Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

getmogochat.com

Post reply on HN
Print view View original

21–30 of 71 posts

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#21

Post by voicereasonish »

JangoSteve wrote: post #11

Someone seems to have broken the demo by typing in some JavaScript. Doesn't seem to be sanitizing input completely. EDIT: Looks like it's CSS, not JS. In case it helps, here's what I'm seeing [1], and here's the code from the message: * { float: left; display: block } [1] http://imgur.com/BoZ6lrF EDIT 2: Yup, style tags don't seem to be escaped. Tried changing colors of the room a few times, and it worked: * { color:…

This should be a major red flag to anyone.

You don't make an app/website secure by deciding on a list of things you need to sanitise.

You sanitise everything to start with.

A very common rookie error.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#23

Post by voicereasonish »

hunvreus wrote: post #13

There are tons of free apps, with contenders like Kandan ( https://github.com/kandanapp/kandan ) if you're looking for a self-hosted or free alternative to HipChat/Campfire, you can even find sexy-ish Web clients for IRC ( https://github.com/thedjpetersen/subway ). The problem I see with message apps is that it's like email; you really wished you could host it yourself and fine tune things (as well as make sure nobod…

If you're working with IRC, your backend will also get DDOS'ed very quickly and very often. So there's that fun to deal with as well.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#24

Post by hhaidar »

hunvreus wrote: post #13

There are tons of free apps, with contenders like Kandan ( https://github.com/kandanapp/kandan ) if you're looking for a self-hosted or free alternative to HipChat/Campfire, you can even find sexy-ish Web clients for IRC ( https://github.com/thedjpetersen/subway ). The problem I see with message apps is that it's like email; you really wished you could host it yourself and fine tune things (as well as make sure nobod…

Shameless plug, I've also written an app: https://github.com/sdelements/lets-chat

It looks a little something like this: http://i.imgur.com/djnd0Uk.png

It's still in it's infancy, currently working on a big update that includes a REST api and other stuff.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#25

Post by psycr »

It seems that the room message state is synced via a poller, as seen here: https://github.com/HashNuke/mogo-chat/blob/master/assets/jav...

I'm curious why you decided to implement this with a poller instead of with a Websocket. There's actually a reasonably detailed answer about how to do this sort of thing with Ember Data in the emberjs.com guides: http://emberjs.com/guides/models/frequently-asked-questions/...

Either way, how did you find working with Ember Data in general? What were the main sticking points?

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#26

Post by nilkn »

jvehent wrote: post #6

This is cool, and as a heavy IRC user, I'm eager to find a solution that can replace self-hosted IRSSI+ZNC entirely, without compromising security. Don't reinvent the protocol, reinvent the UI.

I haven't seen anything that beats IRCCloud in the ease of use and UI departments, especially their mobile apps.

That said, the full service is $5/month and so not for everybody. Also, you mention security and I'm not sure whether you'd consider a cloud service permissible in that sense or not.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#27

Post by gildas »

voicereasonish wrote: post #21
JangoSteve wrote: post #11

Someone seems to have broken the demo by typing in some JavaScript. Doesn't seem to be sanitizing input completely. EDIT: Looks like it's CSS, not JS. In case it helps, here's what I'm seeing [1], and here's the code from the message: * { float: left; display: block } [1] http://imgur.com/BoZ6lrF EDIT 2: Yup, style tags don't seem to be escaped. Tried changing colors of the room a few times, and it worked: * { color:…

This should be a major red flag to anyone. You don't make an app/website secure by deciding on a list of things you need to sanitise. You sanitise everything to start with. A very common rookie error.

> You don't make an app/website secure by deciding on a list of things you need to sanitise.

I agree

> You sanitise everything to start with.

So you need to list everything you need to sanitise...

A better approach is to ban "innerHTML" from your code. You should always display user generated text in text nodes.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#28

Post by yebyen »

voicereasonish wrote: post #21
JangoSteve wrote: post #11

Someone seems to have broken the demo by typing in some JavaScript. Doesn't seem to be sanitizing input completely. EDIT: Looks like it's CSS, not JS. In case it helps, here's what I'm seeing [1], and here's the code from the message: * { float: left; display: block } [1] http://imgur.com/BoZ6lrF EDIT 2: Yup, style tags don't seem to be escaped. Tried changing colors of the room a few times, and it worked: * { color:…

This should be a major red flag to anyone. You don't make an app/website secure by deciding on a list of things you need to sanitise. You sanitise everything to start with. A very common rookie error.

I, for one, am glad to see example Elixir apps with some polish that are published freely. I've been meaning to get into Elixir and Erlang, but lack of polished example apps has been a stumbling block for me, and though I have no immediate need for a TeamChat app at all, it's one of those examples like "The Todos App" that you can even perform as a code-kata in your language of choice.

It would be great if I didn't have to use any Off-the-Shelf code at all, or if I must, if I actually had the time and knowledge to review it for serious vulnerabilities. But posts like this are why I come to HN.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#29

Post by voicereasonish »

gildas wrote: post #27
voicereasonish wrote: post #21

Earlier quoted context omitted.

This should be a major red flag to anyone. You don't make an app/website secure by deciding on a list of things you need to sanitise. You sanitise everything to start with. A very common rookie error.

> You don't make an app/website secure by deciding on a list of things you need to sanitise. I agree > You sanitise everything to start with. So you need to list everything you need to sanitise... A better approach is to ban "innerHTML" from your code. You should always display user generated text in text nodes.

Just to clarify:

    var t = document.createTextNode(msg);
    content.appendChild(t);
That code sanitises all possible content in msg. I don't need to list out HTML tags, script/style tags, do special case for unicode exploits, etc.

You need to list what variables are "unsafe", but you don't need to list out the ways they might be unsafe. If it's got the potential to be unsafe, assume it's completely unsafe in every conceivable way, and don't use it in any context apart from as an unsafe text string.

The rookie code is something like:

    msg.replace("something I think is unsafe", "something safer");
    content.innerHTML+=msg;
And agreed. InnerHTML should be removed from browsers.

Re: Show HN: Mogo Chat – open-source team chat app written in Elixir and Ember.js

#30

Post by opendais »

voicereasonish wrote: post #23
hunvreus wrote: post #13

There are tons of free apps, with contenders like Kandan ( https://github.com/kandanapp/kandan ) if you're looking for a self-hosted or free alternative to HipChat/Campfire, you can even find sexy-ish Web clients for IRC ( https://github.com/thedjpetersen/subway ). The problem I see with message apps is that it's like email; you really wished you could host it yourself and fine tune things (as well as make sure nobod…

If you're working with IRC, your backend will also get DDOS'ed very quickly and very often. So there's that fun to deal with as well.

The IRC server I use at work is DDOS'd less than our website. ;)
Post reply on HN