This code was written by a bunch of undergraduate college students.
This is hiring a bunch of interns (with near zero experience) to implement your product, giving them three months, and then being shocked -- SHOCKED, when the code is not professional grade quality.
I was shocked when everyone and their brother was willing to shell out money to a group of completely unproven college students to produce a distributed open source 'Facebook Clone', that is also 'private'. My inclination is that the 'distributed' and 'private' parts of the description push it into the oxymoron tier of product specifications. I would have expected this alone to give people pause about what the architecture would be (somehow it didn't).
Honestly, at least they have produced something, and for the most part, it works. Hopefully they haven't burned through too much of the $250,000 that they started with. 3 months of development time is honestly nothing.
Presumably, they could get comments on this, throw the entire thing away, re-write while fixing the various issues, and be well beyond where they are now in another three months. (If this is as bad as Steve says, I hope this is the case). Presumably the development will go faster because previously they were learning and developing at the same time (presumably).
Hacking together a prototype that you then throw away is a perfectly reasonable development model. I'm impressed (and pleased) that they have produced anything.
"Hopefully they haven't burned through too much of the $250,000 that they started with."
They mention at least two large cost items - luxr (basically consulting by Janice Fraser, it says around $10k on the company page) and pivotal labs. Pivotal is the huge one, I once got a quote from them on a project I was working on and they basically said they don't do less than 6 figures. So unless they got some kind of insider discount, the back-of-the-napkin math says at least half of their cash is gone.
Whether it was worth it or not is a separate matter. As a resume builder for a young team: sure, why not, you could do a lot worse. As a product for end users: you might support their cause, it depends on whether you're 1) a Facebook-hating neckbeard-sporting privacy nut - excuse me, libertarian, or 2) willing to cut them slack on an early release because there's some interesting technical challenge they're tackling.
For everyone else: no thanks, Facebook's fine and we'll stick with the real thing.
hiring a bunch of interns (with near zero experience) to implement your product - that is how a nearly 90% of projects are started, due to pure economical reason. ^_^
This code was released to developers as an incomplete preview. I'm not sure why people are holding it to the same standards as a finished product that's being released to end users. Seems like a pretext to talk trash.
I don't think anybody is "holding it to the same standards as a finished product."
I haven't read the code myself, but the OP is claiming "really, really bad security holes", and calls out the encryption code.
Security is not something that can be bolted on after the fact; it needs to be baked in from the start, in a product like this. And, remember, security/privacy was Diaspora's raison d'etre.
No one expects the first code dump to be polished, or feature-complete. But if there are serious flaws there, of the magnitude described, pointing it out isn't just "trash talk."
Indeed. These guys should be lauded for getting something out. It's a very non-trivial accomplishment.
I'm afraid that Diaspora might be in an impossible position. If they release something early, they'll get a lot of bad press from knuckleheads like this one that the quality is no good. If they release late, everyone will be clamoring over the wasted $250k in the interim, demanding: "when will we see something?".
Their product is released to end users, because the first thing every early adopter is doing with their shiny new host-you-own federated social network is sending out invites.
I haven't looked at the code, so I can't say this is the case, but...
There's some stuff that good/experienced developers do upfront naturally. There are some security, design and performance things that are clearly a case of bad development versus "this is an early release".
First impressions are important. Just as I was excited to hear about a decentralized, privacy-aware social network back in May, I am now worried when it's made available for us to watch its course.
The fact is, the implementation is obviously problematic. I won't go as far as saying that the design is flawed, although some security vulnerabilities are certainly pointing that way. It's obvious that Diaspora's developers are inexperienced, and therefore could use all the help they can get from us. This is one point in favour of an early release, in my book. On the other hand, early design and implementation decisions have profound implications during the lifespan of a project (this is especially true when it comes to security), and I will not trust my personal details to Diaspora in its current form; the project still has a (very) long way to go before being technically up-to-date.
"Release early, release often" (an open source mantra). Here on HN i also find the 'getto launch' being preached -- "if you not embarrest by your product at lauch-time, you should have released earlier".
Judging from the noise their release makes here on HN i think the diaspora guys did well opening up their repo 'early'.
And to steve: i think you hold 'professional programmers' (which i interpret as programmer that get paid) waaay too high..
There are a few reasons why this is worse: first, they are launching to media attention and a rabid community. BCC sucked at launch, but no one saw it, so yay. (And by sucked, I mean looked ugly, not "Anyone can delete all your documents at will.") Diaspora has thousands of end users already. Some seeds have 200+. They are launched. Not prealpha. Launched.
