8 ms·

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how in

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the author for things not even in the scope of the project. Lastly this has so many upvotes and is #1 on the front page because it's cool, fun, and perfect for a little prototype or POC. There are a number of positive comments buried at the bottom but the highest comment is about how this is a "Security Nightmare". Edit: Typo and I wanted to add: Not everything posted on HN has to be battle-tested, scalable, parallelizable, profitable, cloud-ready, secure, etc. It's the kind of attitude in this thread that keeps people from posting their own work at all. No one want's to get torn apart, back off and provide constructive criticism or keep quiet. (Note: advice I have not always practiced in the past) Edit 2: Show HN rules (https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html), I think this makes my point better than I can. Show HN > Show HN is a way to share something that you've made on Hacker News. The current Show HNs can be found via show in the top bar, and the newest are here. To post one, simply submit a story whose title begins with "Show HN". What to Submit > Show HN is for something you've made that other people can play with. HN users can try it out, give you feedback, and ask questions in the thread. > A Show HN needn't be complicated or look slick. The community is comfortable with work that's at an early stage. > If your work isn't ready for people to try out yet, please don't do a Show HN. Once it's ready, come back and do it then. > Blog posts, sign-up pages, and fundraisers can't be tried out, so they can't be Show HNs. > New features and upgrades ("Foo 1.3.1 is out") generally aren't substantive enough to be Show HNs. A major overhaul is probably ok. In Comments > Be respectful. Anyone sharing work is making a contribution, however modest. > Ask questions out of curiosity. Don't cross-examine. > Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more. > When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.

scottmf 8y ago
>People in this thread are way overly negative. That's most of HN these days, and why I never visit anymore.
- lyjackal 8y ago
  Seems like it's been this way for at least a decade (that's about as far back as I've looked)
- dragonwriter 8y ago
  For someone who doesn't visit, you are a pretty active participant
  - WillPostForFood 8y ago
    wah? He has commented 9 times in the last three months, you have commented 9 times in the last three hours. If he is active, what are you?
    - deleted 8y ago
      [deleted]
    - dragonwriter 8y ago
      He's pretty active for someone who claims he never visits here. I don't claim not to visit here.
- kukabynd 8y ago
  Your comment is here though, no?
asadlionpk 8y ago
Thank you! We only recently started working on this and ofcourse it’s not perfect. All those concerns are very valid and will be addressed one-by-one. The project is open source under a decent license, I am VERY willing to accept any security PRs.
- wiremine 8y ago
  +1 on your positive approach to the negative comments. It looks like a great project: just remember not to loose your focus. :-)
deleted 8y ago
[deleted]
tlrobinson 8y ago
I agree people tend to be overly negative on HN about projects like this, but the AFAICT the project does not state any caveats about the security and/or where it should or shouldn't be used.
- wesleytodd 8y ago
  I think any user should be responsible for vetting their tech choices. Why would the author put a disclaimer instead of fixing the issues? In this case, the project is clearly too new/unstable/insecure to use in any real sense. It's presence as #1 on HN says more about the audience than the project itself I think.
  - tlrobinson 8y ago
    IMHO a project with a trivial directory traversal vulnerability[1] is not ready for a shiny marketing site like this. 1. https://news.ycombinator.com/item?id=19256230 https://news.ycombinator.com/item?id=19256230
    - joshstrange 8y ago
      We can talk in generalities but since in this case we have more specifics let's go that route. This is an open-sourcing of, presumably, an internal tool used at CodeInterview. It's "shiny marketing site" feels very cookie-cutter to me and I'd be shocked if that wasn't either a template or a very few handful of components from something like bootstrap/similar. And it was posted to "Show HN", which is important given the rules of Show HN [1]. > In Comments [0] https://codeinterview.io/ https://codeinterview.io/ [1] https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html
freedomben 8y ago
I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of just `npm install`ing stuff and shipping to prod without auditing well (I've heard a number of times, "well it has like 60 stars on github"). If the project marketed itself as a "development only" or non-production framework then I'd agree with you 100%. However as it stands it's dangerous and could lead to extreme compromise of a system if it gets deployed to a production environment. That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO.
- joshstrange 8y ago
  > That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO. Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never production ready". Not sure what the end goals of Zero are. I will say I thought it was pretty evident that this was not for production (if only to the sheer amount of "magic" inside) but maybe that's just me and it should have a disclaimer to that effect.
  - insulfrable 8y ago
    Maybe security people are getting tired of inconsiderate developers that keep shipping bazillions of insecure packages all over mission critical applications. Devs need to change their culture. This behavior is actively harming end-users through repeated data breaches.
    - 8y ago
quickthrower2 8y ago
The website gives the impression of a polished product. It doesn’t come across as a POC. Therefore I think the security concerns are valid. Someone is bound to build something with this, get users and get hacked otherwise.

