Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Oya – New projects set up lightning fast

oya.sh

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Show HN: Oya – New projects set up lightning fast

#101

Post by steve_adams_86 »

marcell wrote: post #70

I don’t like to go meta, but this is the meanest response to a Show HN I’ve seen in a while. Almost every comment is a reason why it sucks or a random nitpick. If you don’t have anything nice to say, just don’t say anything at all.

If I had a project to Show HN and got this much feedback, I would actually be totally stoked. When feedback is mostly positive, you can't tell if people are sugar-coating or flat out lying to you. This stuff is largely very constructive. The main points are:

- No one really knows what this is, or what problem it solves

- If it's a Make replacement, why not just use Make?

- Is this a new syntax or just YML?

- The marketing approach seems to miss the mark

With that alone they can refine their presentation and message quite a bit. That's quality and honest feedback, even though it might not feel good at first.

Re: Show HN: Oya – New projects set up lightning fast

#103

Post by onion2k »

tomtomtom777 wrote: post #67
onion2k wrote: post #19

Earlier quoted context omitted.

Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Serving the file over HTTPS is good because it means no one can do a man in the middle attack to change it, but it's not enough to be secure. If someone compromises the server itself the file could be altered at the source. The point of the checksum is to ensure that the file you're downloading…

> If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, ... That is not a practical solution at all . What do users find if they enter the "download" page? A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link? The reality of today's identity management…

A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link?

It wouldn't need to be an external site. You can have more than one server running a domain, with a different set of keys (entirely different architecture if you want) to make hacking both harder.

Re: Show HN: Oya – New projects set up lightning fast

#104

Post by skrebbel »

bildung wrote: post #62
skrebbel wrote: post #4

Earlier quoted context omitted.

If their GitHub account gets hacked, so do their customers. What's the fundamental difference?

You have the download at github and the checksum at you webserver. Same effort, but now attackers would have to have both services compromised to plant a malicious download.

So you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source?

And the argument here is that if you don't do that, you're shit at security?

Re: Show HN: Oya – New projects set up lightning fast

#105

Post by bildung »

skrebbel wrote: post #104
bildung wrote: post #62

Earlier quoted context omitted.

You have the download at github and the checksum at you webserver. Same effort, but now attackers would have to have both services compromised to plant a malicious download.

So you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source? And the argument here is that if you don't do that, you're shit at security?

No, I've said "Same effort, but now attackers would have to have both services compromised to plant a malicious download"

Re: Show HN: Oya – New projects set up lightning fast

#107

Post by ecmascript »

bilus wrote: post #40
ecmascript wrote: post #25

I went through most of the documentation but I still don't understand how this will help me in any way. I don't understand what it is? > Become a hero Marketing jargon like this is IMO very tiring. I am a hero because I use your product? Ok, I guess that is a very loose definition of that word. I don't want to be negative really, but I have actually no clue what this product does or what problem it solves.

You're not being negative, that's super useful feedback. We're using Oya internally but are still struggling with making it 100% (or even 80%:) clear what it is that it does. :)

Perhaps I'm not your target audience which is just fine. But I would suggest to make some example of real world issues that Oya solves.

Right now it just felt way too generic and the silly marketing is not really helping. It could help to explain who will view you as a hero when using your product instead of just being a hero in the general sense, which is clearly not the case.

Re: Show HN: Oya – New projects set up lightning fast

#108

Post by tomtomtom777 »

onion2k wrote: post #103
tomtomtom777 wrote: post #67

Earlier quoted context omitted.

> If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, ... That is not a practical solution at all . What do users find if they enter the "download" page? A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link? The reality of today's identity management…

A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link? It wouldn't need to be an external site. You can have more than one server running a domain, with a different set of keys (entirely different architecture if you want) to make hacking both harder.

I still don't really see how this makes hacking harder. An attacker needs to replace the information presented to the user in order to download the software. For instance, the "download" link, or the paragraph describing the download/checksum procedure.

This always originates from one spot for one user. You can spread among users, but you can not spread a single html snippet over machines in a way that a hacker couldn't replace the "root" html snippet.

Re: Show HN: Oya – New projects set up lightning fast

#109

Post by akuji1993 »

bilus wrote: post #47
akuji1993 wrote: post #5

How does this add anything to my process compared to npm tasks, that do the automated work right now, together with out Gitlab CI system?

Not everybody uses JavaScript. There are many language-specific task runners (e.g. Rake, Mage etc.). Oya is aiming to be language agnostic and lightweight (not require a ton of dependencies).

Fair point, thanks for pointing it out.

Re: Show HN: Oya – New projects set up lightning fast

#110

Post by ktarnowski »

gremlinsinc wrote: post #26

This is a horrible marketing piece...I'm assuming it bootstraps a go project because one of the files was go, but nowhere does it say what language/framework you're bootstrapping...at first I assumed it was just another express.js bootstrapper...

Thanks for being honest. Can you tell more what we could do better with Oya and, be length, with other Open Source initiatives?
Post reply on HN