Their entire reason for existing is "Facebook but private". At the moment, they are delivering on that like ROT13Snap delivers on secure backup. And due to a programming bug, ROT13 was applied twice, and indexes are on in Apache. It is a cluster flop.
I've seen 'really, really bad' code. This ain't it.
Yeas, it's made some rookie mistakes. Yes, there's a load of things they shouldn't be trusting on postback (silly things like not checking the owner of an object on 'delete' commands).
That's not bad code, that's a bad implementation. That's not knowing what to trust and what not trust cause they've never been screwed up the ass by it yet.
But bad code? No.
The implementations are problems, they need this shit pointed out to them. That is all.
Steve and Patio11 are doing some serious damage to a good project for no apparent reason apart from self promotion. I want to call them nasty names, I really, really do.
I'm worried that this is going to be one of those group think exercises where people are simply going to key off of their opinions without even looking at the code. Or, worse, reiterate their claims on other forums. I don't think, at least in Patio11's case, that this is gross self-promotion, I think its simply arrogance.
Rather than type a bunch of replies to everyone, here's some random thoughts:
1. Release early, release often is great. But when your product's main focus is "a private social network where you control your data" and other people can do anything they'd like with your account...
2. If this was just unpolished, I wouldn't say anything. But like patio11 is saying, this has been covered by major news outlets, and many non-technical people are getting involved. This is a plea to pay attention to the fact that it's pre-alpha software.
3. The mistakes are beyond amateur. This isn't "omg it's not perfect," this is "I can't believe they didn't even apply the basics." The reason that this matters is that it doesn't bode well for the future of the project. If they can't even get this correct, how am I supposed to trust them later?
4. I only complain because I care. I want this project to succeed, and I really like a lot about the interface, actually. But that doesn't mean I won't call a spade a spade.
There's a lot of negativity and "I told you so" snickering floating around Diaspora on Hacker News.
I'm putting it down to envy: these guys have shipped some pre-alpha code that's interesting to a large number of people.
Excellent marketing in the open source community for developer eyeballs, perhaps not so good in terms of end-user experiences, but that's not the point at this stage, numbers will be low and the perceptions of the dumb early-adopters (of pre-alpha distributed social networking code, ffs) shouldn't leak too badly into the mainstream.
However, people are now eating the dogfood, and I expect to see fairly rapid improvements in the code: not unexpected for an alpha drop in my experience.
To the people who are moaning, would you like others to see your alpha code and laugh bitterly about you being a young (or old for that matter) upstart?
The trouble is that they were so ambitious but lacked any experience from which to chart those ambitions. They're just a bunch of young twenty-somethings just getting out of school. They haven't built any large-scale real-world security-hardened software yet.
More than the fact that the code isn't production ready (by a long shot it seems), I'm just surprised the released anything at all. Perhaps spending all that money on those consultants was a good thing for them. I doubt they would've been able to get by on their own given what was released and the hype they set in motion. It's a lot to live up to. They made some really bold claims.
Just goes to show that you can't just talk the talk and watch your dreams come true.
The trouble is that they were so ambitious but lacked any experience from which to chart those ambitions. They're just a bunch of young twenty-somethings just getting out of school. They haven't built any large-scale real-world security-hardened software yet.
Thank God that our industry isn't lousy with ambitious but inexperienced twenty-somethings. If we let them run amok, we'd get crapware like MS-DOS and computers like the Apple II.
What were these kids thinking, starting some ambitious software project from scratch without much of a clue how to do it? This is unheard of on the internet!
If anything, the hype might end up making some other better implementation actually have a chance of succeeding. If anyone else out there was thinking about doing a distributed social network, now's your shot at the limelight. You've got about a week to come up with a basic OStatus-based social network in Rails that isn't full of security holes.
Ok...
I'm no clearer on what the problem is than when I started reading the article.
All I got from it was they have security problems. What exactly? where exactly?
"Really, Really, Really Bad" is really subjective. When stating a problem try to be concrete and objective and give examples. For instance, if you think someones cooking is a bit off and you are a chef, say you need a little more salt or pepper or whatever the case maybe. A chef can't simply say it is really, really, really bad, leave such comments to amateurs who don't know what exactly they are experiencing and how exactly to fix it.
