121–130 of 166 posts
Earlier quoted context omitted.
And more importantly, if you're going to rewrite, why help Diaspora, and not a more mature option?
Because momentum and attention are more important than maturity. The qualities that come from maturity can be built with work; momentum and attention aren't as much of a function of hard work and are far more difficult to capture.
This is the problem: college students are terrible programmers. There aren't enough consequences for writing bad code in college. In industry, you learn very quickly that everything you learned in college is minuscule compared to what you actually need to know to work. I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even…
I agree with you up until your last paragraph "a startup was probably the worst endeavor for them". The sheer gumption to throw yourself whole-heartedly at problems you are unqualified to solve is one of the most important characteristics of a startup founder. Even if you spent time learning to be a great coder, there would be a dozen other things you'd need to be doing for the first time when you first start a start…
It's this kind of code bashing that makes it difficult and intimidating for newbies to break into development. Think twice before you lambast younger, less experienced programmers on the internet. What a shame.
They (Diaspora staff) said this as they released it: "Feel free to try to get it running on your machines and use it, but we give no guarantees. We know there are security holes and bugs..."
The issue is you shouldn't build (or ship) code like this with such major security holes, you build security at the start, it should be an integral part of the application. You can't just dick out some insecure application then add in security, it doesn't work.
Earlier quoted context omitted.
"The mistakes are beyond amateur." Can you pinpoint them? I don't think it makes sense not to at this point..
Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...
Rails 3 has been in beta for the better part of the summer. This means that many plug-ins (Devise included) haven't been able to keep up 100% compatibility. It's entirely possible that they've only implemented Devise for login authentication, but plan on expanding with something like Warden or Clearance for model/controller level security as the plug-ins come up to speed.
Our group started on a Rails 3 app back in March, and we learned early on that we should stick to our core app development, avoiding plug-in implementations until things stabilize. Hell, look at Bundler. The jump from 0.9.x to 1.0 broke our app deployment methodology between the beta3 release and Rails 1.0. We never even got around to beta4. When you develop using a beta framework that evolves quickly and breaks compatibility, you have to be careful where you place your efforts.
I'm not ready to lay down on the tracks and defend them here, but I don't think it's an impossible to assume that they just haven't addressed security yet. Maybe they haven't arrived at a framework choice. The fact that there is literally no security would seem to suggest this is true more so than if they had sparse security.
One aspect remains true, however. Anyone who deploys this and puts anything of value in it is asking to get body slammed.
1. Most of the XSS errors should be handled by Rails 3 auto-escaping. I'm not certain why this isn't happening. It may be a simple HAML config error or bug.
2. The session key should be moved out of the Git repo.
3. Most of the authorization can be done by reaching through the current user's associations. For example "current_user.photos.destroy" would prevent users from destroying other's photos.
I'm not defending the developers here and agree these should not have gotten past them. My point is these problems can be fixed in a few days, and thanks to open source, there are many eyes looking at the code to find additional security issues.
Earlier quoted context omitted.
Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...
Same thing is true with UsersController#update ( http://github.com/diaspora/diaspora/blob/master/app/controll... ). At least they had the good sense not to implement #destroy.
Earlier quoted context omitted.
I agree with you up until your last paragraph "a startup was probably the worst endeavor for them". The sheer gumption to throw yourself whole-heartedly at problems you are unqualified to solve is one of the most important characteristics of a startup founder. Even if you spent time learning to be a great coder, there would be a dozen other things you'd need to be doing for the first time when you first start a start…
I wholeheartedly agree with you, if the fact was as simple. As it stands, the paragraph should have read: "a startup [with $200,000 funding of other people's money] was probably the worst endeavor for them", as that more accurately represents the reality of the situation.
Perhaps the problems also lie in the expectations of those giving money. I assure you that few experienced angel investors would have been upset or surprised that the college kids they gave $200K to produced code that was messy or had some bad security problems in the early stages. They would be a lot more concerned with how the founders planned on getting adoption for their fledgling service, or whether they were iterating on the product quickly enough. It seems that many who have donated to Diaspora (or who are getting upset on behalf of other people who donated to Diaspora) have different expectations. '
Just today I was playing with the product of a company in the just-ended YC batch. I found I was able to delete someone else's posted content on the site trivially easily. While I'm sure PG wouldn't be exactly happy to hear about this, he sure as heck wouldn't think that the founders should have spent more time learning to code in industry before taking his money to build a startup. He'd just tell them to fix it (and it's probably fixed by now), and then move on to more important questions like whether they were getting more users and building the right features.
This code was written by a bunch of undergraduate college students. This is hiring a bunch of interns (with near zero experience) to implement your product, giving them three months, and then being shocked -- SHOCKED, when the code is not professional grade quality. I was shocked when everyone and their brother was willing to shell out money to a group of completely unproven college students to produce a distributed…
" Hopefully they haven't burned through too much of the $250,000 that they started with. " They mention at least two large cost items - luxr (basically consulting by Janice Fraser, it says around $10k on the company page) and pivotal labs. Pivotal is the huge one, I once got a quote from them on a project I was working on and they basically said they don't do less than 6 figures. So unless they got some kind of insid…
What exactly is so abnormal about being concerned with Facebook's privacy problems? Particularly, what issues are normal to be concerned about and what issues make one a "neckbeard-sporting privacy nut"?