Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Review my app for making server stacks social

stackfu.com

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Review my app for making server stacks social

#11

Post by city41 »

cartab wrote: post #9
brosephius wrote: post #6

what is the "social" part? I'm not entirely sure I get what the product is. is it the sort of thing where if you don't get what it is, you probably don't need it?

The social part is, imagine like a github, where people put up code and you can see it? Same thing with stackfu. People can put up stacks and you can deploy them to your server. Example: A user made a stack for Rails, you need rails, you go and deploy the guy's Rails stack. You'll be able to make a copy of it, edit it, review it, and make it yours if you want, fix it update and push your own version so other people c…

It reminds me of the community configs in EC2.

Are there any measures in place to deal with people who upload malicious stacks? Would they just receive negative reviews? Do you think you need to warn users to not blindly trust a stack?

Re: Review my app for making server stacks social

#12

Post by fcoury »

city41 wrote: post #11
cartab wrote: post #9

Earlier quoted context omitted.

The social part is, imagine like a github, where people put up code and you can see it? Same thing with stackfu. People can put up stacks and you can deploy them to your server. Example: A user made a stack for Rails, you need rails, you go and deploy the guy's Rails stack. You'll be able to make a copy of it, edit it, review it, and make it yours if you want, fix it update and push your own version so other people c…

It reminds me of the community configs in EC2. Are there any measures in place to deal with people who upload malicious stacks? Would they just receive negative reviews? Do you think you need to warn users to not blindly trust a stack?

Take a look at my reply to timmorgan:

http://news.ycombinator.com/item?id=1748915

Re: Review my app for making server stacks social

#14

Post by ryanhuff »

timmorgan wrote: post #8
brosephius wrote: post #6

what is the "social" part? I'm not entirely sure I get what the product is. is it the sort of thing where if you don't get what it is, you probably don't need it?

I believe it's social because it's a community where people can share their own scripts and improve on existing scripts. As well as deploy them easily, of course. It's a great idea I think.

If that's the case, maybe he should position it as an Appstore (or marketplace) for scripts?

Re: Review my app for making server stacks social

#15

Post by istvanp »

ryanhuff wrote: post #14
timmorgan wrote: post #8

Earlier quoted context omitted.

I believe it's social because it's a community where people can share their own scripts and improve on existing scripts. As well as deploy them easily, of course. It's a great idea I think.

If that's the case, maybe he should position it as an Appstore (or marketplace) for scripts?

That typically means there is a monetary component. I don't think that's the intended purpose.

Re: Review my app for making server stacks social

#17

Post by istvanp »

This looks like a great idea but I have a few concerns/questions about it:

1) As others have mentioned, there needs to be transparency on what each script does to make sure that it is not malicious. Is there a way to inspect the code without running it?

2) How do you protect the communication between stackfu and the user's servers? I saw in the video that you provide some keys, but is the connection thoroughly secured to prevent any potential spoofing? What about a potential attack that would come through the site itself and potentially access all users' activated servers? I would be very cautious to have stackfu installed as a daemon on a production server without knowing it's secure inside out -- even if I only enable it when I need it.

3) Did you consider developing a stackfu shell client? Using the command line client, you could provide some basic features like searching and running scripts. Since the scripts are started from the server itself this might be more secure. Although, you still need to make sure that the scripts are actually coming from stackfu (in case it was somehow spoofed), similar to package distribution systems (yum, apt, etc.). Another utility for the client could be to allow/disallow queued scripts sent from stackfu and maybe even a monitoring tool (see the output, previous logs, etc.).

4) How do you handle different *nix configurations? Do script authors need to make different scripts for each distribution? Do you provide a facility to only search for scripts that are compatible with your server(s)?

5) Aside from the number of deployments, do you have a rating system? Script failure and success rates? The number of deployments is hardly enough for me to choose from say 20 different Wordpress installation scripts.

Re: Review my app for making server stacks social

#18

Post by pjscott »

I notice that the web site doesn't tell me what StackFu is. I don't want to have to watch a video just to find out if the concept is interesting enough to warrant the time it takes to watch a video.

Anyway, it looks like a cool idea and I wish you the best of luck. And I've signed up for the beta. I still haven't watched the video.

Re: Review my app for making server stacks social

#19

Post by collint »

fcoury wrote: post #3
collint wrote: post #2

The flow in the video looks great. Easier to get into than Chef :) Hope it works as well (or better) Signed up for the beta

Thanks for the words. StackFu, however, is not a replacement for Chef. With Chef you provision and manage your server's configuration, while StackFu is a social place for people to share "recipes" or stacks to be installed on your server. Ideally, this will be the place for linux savvy folks to share their scripts. And for people who just wants to get something installed (like WordPress) to go, search and easily get…

I suppose my point is that, even with the new hosted suff, chef doesn't have the a polished "wow, I feel like I didn't do anything" feel yet.

If you can capture that you win in my book. If I run chef, or apt-get, or you-name-it through StackFu, then yes. StackFu is my replacement X.

For me the best part is the github-esque "username" / "scriptname", and what I imagine will be the social components behind it.

I think the real show-stopper would be a way to dump in my amazon/rackspace/etc. keys and get a real full stack in one click.

Re: Review my app for making server stacks social

#20

Post by fcoury »

istvanp wrote: post #17

This looks like a great idea but I have a few concerns/questions about it: 1) As others have mentioned, there needs to be transparency on what each script does to make sure that it is not malicious. Is there a way to inspect the code without running it? 2) How do you protect the communication between stackfu and the user's servers? I saw in the video that you provide some keys, but is the connection thoroughly secure…

1) Yes, there will be many ways to do it. One is online, clicking the scripts. We'll provide a lightbox with the code. Another way is "cloning" the script to your account (no git clone in this case, just a hard copy). You can then make changes and publish it back to your account.

2) The connections between your server and StackFu's will be done using HTTPS. We also offer the option to run the service as a daemon or as a standalone, where you have to manually confirm each installation request;

3) I am not sure I understand your concept of shell. We already have a REST API and a Ruby Gem that enables you to do things like publishing a new script, listing servers and scripts, deploy scripts, all from the command line.

4) This won't be available in beta, but we have planned as one of the possible requirements of the script to be the operating system, and that would involve doing some server side checking to make sure the proper OS is installed. Once we have that, I agree that we need to make that searchable;

5) We don't, currently, have a rating system nor rates, however they are interesting concepts. We may do a upvoting/downvoting system similar to what Reddit or StackOverflow does.

Thanks for your feedback. Keep them coming, please!

Post reply on HN