Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thoughts.page: hosting a small webpage for your thoughts

thoughts.page

Post reply on HN
Print view View original

91–100 of 111 posts

Re: Thoughts.page: hosting a small webpage for your thoughts

#93

Post by benbristow »

londons_explore wrote: post #17
pattle wrote: post #9

Earlier quoted context omitted.

Yeah it's an interesting model. I'm guessing it works on an honour system as income isn't easily verifiable

In Norway, everyone's income is public information. Other countries could do the same to make things more transparent.

Tbf in Norway everyone would be skint after a few beers regardless of their salary so you're all pretty even (jk, ofc.)

Re: Thoughts.page: hosting a small webpage for your thoughts

#94

Post by psychometry »

monkeynotes wrote: post #76
psychometry wrote: post #63

Earlier quoted context omitted.

>allowing people to use arbitrary HTML and JS was an intentional choice Oh, you'll be reversing this choice VERY quickly if your product gets any traction, I assure you...

I don't actually see a problem. It goes against my gut reaction but given the pages that are published are entirely isolated there is no more of a threat than someone publishing whatever they want on another web host. There is no user information to hijack, no cookies, no login buttons, no local storage, no auth etc. Yes, the pages can publish illegal information, be set up as phishing hubs, but none of that is as a…

How are they isolated if you can inject JS that downloads resources from anywhere else? I mean, just to start:

- You have no CSP header that I can see.

- You do expose the server version in the headers, though.

- The site is available at a non-SSL-secured domain.

- There's no X-Frame-Options, X-Permitted-Cross-Domain-Policies, etc.

Re: Thoughts.page: hosting a small webpage for your thoughts

#96

Post by jameal »

0xbkt wrote: post #55

Did anyone else notice the reflow hack(?) using JS on the H1 title as well? As a backend guy, just curious whether this JS-assisted way of responsive Web development is commonplace/best practice, and if this is how it is usually done today. I guess it is to keep the title and navbar buttons level on wide screens.

There's probably a way to achieve something similar (though not exact) with just CSS. Their approach allows those buttons to jut right up against the title no matter how wide it is.

Personally I would have just hardcoded the breakpoint where that reflow happens and made sure that those buttons can never overlap the main content area. My preference is to avoid relying on JS for layout, whenever possible, for the sake of simplicity.

Re: Thoughts.page: hosting a small webpage for your thoughts

#97

Post by monkeynotes »

psychometry wrote: post #94
monkeynotes wrote: post #76

Earlier quoted context omitted.

I don't actually see a problem. It goes against my gut reaction but given the pages that are published are entirely isolated there is no more of a threat than someone publishing whatever they want on another web host. There is no user information to hijack, no cookies, no login buttons, no local storage, no auth etc. Yes, the pages can publish illegal information, be set up as phishing hubs, but none of that is as a…

How are they isolated if you can inject JS that downloads resources from anywhere else? I mean, just to start: - You have no CSP header that I can see. - You do expose the server version in the headers, though. - The site is available at a non-SSL-secured domain. - There's no X-Frame-Options, X-Permitted-Cross-Domain-Policies, etc.

My point is, the service simply hosts HTML, ostensibly this is the same as any consumer web host. So whatever attack vector you can think of exists on Dreamhost or Godaddy pages, for instance.

Re: Thoughts.page: hosting a small webpage for your thoughts

#99

Post by jimkleiber »

qwerty456127 wrote: post #46
rovr138 wrote: post #40

Earlier quoted context omitted.

A blog?

A microblog. But without strict length limits. Also without post titles. Without comments, responses and mentions. Without personal branding. Easy to discover together with many others. Easy to subscribe. Quick to read. Controversial thoughts allowed but guarded both against attacks by those who disagree/dislike and against abuse by bots/propaganda/marketing. Monetization/promotion not allowed.

Sounds like how blogs used to be (and even how Twitter and others were, too).

I wonder if the lack of interaction will just make people try to build workarounds to interact in other ways. For example, AFAIK, early Twitter had people use RT and other techniques to spread and/or reply to tweets even though the platform didn't have those functions itself.

How do you imagine this platform would deal with that desire to interact more with each other?

Post reply on HN