Live data from Hacker News

NeoCities

neocities.org

141–150 of 222 posts

Re: NeoCities

#144
post #136

Earlier quoted context omitted.

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web Pull requests welcome!

Why did you choose Ruby as the language?

I think it's a pure joy to read the ruby source. Allthough ruby is not fast, it's got some of the simplest most elegant frameworks out there. Sinatra is not much more than a router config file with some logic. Sequel is the simplest database orm and migration tool around. And slim makes very readable templates. All frameworks perfect for the first minimum viable product. If this site takes off, I would perhaps pay someone to rewrite some bottlenecks of it in java.

Re: NeoCities

#145
post #43

PEOPLE. This is clearly not intended as a business. Stop asking about the "business model." It strikes me as just being a cool side project that enables people to make websites. That's it. Yeesh.

In other words, Yahoo! will eventually end up buying it.

Re: NeoCities

#146
post #85

I just had to do it: http://jstalin.neocities.org/index.html It's going to play audio if you clink the link, unless you're using click to play

Also, backstory: http://mike.winterdiamond.com/history.php

You'd think he'd have learned his lesson about god-awful site design.

Re: NeoCities

#147
post #97

Earlier quoted context omitted.

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web Pull requests welcome!

great response. the bug's existence alone made me question the project intent and viability. even though i probably won't read your code, just making the source available mitigated my biggest concerns.

Re: NeoCities

#148
post #43

PEOPLE. This is clearly not intended as a business. Stop asking about the "business model." It strikes me as just being a cool side project that enables people to make websites. That's it. Yeesh.

I think you're underestimating the lucrative "disoriented time-traveler" market.

Re: NeoCities

#149
post #97

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Responsible security disclosure would say you've got a responsibility to make the bug known. Making it public should only happen after you've made the creator aware.

I can understand why the developer viewed you as 'trashing' his work, you claimed it as a phishing expedition. That'd make the best of us upset. I see you've sorted it out between you which is great, and I hope others look at this exchange and get some good takeaway from it.

Re: NeoCities

#150
post #50

Earlier quoted context omitted.

I'm logged in as "www" right now.

Funny enough, that is exactly how I found the problem. I created a www account (I am almost ashamed to say that was my first instinct, try to break the system before you decide the system is worthy of your use). I ended up logging out and I couldn't log back in with the same password. In hindsight, someone must have created another www account after I did and before I tried to login again. I then tried creating anoth…

haha I created www account, too.
Post reply on HN