181–190 of 222 posts
Wow that's brilliant. I'm definetley a potential paying customer. That's cheaper than spinning up an Amazon EC2 micro instance to develop on at $5 a month. I'm not a big fan of dark gray background with darker gray text though.
There's an XSS on the page: Try to login or create an account. Enter this as your username (or password, as long as it's not valid: you need an error), hit submit. Error + XSS. alert(1); You escape quotes, which is good, so I can't break out of the JSON request. But you have to remember how the HTML parsing of a page works. will break out from within a javascript string.
Earlier quoted context omitted.
I don't think there was ever an intention to obscure work, maliciously or otherwise. This project started because developers started developing, not googling or searching github. To be fair, the "fancy website" is a byproduct of designers who like to make stuff look good, and the rest of Showoff's team caring very much about not just making stuff that works (of which they make a lot, much of which is hidden away in o…
I totally agree, this thread is probably the best exposure any of our projects (I'm the PageKite guy) could ask for. The idea is clearly communicated, pros and cons and alternatives discussed... and now it's a tiny bit easier to explain to people what we are doing. Hats off to the Showoff team for a job well done! :-)
It's great to have the idea validated, especially since mine and showoff.io's user experience are nearly identical. And this will force me to make a pretty homepage and add features.
So now that I've complained, I don't think I can complain much more.
Earlier quoted context omitted.
Check out http://pagekite.net/ , it's Python and it runs on Windows just fine. We are working on a user-friendly installer and GUI, but if you're a developer you don't need that. :-)
Hmm, I also think you need a new name. 'Showoff' says exactly what it does, lets you 'showoff' your work. What's a pagekite? (reminds of the 'mint' vs that unpronouncablely named finance site naming issue). I'm an ops guy, lets say I want to give access to my next generation product to a usability lab for feedback. Can you imagine what that whole experience would feel like? I'll want some reporting of when the site w…
Admittedly, I do need to get that picture drawn.
Regarding the technical side, you do get all those things. Some you get by collecting your own server logs, some (like cookie transparency and instant-off) you get through the nature of the system itself.
But if focusing on the website demo market, then making things easier by adding reports etc. would probably make sense at some point.
Thanks for your comments!
Earlier quoted context omitted.
I care about my work and it being used and contributed to if people are interested in it. I don't care about money, which is why it's open source and run as a free service. My code is MIT and I would love it if people took my code and made a pay-for service like this with it... but instead, they (to be fair, probably unknowingly) duplicate effort and obscure my work. If a fancy website is all I need, I guess that's w…
I don't think there was ever an intention to obscure work, maliciously or otherwise. This project started because developers started developing, not googling or searching github. To be fair, the "fancy website" is a byproduct of designers who like to make stuff look good, and the rest of Showoff's team caring very much about not just making stuff that works (of which they make a lot, much of which is hidden away in o…
Now... open source vs commercial, that's a whole different discussion (although probably not what you'd expect).
Wow that's brilliant. I'm definetley a potential paying customer. That's cheaper than spinning up an Amazon EC2 micro instance to develop on at $5 a month. I'm not a big fan of dark gray background with darker gray text though.
EC2 micro instance is $54 a year, so it's only cheaper if you only want 10 months or less.
Awesome. I'm definitely a potential paying customer. Two suggestions and a question: * How about a free trial for unlimited access or some other kind of cancellation guarantee? * Minor one, but the dark contrast on your website UI is about equivalent to the background on a typical lightbox...i.e. it reads "disabled" to me on first glance. One question: I assume I could map a CNAME record to the showoff URL? (So cooki…
This is very similar to my http://pagekite.net/ , which offers both free trials and CNAME records already. They're out-marketing me, I guess. It looks nicely done!
Take a look at "How We Increased Conversions By 25% (Again) With Our Latest Redesign (carwoo.com)" http://news.ycombinator.com/item?id=2420447
You have a whole wall of words about features, but I can't judge in 5 seconds what it does and if i'm interested. Switch to user stories.
Earlier quoted context omitted.
This is very similar to my http://pagekite.net/ , which offers both free trials and CNAME records already. They're out-marketing me, I guess. It looks nicely done!
You need a picture. Two screenshots with a lightning-bolt-style network connection between them, maybe. Take a look at "How We Increased Conversions By 25% (Again) With Our Latest Redesign (carwoo.com)" http://news.ycombinator.com/item?id=2420447 You have a whole wall of words about features, but I can't judge in 5 seconds what it does and if i'm interested. Switch to user stories.
There's an XSS on the page: Try to login or create an account. Enter this as your username (or password, as long as it's not valid: you need an error), hit submit. Error + XSS. alert(1); You escape quotes, which is good, so I can't break out of the JSON request. But you have to remember how the HTML parsing of a page works. will break out from within a javascript string.
I know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.
Imagine the case where he had not escaped quotes, but had escaped . In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it.
But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.
How often do you really want to show someone something badly enough that you are willing to block your local dev environment to do so?
I could see it working if you are interactively talking to someone in chat, but over email, often times you could be waiting hours for someone to actually try out what you want them to see. You could certainly get around this by setting up a separate local 'dev-show' environment, but if you are going to all that effort you really could/should just set up a dev version on a vps/cloud server.
If you are talking to someone interactively, chances are they are another dev, which means they really don't need to see your environment running, they should be capable of using their own.
Also, in this thread I really feel people are exaggerating the level of effort to set up a 'showable' environment on a cloud instance. For rails as an example, I can go from server launch to a running app with db in less than 15 minutes (easily) with manual config and I really doubt I'm the exception here. Remember, this is a 'dev' environment still, your apache/nginx config doesn't have to be airtight, it just has to work for the single user you are showing it to (all defaults on everything is going to work at least as well as the built in rails server).
Not to mention the fact that if you aren't thinking about automating deployments yet, it's a really good investment of time and would work just as well for this case.