If you don't really have the time to address each particular concern then give them a reference to some security books that are essential when developing something like this.
As it stands the community is no better off before than when you wrote this. You should have written an article about "10 security books that are a must read to prevent diaspora mistakes".[I would appreciate it if someone who is knowledge about this wrote something like this]
Okay first of all, I'm glad that a bunch of undergrads from my school were able to raise $200k, get a lot of press, and build something. This alone should get a community of people around the project fixing bugs, etc.
I've always been saying that making a distributed social network is much easier than "solving" privacy and security for such a thing. First of all, try even defining what it means to privately share things with people on the internet. Then, realize that most solutions (such as diaspora) will actually EXACERBATE the privacy problem, by making you trust the hosting services of all your friends instead of just facebook.
That said, after diaspora was announced it made me think about whether it's possible to ensure privacy in principle. Meaning, is it possible to only trust YOUR hosting company and friends, and cut out every other middleman from being able to snoop your data?
I came up with something which I think would be very useful, and I actually submitted a provisional patent for the technology, which basically enables distributed AND private social networking using just today's web browsers.
If you want to check it out or get involved, see http://myownstream.com . This is an open-source offshoot of a social network I'm building, which I hope to release next year. You can see the roadmap there, but so far it's been going really well :)
There are very serious security blunders here, but I wouldn't go as far as the article to say it needs a complete overhaul. Here are a few example fixes.
1. Most of the XSS errors should be handled by Rails 3 auto-escaping. I'm not certain why this isn't happening. It may be a simple HAML config error or bug.
2. The session key should be moved out of the Git repo.
3. Most of the authorization can be done by reaching through the current user's associations. For example "current_user.photos.destroy" would prevent users from destroying other's photos.
I'm not defending the developers here and agree these should not have gotten past them. My point is these problems can be fixed in a few days, and thanks to open source, there are many eyes looking at the code to find additional security issues.
This is the problem: college students are terrible programmers. There aren't enough consequences for writing bad code in college. In industry, you learn very quickly that everything you learned in college is minuscule compared to what you actually need to know to work.
I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even desirable! Wow. Looking back now, how silly of us. Where did we get this idea? Certainly not from anyone with significant experience in industry. We had one professor with significant industry experience... from the days of IBM mainframes. She was the head of the department. She ran two classes a year, in "software engineering", basically "technical writing and project management". They were good classes, the most like the "real world" of any of our courses, but only 50% of the students took it and it represented maybe 10% of our studies for those of us who did.
Yes, the CS degree is about preparing students for CS graduate programs. But there was never a suggestion that perhaps the CS degree was not what we needed. Or maybe there was a suggestion, one, from some guy on Teh Intarwebs, against every other person in positions of respect around us. We were consistently told that the CS degree was the path to a software development degree. Yes, internships. They are very important. We don't do enough of them. We certainly need more of an apprenticeship model. I suspect that the development of good programmers would work in a culinary school model more than a research school model.
College graduates are basically the first level of competency worth training to become developers, or at least are supposed to be (let's just stick to ideal situations right now, with no wind resistance and infinite point masses). It's like in the martial arts, we say that black-belt is where the learning begins. Once you reach black-belt/BSCS, you have only acquired the tools that you need to start learning.
Every programmer I've known thought he was a super hacker by the time he got out of college. Me included. I see it in the interviews I conduct, also. There is an air of arrogance. There is a sense of shock and personal assault when pointing out their errors. They haven't yet grocked that the code is not them. They haven't yet learned that the errors are inevitable, that it is only time and experience that teaches us how to avoid them, that programming is about the pursuit of eventual perfection and not the dogmatic defense of yesterday's code.
So one of two things happens. Either the degreed programmer shucks his hubris and finds humility, or he becomes a leech on his coworkers (and my use of the masculine pronoun is no mistake, the female programmers I've known don't have this pathology). Unfortunately, the latter is apparently indistinguishable from the former for most management types. Haha, but digging on the liberal arts majors aside, most people who come out of college with a BS in CS do not want to make programming their wake-to-sleep life. They want it to be their 9-to-5 career, and leeching is the easier route to that.
