Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MediaCrush – A website for serving media super fast

github.com

Post reply on HN
Print view View original

41–50 of 99 posts

Re: MediaCrush – A website for serving media super fast

#41

Post by gunn »

Sir_Cmpwn wrote: post #36
gunn wrote: post #35

Earlier quoted context omitted.

Is there a reason a complete IP address rainbow-table wouldn't defeat this?

bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt

Good answer... It looks like it would take on the order of 7 CPU years to create a table of every used address, much less time to target an area or individual. I don't think this is an issue at all though, I was just curious.

Re: MediaCrush – A website for serving media super fast

#42

Post by Daiz »

Sir_Cmpwn wrote: post #23
markatto wrote: post #21

Your site says that you "losslessly compress images, video, and audio" - I poked around in the code a little and didn't find the compression stuff, but it doesn't make sense to me that you can do that. There is some optimization that you can do on PNGs, but for most media encoded with a lossy method you shouldn't be able to achieve a smaller filesize without reencoding with another lossy method (and by definition los…

Actually, we just took some of that out to reduce processing times for users. We're going to overhaul the backend processing system so that we can process some things asyncronously, and then we'll put all that code back. However, we do losslessly compress some things. We run PNG files through optipng and JPGs through jhead to strip out EXIF data, but most interestingly, we run GIF files through ffmpeg and serve them…

As someone who does media compression pretty much daily, your marketing spiel really came out to me badly for the same reasons. While you can optimize JPGs and PNGs in a lossless fashion, you really can't do the same for audio and video. You might be able to make them smaller without losing (much) perceived quality (aka do transparent compression), but you're still doing lossy compression. Same with converting gifs to videos - while the biggest loss certainly happens in the making of the original gif and while you can get a humongous increase in compression quality, converting it to VP8 is still lossy.

And speaking of which, saying that you can get "1000-3000% faster for some files" is also pretty dishonest. You can pretty much claim those kind of numbers with only one of the many formats you support (and one where you're not doing lossless compression), but the way you word it makes it sound like you could get it for potentially anything.

All in all, I'd really suggest you rewrite the description to be more honest.

Two other things I noticed: I can't seem to select text on the homepage (on latest Chrome). Your icon also looks rather similar to that of Miro: http://www.getmiro.com/

Re: MediaCrush – A website for serving media super fast

#43

Post by Sir_Cmpwn »

gunn wrote: post #41
Sir_Cmpwn wrote: post #36

Earlier quoted context omitted.

bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt

Good answer... It looks like it would take on the order of 7 CPU years to create a table of every used address, much less time to target an area or individual. I don't think this is an issue at all though, I was just curious.

Actually, the salting is an important detail. Those 7 CPU years would only create a table for one hash. That's how long it takes to brute force a single hash, not the entire space.

Re: MediaCrush – A website for serving media super fast

#44

Post by eonil »

Sir_Cmpwn wrote: post #23
markatto wrote: post #21

Your site says that you "losslessly compress images, video, and audio" - I poked around in the code a little and didn't find the compression stuff, but it doesn't make sense to me that you can do that. There is some optimization that you can do on PNGs, but for most media encoded with a lossy method you shouldn't be able to achieve a smaller filesize without reencoding with another lossy method (and by definition los…

Actually, we just took some of that out to reduce processing times for users. We're going to overhaul the backend processing system so that we can process some things asyncronously, and then we'll put all that code back. However, we do losslessly compress some things. We run PNG files through optipng and JPGs through jhead to strip out EXIF data, but most interestingly, we run GIF files through ffmpeg and serve them…

We all know how H.264 is great. You don't need to explain it again.

And you should fix it right now. I already got super-bad first impression. Currently your product is just marketing junk shit to me. And you have no way to fix my impression because I won't review your product ever again.

Re: MediaCrush – A website for serving media super fast

#45

Post by Sir_Cmpwn »

Daiz wrote: post #42
Sir_Cmpwn wrote: post #23

Earlier quoted context omitted.

Actually, we just took some of that out to reduce processing times for users. We're going to overhaul the backend processing system so that we can process some things asyncronously, and then we'll put all that code back. However, we do losslessly compress some things. We run PNG files through optipng and JPGs through jhead to strip out EXIF data, but most interestingly, we run GIF files through ffmpeg and serve them…

As someone who does media compression pretty much daily, your marketing spiel really came out to me badly for the same reasons. While you can optimize JPGs and PNGs in a lossless fashion, you really can't do the same for audio and video. You might be able to make them smaller without losing (much) perceived quality (aka do transparent compression), but you're still doing lossy compression. Same with converting gifs t…

I agree. We originally started to simply deal with GIF compression (MediaCrush was previously known as gifquick) and we have less ground to stand on with respect to spectacular compression with support for more formats. I'll reprioritize the "rewrite the spiel" task thanks to feedback from HN.

As for selecting text on the home page, not much we can do about it. We force your focus into a contenteditable div to allow you to paste images/URLs directly into the page.

Regarding the icon, it just so happens that I had the sneaking suspicion that I had seen it before when the designer presented it to me. So I ran a reverse image search and looked at about a thousand similar icons. I didn't find Miro - if I had, I probably would have asked for it to be different. In any case, I think it's different enough that I'm not worried.

