Live data from Hacker News

Trouble with Diaspora

blog.steveklabnik.com

81–90 of 166 posts

Re: Trouble with Diaspora

#81
This is the problem: college students are terrible programmers. There aren't enough consequences for writing bad code in college. In industry, you learn very quickly that everything you learned in college is minuscule compared to what you actually need to know to work.

I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even desirable! Wow. Looking back now, how silly of us. Where did we get this idea? Certainly not from anyone with significant experience in industry. We had one professor with significant industry experience... from the days of IBM mainframes. She was the head of the department. She ran two classes a year, in "software engineering", basically "technical writing and project management". They were good classes, the most like the "real world" of any of our courses, but only 50% of the students took it and it represented maybe 10% of our studies for those of us who did.

Yes, the CS degree is about preparing students for CS graduate programs. But there was never a suggestion that perhaps the CS degree was not what we needed. Or maybe there was a suggestion, one, from some guy on Teh Intarwebs, against every other person in positions of respect around us. We were consistently told that the CS degree was the path to a software development degree. Yes, internships. They are very important. We don't do enough of them. We certainly need more of an apprenticeship model. I suspect that the development of good programmers would work in a culinary school model more than a research school model.

College graduates are basically the first level of competency worth training to become developers, or at least are supposed to be (let's just stick to ideal situations right now, with no wind resistance and infinite point masses). It's like in the martial arts, we say that black-belt is where the learning begins. Once you reach black-belt/BSCS, you have only acquired the tools that you need to start learning.

Every programmer I've known thought he was a super hacker by the time he got out of college. Me included. I see it in the interviews I conduct, also. There is an air of arrogance. There is a sense of shock and personal assault when pointing out their errors. They haven't yet grocked that the code is not them. They haven't yet learned that the errors are inevitable, that it is only time and experience that teaches us how to avoid them, that programming is about the pursuit of eventual perfection and not the dogmatic defense of yesterday's code.

So one of two things happens. Either the degreed programmer shucks his hubris and finds humility, or he becomes a leech on his coworkers (and my use of the masculine pronoun is no mistake, the female programmers I've known don't have this pathology). Unfortunately, the latter is apparently indistinguishable from the former for most management types. Haha, but digging on the liberal arts majors aside, most people who come out of college with a BS in CS do not want to make programming their wake-to-sleep life. They want it to be their 9-to-5 career, and leeching is the easier route to that.

The kids mean well, I'm sure they are quite intelligent, and they've got heart. But a startup was probably the worst first endeavor for them. I think it's better to go through your male-programmer-humiliation on someone else's dollar. They're basically going into more debt to learn how to be programmers now that they've gotten out of college. They could have been earning a salary to learn how to be programmers.

Re: Trouble with Diaspora

#82
Steve, where did you get the $250,000 figure? Their Kickstarter page still shows $200K and change (http://www.kickstarter.com/projects/196017994/diaspora-the-p...), and now there are currently three mentions of $250K in the comments here, none of them questioning the $50K raise. Just checking to see if I missed another bit of funding somewhere.

Re: Trouble with Diaspora

#83

Earlier quoted context omitted.

Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...

How is that a fundamental security flaw if there's an easy one line fix with no likely side effects?

If it's that easy, why not just implement it in the first place and give people less of a reason to lambaste your application that supposedly centers around privacy?

Re: Trouble with Diaspora

#84
post #59
post #48

Earlier quoted context omitted.

If they re-write, given that they're fairly inexperienced but are probably still sitting on a pile of cash, they run into the Second System Effect. http://en.wikipedia.org/wiki/Second-system_effect

"when following on from a relatively small, elegant, and successful system." I don't think that the second system effect applies, specifically given that it isn't elegant or successful yet. (In fact, most of the comments are that it is inelegant and a failure). Second system effect mostly reflects the evils of redesigning a perfectly good working product.

Not necessarily and I think it's one of those phrases open to interpretation.

IMO, second system effect is doing everything you've done bigger and better while fixing the problems in the first system. It wasn't tied to the elegance of the first system design, at least in my mind.

Re: Trouble with Diaspora

#85
post #72

Earlier quoted context omitted.