The kids mean well, I'm sure they are quite intelligent, and they've got heart. But a startup was probably the worst first endeavor for them. I think it's better to go through your male-programmer-humiliation on someone else's dollar. They're basically going into more debt to learn how to be programmers now that they've gotten out of college. They could have been earning a salary to learn how to be programmers.
it's insulting to refer to them as kids and criticism like this is only helpful if you give examples: this article does not do that, just making wide sweeping statements about "how bad" it all is. i had a quick look at github, it didn't look like it stunk, but i don't know ruby nor the framework they use.
they didn't appear to use pbkdf2 or similar to derive their crypto keys, so that isn't good. but at least they didn't make up their own algorithm (though maybe they're making their own crypto protocol--hopefully not--i couldn't tell from the code).
it's very easy to say "this sucks", it's harder to say "this sucks and here's why" and it's even harder to say "this suck and here's why and here's how i do it in my deployed product"
I call everyone 'kids,' it's not meant to be offensive. I'm 24 myself.
The 'here's why' part gets tricky with security stuff. I don't want to be complicit in people trashing accounts. And if you read, I did submit patches.
And they are making up their own protocol. It's currently not documented.
I'm not even sure it's worth submitting patches to Diaspora, both because of the fundamental problems with the code, but also because of their "Open Core" licensing scheme (AGPL + contributor agreement): http://www.ebb.org/bkuhn/blog/2009/10/16/open-core-shareware...
Looking through the code, it looks like Diaspora is really just putting a front end and "aspects" on top of OStatus. I think it might be good at this point to just scrap the Diaspora code and start over from the basics with a good OStatus-based reference implementation in Rails.
At its core, the real value in something like Diaspora is its protocols. If you disagree with the license, or the language they chose, why not make your own implementation from scratch that can federate with it.
If it survives, I might do this... I think their approach is fine for rolling out a private enterprise FB or creating an alternative hosting solution, but I'd like to see an even more decentralized solution. Ruby isn't a good choice of language for mobile, or native compiled "IJW out of the box" deployable solutions.
It's great that they're getting so much open-source help, but I'm going to ask the obvious question: if a "complete overhaul" is what's needed, as the author seems to imply, and the FOSS community performs said overhaul, then what of the $250k that was given to the Diaspora guys? Is it still even "Diaspora" anymore, as opposed to a FOSS project?
It's an awful lot easier for a bunch of third parties to refactor and fix something that's bad, a piece at a time, than for a bunch of third parties to create something from nothing. Diaspora is a good thing, even if it's bad: the mere fact of its existence and the enthusiasm around making it better gives it a vector of development that a mere idea would never have.
One thing I really liked about this post: most people readily complain about something, yet only a few like Steve actually do something to help fix it.
Indeed. If the world was filled with more people like Steve it would be awesome. This post is getting close to 100 comments. If each commenter took the time to fix just one bug, that would be a lot of progress just there.
They could've really saved themselves some grief is they'd been far more explicit about saying that it's Alpha and months from being production ready. All this 'there's bugs! omfg!' hoo-ha could've been headed off at the pass
Steve, where did you get the $250,000 figure? Their Kickstarter page still shows $200K and change (http://www.kickstarter.com/projects/196017994/diaspora-the-p...), and now there are currently three mentions of $250K in the comments here, none of them questioning the $50K raise. Just checking to see if I missed another bit of funding somewhere.
The issue is you shouldn't build (or ship) code like this with such major security holes, you build security at the start, it should be an integral part of the application. You can't just dick out some insecure application then add in security, it doesn't work.
[+] [-] ohyes|15 years ago|reply
This is hiring a bunch of interns (with near zero experience) to implement your product, giving them three months, and then being shocked -- SHOCKED, when the code is not professional grade quality.
I was shocked when everyone and their brother was willing to shell out money to a group of completely unproven college students to produce a distributed open source 'Facebook Clone', that is also 'private'. My inclination is that the 'distributed' and 'private' parts of the description push it into the oxymoron tier of product specifications. I would have expected this alone to give people pause about what the architecture would be (somehow it didn't).
Honestly, at least they have produced something, and for the most part, it works. Hopefully they haven't burned through too much of the $250,000 that they started with. 3 months of development time is honestly nothing.
Presumably, they could get comments on this, throw the entire thing away, re-write while fixing the various issues, and be well beyond where they are now in another three months. (If this is as bad as Steve says, I hope this is the case). Presumably the development will go faster because previously they were learning and developing at the same time (presumably).
Hacking together a prototype that you then throw away is a perfectly reasonable development model. I'm impressed (and pleased) that they have produced anything.