scottmf 8y ago

>People in this thread are way overly negative. That's most of HN these days, and why I never visit anymore.

lyjackal 8y ago
Seems like it's been this way for at least a decade (that's about as far back as I've looked)
dragonwriter 8y ago
For someone who doesn't visit, you are a pretty active participant
- WillPostForFood 8y ago
  wah? He has commented 9 times in the last three months, you have commented 9 times in the last three hours. If he is active, what are you?
  - deleted 8y ago
    [deleted]
  - dragonwriter 8y ago
    He's pretty active for someone who claims he never visits here. I don't claim not to visit here.
kukabynd 8y ago
Your comment is here though, no?

asadlionpk 8y ago

Thank you! We only recently started working on this and ofcourse it’s not perfect. All those concerns are very valid and will be addressed one-by-one. The project is open source under a decent license, I am VERY willing to accept any security PRs.

wiremine 8y ago
+1 on your positive approach to the negative comments. It looks like a great project: just remember not to loose your focus. :-)

deleted 8y ago

[deleted]

tlrobinson 8y ago

I agree people tend to be overly negative on HN about projects like this, but the AFAICT the project does not state any caveats about the security and/or where it should or shouldn't be used.

wesleytodd 8y ago
I think any user should be responsible for vetting their tech choices. Why would the author put a disclaimer instead of fixing the issues? In this case, the project is clearly too new/unstable/insecure to use in any real sense. It's presence as #1 on HN says more about the audience than the project itself I think.
- tlrobinson 8y ago
  IMHO a project with a trivial directory traversal vulnerability[1] is not ready for a shiny marketing site like this. 1. https://news.ycombinator.com/item?id=19256230 https://news.ycombinator.com/item?id=19256230
  - joshstrange 8y ago
    We can talk in generalities but since in this case we have more specifics let's go that route. This is an open-sourcing of, presumably, an internal tool used at CodeInterview. It's "shiny marketing site" feels very cookie-cutter to me and I'd be shocked if that wasn't either a template or a very few handful of components from something like bootstrap/similar. And it was posted to "Show HN", which is important given the rules of Show HN [1]. > In Comments [0] https://codeinterview.io/ https://codeinterview.io/ [1] https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html

freedomben 8y ago

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of just `npm install`ing stuff and shipping to prod without auditing well (I've heard a number of times, "well it has like 60 stars on github"). If the project marketed itself as a "development only" or non-production framework then I'd agree with you 100%. However as it stands it's dangerous and could lead to extreme compromise of a system if it gets deployed to a production environment. That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO.

joshstrange 8y ago
> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO. Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never production ready". Not sure what the end goals of Zero are. I will say I thought it was pretty evident that this was not for production (if only to the sheer amount of "magic" inside) but maybe that's just me and it should have a disclaimer to that effect.
- insulfrable 8y ago
  Maybe security people are getting tired of inconsiderate developers that keep shipping bazillions of insecure packages all over mission critical applications. Devs need to change their culture. This behavior is actively harming end-users through repeated data breaches.
  - 8y ago

quickthrower2 8y ago

The website gives the impression of a polished product. It doesn’t come across as a POC. Therefore I think the security concerns are valid. Someone is bound to build something with this, get users and get hacked otherwise.