4 ms·

A few criticisms from someone who has tried everything in this market: 1. Security is a weak point. From their FAQ: "Documents uploaded to crocodoc are assi

A few criticisms from someone who has tried everything in this market: 1. Security is a weak point. From their FAQ: "Documents uploaded to crocodoc are assigned a unique, unguessable URL (e.g. http://crocodoc.com/gQlo2g http://crocodoc.com/gQlo2g), which you can selectively share with others you wish to collaborate with. For added security, crocodoc Pro users have the option of password-protecting their documents, which are uploaded and viewed using bank-grade SSL encryption. Companies interested in running crocodoc behind their firewall can contact us to request more information on intranet deployments." This is insufficient security for any serious business application. Nothing about data encryption at rest. Nothing about link expiration. Nothing about the authentication used for password protection. Running behind a firewall has nothing to do with the security of data once it is transmitted. 2. The format seems to be proprietary. Call me crazy, but if I'm investing the time and energy into marking up documents, I want to take them away in a portable, editable format. Maybe I missed this point on their site?

sunchild 17y ago
On point 1 above: self-hosting is not necessarily the answer either. It really depends on the underlying architecture.
jrheard 17y ago
Agreed re: #1. Anyone who's taken an intro-level security course or had any experience with webdev can tell you that "unguessable" is beyond being an oxymoron - it's a running joke. There's no such thing as security through obscurity. Of course, they do offer password protection for Pro users, and if they're using SSL that's great too; I just feel like "unguessable" is not the best word to use when discussing any aspect of an app's security. As an aside: the <del>mark up</del><ins>review</ins> tagline is fantastic! Really clever.
jamesbritt 17y ago
"2. The format seems to be proprietary. Call me crazy, but if I'm investing the time and energy into marking up documents, I want to take them away in a portable, editable format. Maybe I missed this point on their site?" Oh, excellent point. I was just trying out the site, and it's quite impressive. But you're comment was something that completely slipped my mind. For my purposes I'll eventually want a local copy of the document with all the additions. The FAQ says nothing about this. Also, I was editing a document in 3 different browsers to see how it handled multiple users. I didn't see any automatic updating, like how Google Docs shows other edits in near real-time among my changes. I had to refresh the browser to see the new state of the file. I can see that creating assorted cross-editing problems.

sunchild 17y ago

On point 1 above: self-hosting is not necessarily the answer either. It really depends on the underlying architecture.

jrheard 17y ago

Agreed re: #1. Anyone who's taken an intro-level security course or had any experience with webdev can tell you that "unguessable" is beyond being an oxymoron - it's a running joke. There's no such thing as security through obscurity. Of course, they do offer password protection for Pro users, and if they're using SSL that's great too; I just feel like "unguessable" is not the best word to use when discussing any aspect of an app's security. As an aside: the <del>mark up</del><ins>review</ins> tagline is fantastic! Really clever.

jamesbritt 17y ago

"2. The format seems to be proprietary. Call me crazy, but if I'm investing the time and energy into marking up documents, I want to take them away in a portable, editable format. Maybe I missed this point on their site?" Oh, excellent point. I was just trying out the site, and it's quite impressive. But you're comment was something that completely slipped my mind. For my purposes I'll eventually want a local copy of the document with all the additions. The FAQ says nothing about this. Also, I was editing a document in 3 different browsers to see how it handled multiple users. I didn't see any automatic updating, like how Google Docs shows other edits in near real-time among my changes. I had to refresh the browser to see the new state of the file. I can see that creating assorted cross-editing problems.