[+] [-] alabut|15 years ago|reply
They mention at least two large cost items - luxr (basically consulting by Janice Fraser, it says around $10k on the company page) and pivotal labs. Pivotal is the huge one, I once got a quote from them on a project I was working on and they basically said they don't do less than 6 figures. So unless they got some kind of insider discount, the back-of-the-napkin math says at least half of their cash is gone.
Whether it was worth it or not is a separate matter. As a resume builder for a young team: sure, why not, you could do a lot worse. As a product for end users: you might support their cause, it depends on whether you're 1) a Facebook-hating neckbeard-sporting privacy nut - excuse me, libertarian, or 2) willing to cut them slack on an early release because there's some interesting technical challenge they're tackling.
For everyone else: no thanks, Facebook's fine and we'll stick with the real thing.
[+] [-] Maro|15 years ago|reply
http://en.wikipedia.org/wiki/Second-system_effect
[+] [-] c00p3r|15 years ago|reply
[+] [-] cilantro|15 years ago|reply
[+] [-] michael_dorfman|15 years ago|reply
I haven't read the code myself, but the OP is claiming "really, really bad security holes", and calls out the encryption code.
Security is not something that can be bolted on after the fact; it needs to be baked in from the start, in a product like this. And, remember, security/privacy was Diaspora's raison d'etre.
No one expects the first code dump to be polished, or feature-complete. But if there are serious flaws there, of the magnitude described, pointing it out isn't just "trash talk."
[+] [-] jpeterson|15 years ago|reply
I'm afraid that Diaspora might be in an impossible position. If they release something early, they'll get a lot of bad press from knuckleheads like this one that the quality is no good. If they release late, everyone will be clamoring over the wasted $250k in the interim, demanding: "when will we see something?".
[+] [-] patio11|15 years ago|reply
[+] [-] latch|15 years ago|reply
There's some stuff that good/experienced developers do upfront naturally. There are some security, design and performance things that are clearly a case of bad development versus "this is an early release".
Fundamentals.
[+] [-] mfukar|15 years ago|reply
The fact is, the implementation is obviously problematic. I won't go as far as saying that the design is flawed, although some security vulnerabilities are certainly pointing that way. It's obvious that Diaspora's developers are inexperienced, and therefore could use all the help they can get from us. This is one point in favour of an early release, in my book. On the other hand, early design and implementation decisions have profound implications during the lifespan of a project (this is especially true when it comes to security), and I will not trust my personal details to Diaspora in its current form; the project still has a (very) long way to go before being technically up-to-date.
[+] [-] cies|15 years ago|reply
Judging from the noise their release makes here on HN i think the diaspora guys did well opening up their repo 'early'.
And to steve: i think you hold 'professional programmers' (which i interpret as programmer that get paid) waaay too high..
[+] [-] patio11|15 years ago|reply
Their entire reason for existing is "Facebook but private". At the moment, they are delivering on that like ROT13Snap delivers on secure backup. And due to a programming bug, ROT13 was applied twice, and indexes are on in Apache. It is a cluster flop.
[+] [-] logicalmind|15 years ago|reply
[+] [-] steveklabnik|15 years ago|reply
What I meant was more of "someone who's knowledgeable about their craft," but you're absolutely right anyway.
[+] [-] mattmanser|15 years ago|reply
Yeas, it's made some rookie mistakes. Yes, there's a load of things they shouldn't be trusting on postback (silly things like not checking the owner of an object on 'delete' commands).
That's not bad code, that's a bad implementation. That's not knowing what to trust and what not trust cause they've never been screwed up the ass by it yet.
But bad code? No.
The implementations are problems, they need this shit pointed out to them. That is all.
Steve and Patio11 are doing some serious damage to a good project for no apparent reason apart from self promotion. I want to call them nasty names, I really, really do.
[+] [-] Mod_daniel|15 years ago|reply
[+] [-] steveklabnik|15 years ago|reply
[+] [-] steveklabnik|15 years ago|reply
Rather than type a bunch of replies to everyone, here's some random thoughts:
1. Release early, release often is great. But when your product's main focus is "a private social network where you control your data" and other people can do anything they'd like with your account...
2. If this was just unpolished, I wouldn't say anything. But like patio11 is saying, this has been covered by major news outlets, and many non-technical people are getting involved. This is a plea to pay attention to the fact that it's pre-alpha software.