Since I've already brought this up on Reddit... For example: http://github.com/diaspora/diaspora/blob/master/app/controll... There's no check to see if this is your photo or not. And before you mention it, the before_filter only checks if they're logged in, not permissions. There are many, many similar things to this. Check out lib/encryptor.rb and shudder. I'm no security expert, but...

How is that a fundamental problem? It takes two lines of code to fix. This is an alpha release. People shouldn't be using it, that's all. They should've put in an artificial limitation like max. 2 users with max. 2 pics each per server to avoid people using it. The whole thing being in Rails is much more of a turn-off for me.

It's not so much that it's hard to fix, it just demonstrates that they're either incompetent or not taking things seriously. It doesn't exactly inspire confidence for the future of the project.

Re: Trouble with Diaspora

#86

Steve, where did you get the $250,000 figure? Their Kickstarter page still shows $200K and change ( http://www.kickstarter.com/projects/196017994/diaspora-the-p... ), and now there are currently three mentions of $250K in the comments here, none of them questioning the $50K raise. Just checking to see if I missed another bit of funding somewhere.

Nope, I just remembered wrong. I'll edit that now, thank you. At least that's not as bad as someone on Reddit who tried to say they raised $4mm...

Re: Trouble with Diaspora

#87
post #21

The trouble is that they were so ambitious but lacked any experience from which to chart those ambitions. They're just a bunch of young twenty-somethings just getting out of school. They haven't built any large-scale real-world security-hardened software yet. More than the fact that the code isn't production ready (by a long shot it seems), I'm just surprised the released anything at all. Perhaps spending all that mo…

What were these kids thinking, starting some ambitious software project from scratch without much of a clue how to do it? This is unheard of on the internet!

I don't see what point you're trying to make.

My point is that their problem is other peoples' expectations. Their ambition set the bar before they'd written a single line of code. Had they been more humble and waited to ask for a handout afte they had released what they have now I don't think there would be half as many articles hitting HN about how crappy their software is.

I think that they released something is great. I would never put some one down for having ambitions and aspirations to follow them. I would simply advise that they keep those ambitions to themselves and let their actions speak for them.

Re: Trouble with Diaspora

#88
post #79
post #60

Earlier quoted context omitted.

The "V" in MVP stands for viable. As is, the Diaspora code base is not viable. Not even minimally so.

The "P" stands for product, not code-base. Logically, security and privacy are secondary: they are properties of some functionality/data.

Yes, P does indeed stand for product. And this is not a product. Not yet, anyway.

Re: Trouble with Diaspora

#89
post #39

This code was written by a bunch of undergraduate college students. This is hiring a bunch of interns (with near zero experience) to implement your product, giving them three months, and then being shocked -- SHOCKED, when the code is not professional grade quality. I was shocked when everyone and their brother was willing to shell out money to a group of completely unproven college students to produce a distributed…

"Hopefully they haven't burned through too much of the $250,000 that they started with."

They mention at least two large cost items - luxr (basically consulting by Janice Fraser, it says around $10k on the company page) and pivotal labs. Pivotal is the huge one, I once got a quote from them on a project I was working on and they basically said they don't do less than 6 figures. So unless they got some kind of insider discount, the back-of-the-napkin math says at least half of their cash is gone.

Whether it was worth it or not is a separate matter. As a resume builder for a young team: sure, why not, you could do a lot worse. As a product for end users: you might support their cause, it depends on whether you're 1) a Facebook-hating neckbeard-sporting privacy nut - excuse me, libertarian, or 2) willing to cut them slack on an early release because there's some interesting technical challenge they're tackling.

For everyone else: no thanks, Facebook's fine and we'll stick with the real thing.

Re: Trouble with Diaspora

#90
it's insulting to refer to them as kids and criticism like this is only helpful if you give examples: this article does not do that, just making wide sweeping statements about "how bad" it all is. i had a quick look at github, it didn't look like it stunk, but i don't know ruby nor the framework they use.

they didn't appear to use pbkdf2 or similar to derive their crypto keys, so that isn't good. but at least they didn't make up their own algorithm (though maybe they're making their own crypto protocol--hopefully not--i couldn't tell from the code).

it's very easy to say "this sucks", it's harder to say "this sucks and here's why" and it's even harder to say "this suck and here's why and here's how i do it in my deployed product"

Post reply on HN