that everything you learned in college is minuscule compared to what you actually need to know to work. I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even…
"But a startup was probably the worst first endeavor for them. I think it's better to go through your male-programmer-humiliation on someone else's dollar."
I don't know. It seems like they are earning their "male-programmer-humiliation" in the most efficient way possible. If having an article about how atrociously buggy your code is at the top of Hacker News doesn't teach one instant humility, nothing will.
Re: Trouble with Diaspora
#95Steve, where did you get the $250,000 figure? Their Kickstarter page still shows $200K and change ( http://www.kickstarter.com/projects/196017994/diaspora-the-p... ), and now there are currently three mentions of $250K in the comments here, none of them questioning the $50K raise. Just checking to see if I missed another bit of funding somewhere.
Nope, I just remembered wrong. I'll edit that now, thank you. At least that's not as bad as someone on Reddit who tried to say they raised $4mm...
No worries - I would have left a comment on your post, but I didn't have an account to sign in with, and wasn't sure if maybe they had raised an additional $50K outside of Kickstarter.
Just wanted to say good on you for fixing bugs and contributing to Diaspora! Unfortunately I don't even know enough Ruby to understand what I'm looking at, but I'm excited about the project - they've definitely got a good resource in you! Is there any indication that they switched to Ruby during this Summer? I swear it was originally going to be in PHP, but I can't find any mention of that now. Could the oversights in the code be due to this being the first piece of Ruby the team has written?
Re: Trouble with Diaspora
#96Earlier quoted context omitted.
The "P" stands for product, not code-base. Logically, security and privacy are secondary: they are properties of some functionality/data.
Yes, P does indeed stand for product. And this is not a product. Not yet, anyway.
If you do some reading around MVP, you might be surprised at what a low standard exists to constitute a product. Some folk even count an ad + landing page as an MVP. ie. 0 code base. An MVP is a point of departure, not arrival.
Re: Trouble with Diaspora
#97This code was written by a bunch of undergraduate college students. This is hiring a bunch of interns (with near zero experience) to implement your product, giving them three months, and then being shocked -- SHOCKED, when the code is not professional grade quality. I was shocked when everyone and their brother was willing to shell out money to a group of completely unproven college students to produce a distributed…
" Hopefully they haven't burned through too much of the $250,000 that they started with. " They mention at least two large cost items - luxr (basically consulting by Janice Fraser, it says around $10k on the company page) and pivotal labs. Pivotal is the huge one, I once got a quote from them on a project I was working on and they basically said they don't do less than 6 figures. So unless they got some kind of insid…
According to a post in a thread yesterday, they just worked at Pivotal's office, they weren't consulting for them.
Re: Trouble with Diaspora
#98Earlier quoted context omitted.
They could have saved themselves some grief if they didn't over-promise in order to get money for a project before they had a single line of code.
A perfect storm of backlash against Facebook's privacy issues combined with major media coverage thrust them into the spotlight - their original ambitions for the project and fundraising goal of $10,000 were set before that happened. By no means do I see that as "over-promising in order to get money."
Even asking for $10,000 was major hubris that made me skeptical they were up to the task. But they could have been more honest about their capabilities, timeline, roadmap, etc. in order to put things into perspective and bring the hype down a notch. They most definitely over-promised, even if they had only received the original $10k
Re: Trouble with Diaspora
#99This is the problem: college students are terrible programmers. There aren't enough consequences for writing bad code in college. In industry, you learn very quickly that everything you learned in college is minuscule compared to what you actually need to know to work. I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even…
I think it's better to go through your male-programmer-humiliation on someone else's dollar.
I'm pretty sure that's what just happened.
Re: Trouble with Diaspora
#100Earlier quoted context omitted.
Nope, I just remembered wrong. I'll edit that now, thank you. At least that's not as bad as someone on Reddit who tried to say they raised $4mm...
No worries - I would have left a comment on your post, but I didn't have an account to sign in with, and wasn't sure if maybe they had raised an additional $50K outside of Kickstarter. Just wanted to say good on you for fixing bugs and contributing to Diaspora! Unfortunately I don't even know enough Ruby to understand what I'm looking at, but I'm excited about the project - they've definitely got a good resource in y…
They won't have me for long; I have my own projects to work on. Hackety Hack is more important to me, by far.
I also vaguely remember that it was supposed to be in PHP as well, and several other people have mentioned that. I can't find a source...
It could be the reason, but things like "make sure if you're trying to delete a photo, it's yours" is something that transcends implementation languages, you know?