3. The mistakes are beyond amateur. This isn't "omg it's not perfect," this is "I can't believe they didn't even apply the basics." The reason that this matters is that it doesn't bode well for the future of the project. If they can't even get this correct, how am I supposed to trust them later?
4. I only complain because I care. I want this project to succeed, and I really like a lot about the interface, actually. But that doesn't mean I won't call a spade a spade.
[+] [-] com|15 years ago|reply
I'm putting it down to envy: these guys have shipped some pre-alpha code that's interesting to a large number of people.
Excellent marketing in the open source community for developer eyeballs, perhaps not so good in terms of end-user experiences, but that's not the point at this stage, numbers will be low and the perceptions of the dumb early-adopters (of pre-alpha distributed social networking code, ffs) shouldn't leak too badly into the mainstream.
However, people are now eating the dogfood, and I expect to see fairly rapid improvements in the code: not unexpected for an alpha drop in my experience.
To the people who are moaning, would you like others to see your alpha code and laugh bitterly about you being a young (or old for that matter) upstart?
[+] [-] agentultra|15 years ago|reply
More than the fact that the code isn't production ready (by a long shot it seems), I'm just surprised the released anything at all. Perhaps spending all that money on those consultants was a good thing for them. I doubt they would've been able to get by on their own given what was released and the hype they set in motion. It's a lot to live up to. They made some really bold claims.
Just goes to show that you can't just talk the talk and watch your dreams come true.
[+] [-] raganwald|15 years ago|reply
Thank God that our industry isn't lousy with ambitious but inexperienced twenty-somethings. If we let them run amok, we'd get crapware like MS-DOS and computers like the Apple II.
[+] [-] Volscio|15 years ago|reply
[+] [-] jarin|15 years ago|reply
[+] [-] chegra|15 years ago|reply
All I got from it was they have security problems. What exactly? where exactly?
"Really, Really, Really Bad" is really subjective. When stating a problem try to be concrete and objective and give examples. For instance, if you think someones cooking is a bit off and you are a chef, say you need a little more salt or pepper or whatever the case maybe. A chef can't simply say it is really, really, really bad, leave such comments to amateurs who don't know what exactly they are experiencing and how exactly to fix it.
If you don't really have the time to address each particular concern then give them a reference to some security books that are essential when developing something like this.
As it stands the community is no better off before than when you wrote this. You should have written an article about "10 security books that are a must read to prevent diaspora mistakes".[I would appreciate it if someone who is knowledge about this wrote something like this]
[+] [-] natrius|15 years ago|reply
[+] [-] EGreg|15 years ago|reply
I've always been saying that making a distributed social network is much easier than "solving" privacy and security for such a thing. First of all, try even defining what it means to privately share things with people on the internet. Then, realize that most solutions (such as diaspora) will actually EXACERBATE the privacy problem, by making you trust the hosting services of all your friends instead of just facebook.
That said, after diaspora was announced it made me think about whether it's possible to ensure privacy in principle. Meaning, is it possible to only trust YOUR hosting company and friends, and cut out every other middleman from being able to snoop your data?
I came up with something which I think would be very useful, and I actually submitted a provisional patent for the technology, which basically enables distributed AND private social networking using just today's web browsers.
If you want to check it out or get involved, see http://myownstream.com . This is an open-source offshoot of a social network I'm building, which I hope to release next year. You can see the roadmap there, but so far it's been going really well :)
[+] [-] xentronium|15 years ago|reply
[+] [-] rbates|15 years ago|reply
1. Most of the XSS errors should be handled by Rails 3 auto-escaping. I'm not certain why this isn't happening. It may be a simple HAML config error or bug.
2. The session key should be moved out of the Git repo.
3. Most of the authorization can be done by reaching through the current user's associations. For example "current_user.photos.destroy" would prevent users from destroying other's photos.
I'm not defending the developers here and agree these should not have gotten past them. My point is these problems can be fixed in a few days, and thanks to open source, there are many eyes looking at the code to find additional security issues.
[+] [-] moron4hire|15 years ago|reply
I knew guys who only studied databases or only studied HTML+JavaScript+CSS. And we all expected that this level of specialization was common and even desirable! Wow. Looking back now, how silly of us. Where did we get this idea? Certainly not from anyone with significant experience in industry. We had one professor with significant industry experience... from the days of IBM mainframes. She was the head of the department. She ran two classes a year, in "software engineering", basically "technical writing and project management". They were good classes, the most like the "real world" of any of our courses, but only 50% of the students took it and it represented maybe 10% of our studies for those of us who did.
