Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MediaCrush – A website for serving media super fast

github.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: MediaCrush – A website for serving media super fast

#51

Post by Sir_Cmpwn »

nthnclrk wrote: post #47
Sir_Cmpwn wrote: post #16

Earlier quoted context omitted.

Regarding 2, we have @mediacru_sh [1] and a subreddit [2]. Not many folk follow that, though. We have a problem with Facebook, though. Considering that all the devs are very pro-privacy [3], none of us have one! As for Kickstarter, I'm not sure what we'd be raising money for or giving to contributors as a thank you. We are pretty featureful as it stands now, and I'm very against the idea of making people pay for cert…

Love the idea. Potentially you could fund via a paid tier for business/enterprise use? Rather than offering more features, you could have some sort of guarantee of length of hosting ie. Pay $299 a year and get x storage for x years? (Choosing suitably generous figures) Then update your disclaimer on the about page to be free forever for personal use? I don't know, but personally, this would be brilliant for the busin…

If you're worried about it going away, you can always run your own instance! It is open-source, and the instructions are pretty straightforward if you have a look through the readme. You can always donate [1] to help ensure continued development. Even if it does go under, too, we'll keep the GitHub up and maintain it in our spare time, since we love the project and use it so much for our own needs.

You do have a good point, though. I don't want to force businesses to pay for hosting with us, but I am open to considering other means of monetization. Maybe we could set up and host private instances for people, plus support, for a fee?

[1] https://mediacru.sh/donate

Re: MediaCrush – A website for serving media super fast

#52

Post by toppy »

Sir_Cmpwn wrote: post #50
toppy wrote: post #49

Earlier quoted context omitted.

By "only you can delete" you mean "only user with your IP can delete"? 1. Open FF / upload some file, get " rel="nofollow">https://mediacru.sh/ 2. Open Chrome in private mode 3. Go /delete" rel="nofollow">https://mediacru.sh/api/ /delete 4. File is gone!

You == your IP, in this case. We check the deleter's IP against the bcrypted one we store with the file before allowing them to delete it. There's an open GitHub issue discussing alternative methods [1] if you'd like to read some more about it. [1] https://github.com/MediaCrush/MediaCrush/issues/311

It's clear now. Nice job!

Re: MediaCrush – A website for serving media super fast

#53

Post by Sir_Cmpwn »

Sir_Cmpwn wrote: post #36
gunn wrote: post #35

Earlier quoted context omitted.

Is there a reason a complete IP address rainbow-table wouldn't defeat this?

bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt

I'm going to respond to all of you at once by saying this: bcrypt is the best possible solution that we are aware of. It's infeasible for anyone but the most resourceful adversaries to brute force your hashed IP, and even then it's still expensive.

However, that's part of why we're open source. You can't trust us when we say that we aren't storing your IP. We could be doing it and you'd have no way of being able to tell. If you're concerned about this, run a private instance of MediaCrush. There are instructions in the README, it's pretty easy to set up.

Re: MediaCrush – A website for serving media super fast

#54

Post by duiker101 »

Sir_Cmpwn wrote: post #13
graue wrote: post #12

Hmm... did this site get served a secret warrant last week? Or did they just forget to update their warrant canary? https://mediacru.sh/transparency/warrant-canary.txt (Note: the date 08/11 is written European style meaning November 8th, as you can see if you go up a directory.)

Ack! My other half is responsible for the warrant canary. He keeps forgetting it. We may as well not even have it. It doesn't mean much without a signature, but I assure you that we have never been served a warrant.

can't you make it automatic, taking the news with rss and stop it if you get a warrant?

Re: MediaCrush – A website for serving media super fast

#55

Post by Sir_Cmpwn »

duiker101 wrote: post #54
Sir_Cmpwn wrote: post #13

Earlier quoted context omitted.

Ack! My other half is responsible for the warrant canary. He keeps forgetting it. We may as well not even have it. It doesn't mean much without a signature, but I assure you that we have never been served a warrant.

can't you make it automatic, taking the news with rss and stop it if you get a warrant?

Nope. If an adversary seizes our servers, we couldn't stop it from falsely reporting that all is well.

Re: MediaCrush – A website for serving media super fast

#56

Post by mike-cardwell »

graue wrote: post #12

Hmm... did this site get served a secret warrant last week? Or did they just forget to update their warrant canary? https://mediacru.sh/transparency/warrant-canary.txt (Note: the date 08/11 is written European style meaning November 8th, as you can see if you go up a directory.)

  mike@glue:~$ wget -qO - https://mediacru.sh/transparency/warrant-canary.txt|gpg --verify
  gpg: Signature made Fri 08 Nov 2013 11:48:13 GMT using RSA key ID 5044F2FC
  gpg: BAD signature from "MediaCrush Administrators "
  mike@glue:~$

Re: MediaCrush – A website for serving media super fast

#59

Post by jdiez17 »

mike-cardwell wrote: post #56
graue wrote: post #12

Hmm... did this site get served a secret warrant last week? Or did they just forget to update their warrant canary? https://mediacru.sh/transparency/warrant-canary.txt (Note: the date 08/11 is written European style meaning November 8th, as you can see if you go up a directory.)

mike@glue:~$ wget -qO - https://mediacru.sh/transparency/warrant-canary.txt|gpg --verify gpg: Signature made Fri 08 Nov 2013 11:48:13 GMT using RSA key ID 5044F2FC gpg: BAD signature from "MediaCrush Administrators " mike@glue:~$

That's not the signed warrant canary - the PGP signed message lives at https://mediacru.sh/transparency/warrant-canary.signed.txt.

    josemanueldiez@InfiniteImprobabilityDrive:~$ wget -qO - https://mediacru.sh/transparency/warrant-canary.signed.txt|gpg --verify
    gpg: Signature made Fri Nov  8 12:48:13 2013 CET using RSA key ID 5044F2FC
    gpg: Good signature from "MediaCrush Administrators "

Re: MediaCrush – A website for serving media super fast

#60

Post by girvo »

eonil wrote: post #44
Sir_Cmpwn wrote: post #23

Earlier quoted context omitted.

Actually, we just took some of that out to reduce processing times for users. We're going to overhaul the backend processing system so that we can process some things asyncronously, and then we'll put all that code back. However, we do losslessly compress some things. We run PNG files through optipng and JPGs through jhead to strip out EXIF data, but most interestingly, we run GIF files through ffmpeg and serve them…

We all know how H.264 is great. You don't need to explain it again. And you should fix it right now. I already got super-bad first impression. Currently your product is just marketing junk shit to me. And you have no way to fix my impression because I won't review your product ever again.

"Fix it right now"

That came across to me as super snarky and entitled, despite you having a point. Rewrite it right now.

(See? Now, I actually don't think you meant it like that, but if I was the OP I would've taken that badly. Food for thought!)

Post reply on HN