5 ms·

Bit of a tangent and, for those not familiar, Yik Yak is an anonymous, upvote-downvote, location-based forum (kinda) where posts are automatically deleted if th

Bit of a tangent and, for those not familiar, Yik Yak is an anonymous, upvote-downvote, location-based forum (kinda) where posts are automatically deleted if they net -5 votes. In college, I was really interested in how Yik Yak worked and found out that, given a list of N user ids (which were super easy to generate), one could send downvote requests to the server and instantly delete any post with a score <= (N - 5). Infinite loop + pass in a list of locations (e.g. a list of colleges in the US), and it's pretty darn easy to disable Yik Yak for the entire country. There was no location checking to see if a user id was being used in both Florida and Montana at the same time, and there was no real throttling. I hit up their support, and tried to reach out to their devs, but I kept getting brushed off. Of course this is just one small thing, but I'm not exactly surprised at how things are turning out if this was the level of interest that the Yik Yak team showed in their own product.

problems 10y ago
Honestly, I'm continually amazed by the level of absolute garbage people can ship with any level of popularity. And worse, get funding to ship it.
- ng12 10y ago
  But it doesn't really matter does it? It's a social application, not a banking system. If your garbage gets users it's not garbage.
  - pcwalton 10y ago
    If a company gets users but fails to retain them, causing the product to fail and the investors to lose their funds, then it certainly isn't a success.
    - ng12 10y ago
      Sure, but it's a calculated risk -- maybe they decided that growth features were more important than uptime or data integrity. That still doesn't mean the app is garbage.
    - TacticalTable 10y ago
      Yikyak didn't fail because of garbage code, it failed because of absolutely stupid decisions of direction. Adding usernames absolutely killed the app
  - s73ver 10y ago
    No, that just means it's popular garbage.
    - ng12 10y ago
      And that's infinitely better than scalable, well-designed garbage nobody uses.
- austenallred 10y ago
  The quality of code and level of popularity are not directly correlated. In fact, I've found often times they're inversely correlated. Maybe something to do with where time is spent?
  - Trundle 9y ago
    It amused me last year when I realised that 95% of my phone use was the facebook app, tinder, and pokemon go. One a notorious battery drain, the next crashed regularly, and then the last was worst at both. I definitely think there are a lot of programmers who place a too much weight on the effect of quality when it comes to consumer apps.
pjungwir 10y ago
A problem I've mused on for a few years is related to this: when a phone submits a lonlat to an API server, how can you make the server more confident it can trust the location? I mean with curl I could POST any lonlat I want---I don't even need a phone! I don't think this is truly solvable, but how can you make spoofing the location harder? The scale I'm thinking about is "Are you really in the store you say you're in?" where all users are from the same fairly dense city. So geolocating the IP isn't good enough. Accuracy to a city block or two seems good enough though. My best idea so far is to submit a list of available wifi access points, and use that as a "password" to prove that you're where you say you are. If your list is 80% like the list of other users at that location, we trust you. Unfortunately in iOS you can't get that list! It requires a private API, so calling that method will get your app rejected from the store. Does anyone have any other ideas?
- s73ver 10y ago
  I think the reason that API is private is because people do not want that level of tracking. And there are very few applications which absolutely, positively need this level of accuracy. And, I'm sorry, but marketing/advertising doesn't count.
  - pjungwir 10y ago
    In my case it is: the store gives you a secret code, and you enter it on your phone to earn discounts and raffle entries. We would like to prevent people taking the code home and sharing it with all their friends. So it's not about tracking. Still I get why the restriction needs to be there.
    - nso 10y ago
      Make them have to submit it via a WIFI network in the store?
      - Crespyl 10y ago
        Or arrange some kind of (perhaps NFC based) token signing system.
djsumdog 10y ago
I think they started requiring a real phone number type identification to deal with the issue instead of any type of real IP/region/rate-limited/Captcha based spam detection. I used it up until they asked for a real phone number. It was kinda cute, but yea, mostly filled with college students. Depending on where I travelled in the world, there may have been messages from three weeks ago on the top for that area. I was surprised how many remote areas had at least a few yackers; although very few non-English posts. I think my favourite Yak: "If you ever feel down about Uni, just remember there's still someone from your home town trying to make it as a rapper."

problems 10y ago

Honestly, I'm continually amazed by the level of absolute garbage people can ship with any level of popularity. And worse, get funding to ship it.

ng12 10y ago
But it doesn't really matter does it? It's a social application, not a banking system. If your garbage gets users it's not garbage.
- pcwalton 10y ago
  If a company gets users but fails to retain them, causing the product to fail and the investors to lose their funds, then it certainly isn't a success.
  - ng12 10y ago
    Sure, but it's a calculated risk -- maybe they decided that growth features were more important than uptime or data integrity. That still doesn't mean the app is garbage.
  - TacticalTable 10y ago
    Yikyak didn't fail because of garbage code, it failed because of absolutely stupid decisions of direction. Adding usernames absolutely killed the app
- s73ver 10y ago
  No, that just means it's popular garbage.
  - ng12 10y ago
    And that's infinitely better than scalable, well-designed garbage nobody uses.
austenallred 10y ago
The quality of code and level of popularity are not directly correlated. In fact, I've found often times they're inversely correlated. Maybe something to do with where time is spent?
- Trundle 9y ago
  It amused me last year when I realised that 95% of my phone use was the facebook app, tinder, and pokemon go. One a notorious battery drain, the next crashed regularly, and then the last was worst at both. I definitely think there are a lot of programmers who place a too much weight on the effect of quality when it comes to consumer apps.

pjungwir 10y ago

A problem I've mused on for a few years is related to this: when a phone submits a lonlat to an API server, how can you make the server more confident it can trust the location? I mean with curl I could POST any lonlat I want---I don't even need a phone! I don't think this is truly solvable, but how can you make spoofing the location harder? The scale I'm thinking about is "Are you really in the store you say you're in?" where all users are from the same fairly dense city. So geolocating the IP isn't good enough. Accuracy to a city block or two seems good enough though. My best idea so far is to submit a list of available wifi access points, and use that as a "password" to prove that you're where you say you are. If your list is 80% like the list of other users at that location, we trust you. Unfortunately in iOS you can't get that list! It requires a private API, so calling that method will get your app rejected from the store. Does anyone have any other ideas?

s73ver 10y ago
I think the reason that API is private is because people do not want that level of tracking. And there are very few applications which absolutely, positively need this level of accuracy. And, I'm sorry, but marketing/advertising doesn't count.
- pjungwir 10y ago
  In my case it is: the store gives you a secret code, and you enter it on your phone to earn discounts and raffle entries. We would like to prevent people taking the code home and sharing it with all their friends. So it's not about tracking. Still I get why the restriction needs to be there.
  - nso 10y ago
    Make them have to submit it via a WIFI network in the store?
    - Crespyl 10y ago
      Or arrange some kind of (perhaps NFC based) token signing system.

djsumdog 10y ago

I think they started requiring a real phone number type identification to deal with the issue instead of any type of real IP/region/rate-limited/Captcha based spam detection. I used it up until they asked for a real phone number. It was kinda cute, but yea, mostly filled with college students. Depending on where I travelled in the world, there may have been messages from three weeks ago on the top for that area. I was surprised how many remote areas had at least a few yackers; although very few non-English posts. I think my favourite Yak: "If you ever feel down about Uni, just remember there's still someone from your home town trying to make it as a rapper."