Yes, the CS degree is about preparing students for CS graduate programs. But there was never a suggestion that perhaps the CS degree was not what we needed. Or maybe there was a suggestion, one, from some guy on Teh Intarwebs, against every other person in positions of respect around us. We were consistently told that the CS degree was the path to a software development degree. Yes, internships. They are very important. We don't do enough of them. We certainly need more of an apprenticeship model. I suspect that the development of good programmers would work in a culinary school model more than a research school model.
College graduates are basically the first level of competency worth training to become developers, or at least are supposed to be (let's just stick to ideal situations right now, with no wind resistance and infinite point masses). It's like in the martial arts, we say that black-belt is where the learning begins. Once you reach black-belt/BSCS, you have only acquired the tools that you need to start learning.
Every programmer I've known thought he was a super hacker by the time he got out of college. Me included. I see it in the interviews I conduct, also. There is an air of arrogance. There is a sense of shock and personal assault when pointing out their errors. They haven't yet grocked that the code is not them. They haven't yet learned that the errors are inevitable, that it is only time and experience that teaches us how to avoid them, that programming is about the pursuit of eventual perfection and not the dogmatic defense of yesterday's code.
So one of two things happens. Either the degreed programmer shucks his hubris and finds humility, or he becomes a leech on his coworkers (and my use of the masculine pronoun is no mistake, the female programmers I've known don't have this pathology). Unfortunately, the latter is apparently indistinguishable from the former for most management types. Haha, but digging on the liberal arts majors aside, most people who come out of college with a BS in CS do not want to make programming their wake-to-sleep life. They want it to be their 9-to-5 career, and leeching is the easier route to that.
The kids mean well, I'm sure they are quite intelligent, and they've got heart. But a startup was probably the worst first endeavor for them. I think it's better to go through your male-programmer-humiliation on someone else's dollar. They're basically going into more debt to learn how to be programmers now that they've gotten out of college. They could have been earning a salary to learn how to be programmers.
[+] [-] dododo|15 years ago|reply
they didn't appear to use pbkdf2 or similar to derive their crypto keys, so that isn't good. but at least they didn't make up their own algorithm (though maybe they're making their own crypto protocol--hopefully not--i couldn't tell from the code).
it's very easy to say "this sucks", it's harder to say "this sucks and here's why" and it's even harder to say "this suck and here's why and here's how i do it in my deployed product"
[+] [-] steveklabnik|15 years ago|reply
The 'here's why' part gets tricky with security stuff. I don't want to be complicit in people trashing accounts. And if you read, I did submit patches.
And they are making up their own protocol. It's currently not documented.
[+] [-] jarin|15 years ago|reply
Looking through the code, it looks like Diaspora is really just putting a front end and "aspects" on top of OStatus. I think it might be good at this point to just scrap the Diaspora code and start over from the basics with a good OStatus-based reference implementation in Rails.
[+] [-] cmars232|15 years ago|reply
If it survives, I might do this... I think their approach is fine for rolling out a private enterprise FB or creating an alternative hosting solution, but I'd like to see an even more decentralized solution. Ruby isn't a good choice of language for mobile, or native compiled "IJW out of the box" deployable solutions.
[+] [-] mayank|15 years ago|reply
[+] [-] RyanMcGreal|15 years ago|reply
[+] [-] jlgbecom|15 years ago|reply
[+] [-] tariq|15 years ago|reply
[+] [-] chaostheory|15 years ago|reply
[+] [-] harryh|15 years ago|reply
Go Steve!
[+] [-] steveklabnik|15 years ago|reply
[+] [-] rblion|15 years ago|reply
[+] [-] msy|15 years ago|reply
[+] [-] twymer|15 years ago|reply
[+] [-] jlgbecom|15 years ago|reply
[+] [-] Maro|15 years ago|reply
Github issue #8: "Facebook has a majority market share"
http://github.com/diaspora/diaspora/issues#issue/8
[+] [-] jokermatt999|15 years ago|reply
https://launchpad.net/ubuntu/+bug/1
[+] [-] thinkalone|15 years ago|reply
[+] [-] steveklabnik|15 years ago|reply
[+] [-] middlegeek|15 years ago|reply
"Feel free to try to get it running on your machines and use it, but we give no guarantees. We know there are security holes and bugs..."
[+] [-] citricsquid|15 years ago|reply