Live data from Hacker News

Show HN: Profile.io - Profiles for Developers

profile.io

41–50 of 53 posts

Re: Show HN: Profile.io - Profiles for Developers

#41
post #40
post #37

Earlier quoted context omitted.

I don't see the niche argument applying to a service that basically isn't a community; there is no in-service exchange between the users. flavors.me has a better design and presumably offers more service hooks than profile.io. Saying that profile.io is a niche product in the light of flavors.me just seems like PR-ish for "less appeal". :) If it's vertical, it can't be the same as a service with a wide appeal. From wh…

You are comparing a 3-day version of Profile.io to a 2+ year-old site. We have plans that would differentiate ourselves from the other services out there but we can't build all of them in a matter of days. It is not entirely inspired by About.me but we got some inspiration from it mainly with the design. If you look at my previous HN submissions, Profile.io is a byproduct of my previous project - Launchset. It's just…

I have spent more than 30 minutes of my time giving you suggestions for your service and outlining challenges that lie ahead.

If the about.me and appeal remarks seemed hostile, it was because I didn't know that I was talking to one of the creators. (Like I've said before, HN need to highlight that somehow.)

If that's not positive, I honestly don't know what is. And to give you some honest advice (I know how you hate that, though), your attitude to feedback isn't going to help you succeed. Quite the contrary.

Helping people is a little like being a parent; to your children, you're a parent first, and a friend second. You may have to make some unpopular decisions, but they're in the best interest of the person.

Re: Show HN: Profile.io - Profiles for Developers

#43
post #27

Escape (and everything else), and check the site for XSS. I don't mean to be rude, and I realize you two coded this up in a really short amount of time -- but before this site goes live it would be best to have it secure. Demo: http://profile.io/foobar [EDIT] As someone else pointed out, viewing the list-of-developers page puts up the XSS, which is even worse. I didn't know that page existed. [EDIT2] It turns out I b…

http://www.youtube.com/watch?v=hzVJFv9GyJg Seriously though, I hope you realized that the best thing to do when someone has XSS issues is to just tell them rather than EXPLOIT them.

Testing for exploits usually requires you to actually try an exploit.

Edit: just to be clear, this is for black box testing.

Re: Show HN: Profile.io - Profiles for Developers

#44

Earlier quoted context omitted.

I think the bigger issue is that your tracebacks are publicly visible.

Great point, thanks. Did I mention we made this entire site on a BUS RIDE? :)

Sure, I appreciate that you guys hacked this together under extremely tight conditions and I don't mean to be a dick about it. It's just that this is something which has the potential to be really bad, and depending on your framework you can usually fix this with a simple `debug = false` or similar.

Re: Show HN: Profile.io - Profiles for Developers

#47
post #35
post #31

Earlier quoted context omitted.

Fixed. Let me know if we missed anything. I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default. We can only upgrade to a later version of Django in Prod and not locally.

Usernames aren't sanitized yet. (As is visible with the ' EG: http://profile.io/xss2

Also, you missed the login form (both in the header and on http://profile.io/login). Its echoing the username directly, e.g., "Username alert(1) was not found"

Re: Show HN: Profile.io - Profiles for Developers

#48

"Favorite cloud provider?" God, can we at least not make it easy for people to stereotype us? The only non-silly answer is "water vapour".

Please explain why "Amazon Web Services" would be a silly answer.

Because "cloud" means nothing.

Re: Show HN: Profile.io - Profiles for Developers

#49

Earlier quoted context omitted.

Please explain why "Amazon Web Services" would be a silly answer.

Because "cloud" means nothing.

Really? To me as a developer, "cloud" means PaaS or IaaS.

It's fun to ridicule a trendy word when it is misused by marketing types. But among smart hackers, aren't we past that?

Re: Show HN: Profile.io - Profiles for Developers

#50

Earlier quoted context omitted.

Because "cloud" means nothing.

Really? To me as a developer, "cloud" means PaaS or IaaS. It's fun to ridicule a trendy word when it is misused by marketing types. But among smart hackers, aren't we past that?

Okay, I can see how GAE is a PaaS. Is AWS? If so, why isn't linode? And, by extension, any server...
Post reply on HN