Show HN: Drop-In Chat – Chatify your app • Hacker News Board

Re: Show HN: Drop-In Chat – Chatify your app

#41

Post by fmavituna » Mon, Aug 04, 2014, 9:02 AM UTC

owenversteeg wrote: post #36

WARNING: DO NOT TRY TO CHAT WITH PEOPLE - BAD THINGS WILL HAPPEN - READ BELOW Uhh, it's possible to inject Javascript into this. There are two people that already did this. One is harmless and alerts "Wufff!" and the other redirects you to pornhub. [edit] Now there's another that redirects you to lemonparty. [edit 2] Now there's another that redirects you here. It's fun watching this play out live, with the nice vs.…

Maybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P...

Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - https://www.netsparker.com/netsparker/

There is also a free community edition which would possibly detect this vulnerability : https://www.netsparker.com/communityedition/

Re: Show HN: Drop-In Chat – Chatify your app

#42

Post by templeos2 » Mon, Aug 04, 2014, 1:18 PM UTC

dumb dumb fucks. You get punished, retard-niggers. You got serious hell to pay for fucking with God.

You fuck with everything. All it takes is God talking to the world and sentencing you to death, retard-nigger.

Re: Show HN: Drop-In Chat – Chatify your app

#43

Post by danbucholtz » Mon, Aug 04, 2014, 5:57 PM UTC

Very cool app. Needs a little bit of maturing but a really good first step!

Re: Show HN: Drop-In Chat – Chatify your app

#44

Post by ahochhaus » Tue, Aug 05, 2014, 3:50 AM UTC

owenversteeg wrote: post #36

WARNING: DO NOT TRY TO CHAT WITH PEOPLE - BAD THINGS WILL HAPPEN - READ BELOW Uhh, it's possible to inject Javascript into this. There are two people that already did this. One is harmless and alerts "Wufff!" and the other redirects you to pornhub. [edit] Now there's another that redirects you to lemonparty. [edit 2] Now there's another that redirects you here. It's fun watching this play out live, with the nice vs.…

Drop-In Chat had a few different XSS flaws. They should all be fixed now. Thanks for finding them and pointing them out!

Sorry for the slow security fix, I was traveling after leaving YC Hacks. Please do let me know if you find anything else wrong.

Re: Show HN: Drop-In Chat – Chatify your app

#45

Post by ahochhaus » Tue, Aug 05, 2014, 3:51 AM UTC

danbucholtz wrote: post #43

Very cool app. Needs a little bit of maturing but a really good first step!

Thanks for the encouragement. What we have is certainly just a first step. We will continue to keep making incremental improvements now that YC Hacks is over.

Re: Show HN: Drop-In Chat – Chatify your app

#46

Post by ahochhaus » Tue, Aug 05, 2014, 3:54 AM UTC

waitingkuo wrote: post #34

I do need a messaging service for my product! Can it be used in production currently? I'm also curious about whether you provide the video conference api in the future or not? That would be useful!

Hi waitingkuo. Thanks for the encouragement. Currently I wouldn't recommend using Drop-In Chat in a production context as the code is too new and not really stable. When we get to the point we think the product is ready for production use we'll make an announcement.

At this point we do not have plans to add video conferencing support.

Re: Show HN: Drop-In Chat – Chatify your app

#47

Post by ahochhaus » Tue, Aug 05, 2014, 4:04 AM UTC

scrollaway wrote: post #31

ahochhaus wrote: post #10

Earlier quoted context omitted.

The back end is golang. The client server messaging protocol is BrowserChannel/WebChannel. https://code.google.com/p/libevent-browserchannel-server/wik... We open sourced the BrowserChannel library here: https://github.com/samegoal/wc And have a chat room demo app here: https://github.com/samegoal/wcchat The code we used for this particular site isn't Open Source yet. We are still trying to figure out what we want to…

Good luck with it. I hope you open source it. Would you be able to give a rationale on why you chose against xmpp?

Hi scrollaway. Thanks for the support.

XMPP seems really great in a context of needing to inter-operate with other servers. However, for our use-case all communication was in a silo of a single site so this was not a major benefit to Drop-In Chat.

Our team wants broad broad browser support (for legacy corporate deployments) and a well-tested client side module. BrowserChannel, which is used for gmail chat, is very widely deployed and well tested.

Maybe I'm missing something, but even if we went with XMPP, wouldn't Drop-In Chat still need a way to stream messages from the server to the client? If so, we would still need to rely on a transport mechanism like websockets/XHR streaming/forever iframes for the in-browser real time message delivery. BrowserChannel/WebChannel bundles up this abstraction nicely and hides all the ugliness of dealing with browser quirks for streaming message delivery.

Re: Show HN: Drop-In Chat – Chatify your app

#48

Post by ahochhaus » Tue, Aug 05, 2014, 4:09 AM UTC

chatango wrote: post #32

ahochhaus wrote: post #25

Earlier quoted context omitted.

I looked at chatango and I think the intended use case is a bit different than dropinchat. Drop-in chat provides user-to-user instant messaging. As best I can tell, chatango (primarily?) provides broadcast style communication. Is this correct?

Chatango is primarily focused on group chats, but you can send private messages as well. Dropinchat.com mentions "chat groups". Are they only for user-to-user messages?

At this point dropinchat.com does not support sending messages to more than one user. However, we do plan to add that feature as our team has time.

The documentation on dropinchat.com mentions "groups" as a set of users which are allowed to see one another and message back and forth. Our team thinks this use case might be helpful, for example, for a website administrator to limiting communication between members on a given organizational team or individuals in a certain building, etc.

Re: Show HN: Drop-In Chat – Chatify your app

#49

Post by ahochhaus » Tue, Aug 05, 2014, 4:12 AM UTC

Sorry for the XSS problems. They are fixed now so it is safe to visit and test again if you like. Thanks owenversteeg for warning everyone.

Re: Show HN: Drop-In Chat – Chatify your app

#50

Post by scrollaway » Wed, Aug 06, 2014, 5:55 PM UTC

ahochhaus wrote: post #47

scrollaway wrote: post #31

Earlier quoted context omitted.

Good luck with it. I hope you open source it. Would you be able to give a rationale on why you chose against xmpp?

Hi scrollaway. Thanks for the support. XMPP seems really great in a context of needing to inter-operate with other servers. However, for our use-case all communication was in a silo of a single site so this was not a major benefit to Drop-In Chat. Our team wants broad broad browser support (for legacy corporate deployments) and a well-tested client side module. BrowserChannel, which is used for gmail chat, is very wi…

Sure, but BrowserChannel is only relevant on the client. What about the server? Using XMPP would allow for external clients to connect for example.