Re: MediaCrush – A website for serving media super fast

#46

Post by Sir_Cmpwn »

eonil wrote: post #44
Sir_Cmpwn wrote: post #23

Earlier quoted context omitted.

Actually, we just took some of that out to reduce processing times for users. We're going to overhaul the backend processing system so that we can process some things asyncronously, and then we'll put all that code back. However, we do losslessly compress some things. We run PNG files through optipng and JPGs through jhead to strip out EXIF data, but most interestingly, we run GIF files through ffmpeg and serve them…

We all know how H.264 is great. You don't need to explain it again. And you should fix it right now. I already got super-bad first impression. Currently your product is just marketing junk shit to me. And you have no way to fix my impression because I won't review your product ever again.

> We all know how H.264 is great. You don't need to explain it again.

You know that, but our intended audience isn't the HN crowd.

I'm sorry to hear that you got a bad impression of the site, but even without any fancy speed tricks (and there are fancy speed tricks), it's still an open-source, privacy-centric media hosting site that I think is pretty damn great.

Re: MediaCrush – A website for serving media super fast

#47

Post by nthnclrk »

Sir_Cmpwn wrote: post #16
mankash666 wrote: post #14

Earlier quoted context omitted.

I'm no expert, but here are my two cents: 1> Spread the word manually on HN, 4chan and the like 2> Add basic social media presence (twitter, FB ..). This will let you communicate with your fans/early adopters, and let them talk to you too. 3> When the audience in #2 is big enough, launch on kickstarter et al. 4> IF you have a successful kickstarter campaign, the media will cover you, given the big pain points you sol…

Regarding 2, we have @mediacru_sh [1] and a subreddit [2]. Not many folk follow that, though. We have a problem with Facebook, though. Considering that all the devs are very pro-privacy [3], none of us have one! As for Kickstarter, I'm not sure what we'd be raising money for or giving to contributors as a thank you. We are pretty featureful as it stands now, and I'm very against the idea of making people pay for cert…

Love the idea. Potentially you could fund via a paid tier for business/enterprise use?

Rather than offering more features, you could have some sort of guarantee of length of hosting ie. Pay $299 a year and get x storage for x years? (Choosing suitably generous figures)

Then update your disclaimer on the about page to be free forever for personal use?

I don't know, but personally, this would be brilliant for the business I work at, but we could never use it for fear of hosting being unavailable if you go out of "business". I actually think you're doing a disservice to many organisations out there for not offering that — with the handy upside of having secured incoming funds.

...just a thought.

Re: MediaCrush – A website for serving media super fast

#48

Post by wgd »

Sir_Cmpwn wrote: post #36
gunn wrote: post #35

Earlier quoted context omitted.

Is there a reason a complete IP address rainbow-table wouldn't defeat this?

bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt

At 1/3 of a second to compute a single hash, brute forcing the entire space of possible addresses takes around 45 CPU-years. But computing the hash of every single IP address is ridiculously parallel, so it's trivial to spin up 2k machines on EC2 and brute force the entire thing in a week. Total cost, somewhere under $8k if you don't want to bother owning real machines, less for any organization that happens to need to do similar things on a regular or semi-regular basis.

It's not a trivial investment since that effort only gets you a single IP address, but it's easily within the reach of a vast number of organizations if they have real motivation (read: not a fishing expedition) to reverse it.

Re: MediaCrush – A website for serving media super fast

#49

Post by toppy »

Sir_Cmpwn wrote: post #40
toppy wrote: post #39

Anybody can delete my file by adding 'delete' to public URL of uploaded file, am I right? Please don't do this.

You are not correct. Only you can delete your uploaded file. That reminds me of a cool thing [1] one of our users built on top of MediaCrush, though, where others can delete your files. [1] https://github.com/blha303/SnapCrush

By "only you can delete" you mean "only user with your IP can delete"?

1. Open FF / upload some file, get " rel="nofollow">https://mediacru.sh/

2. Open Chrome in private mode

3. Go /delete" rel="nofollow">https://mediacru.sh/api//delete

4. File is gone!

Re: MediaCrush – A website for serving media super fast

#50

Post by Sir_Cmpwn »

toppy wrote: post #49
Sir_Cmpwn wrote: post #40

Earlier quoted context omitted.

You are not correct. Only you can delete your uploaded file. That reminds me of a cool thing [1] one of our users built on top of MediaCrush, though, where others can delete your files. [1] https://github.com/blha303/SnapCrush

By "only you can delete" you mean "only user with your IP can delete"? 1. Open FF / upload some file, get " rel="nofollow">https://mediacru.sh/ 2. Open Chrome in private mode 3. Go /delete" rel="nofollow">https://mediacru.sh/api/ /delete 4. File is gone!

You == your IP, in this case. We check the deleter's IP against the bcrypted one we store with the file before allowing them to delete it. There's an open GitHub issue discussing alternative methods [1] if you'd like to read some more about it.

[1] https://github.com/MediaCrush/MediaCrush/issues/311

Post reply on HN