6 ms·

> I'm not making the server code available now, because it is messy and runs on duck-tape now. I feel like this is an unfortunately common take. "If it's not

> I'm not making the server code available now, because it is messy and runs on duck-tape now. I feel like this is an unfortunately common take. "If it's not widely used, or pretty, or innovative, it's not worth sharing." Chances are I've seen more duct tape on production code than whatever simple hacks you've done to make the server work. If it works and it's not going to leak your personal data or credentials, just share it. Anybody who's judging you by the state of your repos clearly doesn't understand that coding is iterative and happens better in the open, and is probably safe to ignore. Even if you never get a single star or MR, it's now out there to at least be something people can learn from. And really, all you've done is increase the chances that you might learn from somebody else, or help somebody else out.

jimmies 6y ago
Author here. I was actually somewhat worried that someone gonna get to my Pi that has some other stuff running on it, because I am absolutely not doing any security and sandboxing on this nodejs server... But I guess you made a good point, here you go :) Welcome to the wonderful world of random code copy-and-pasted from Stackoverflow! https://gist.github.com/htruong/692b1bca7b94db20051b601c89a44de9 https://gist.github.com/htruong/692b1bca7b94db20051b601c89a4...
- bakatubas 6y ago
  I found a vulnerability! ... Just kidding. :)
- opan 6y ago
  Could you add a LICENSE file?
  - jimmies 6y ago
    I have edited the code on the link above and added the license text.
- mixcocam 6y ago
  What you built is super cool. If I would like to hack on an m5paper myself what ressources would you recommend that I start with to kick off a small project?
  - jimmies 6y ago
    I read the M5paper Factory Test app [1] and it has tons of interesting details. m5stack has several other example applications in their repo, but I learned a lot from reading their source code in the test app. Their code is quite sane and organized. You just need to be tolerant to their spelling from time to time, I figure English is not their first language (just like me). 1: https://github.com/m5stack/M5Paper_FactoryTest https://github.com/m5stack/M5Paper_FactoryTest
- cpach 6y ago
  https://github.com/mozilla/readability https://github.com/mozilla/readability I had no idea that Readability.js was available as a standalone library. That’s awesome!
- MR4D 6y ago
  Kudos to you! We need more people to take this approach for things they want to share. It makes for a better community.
  - HowardStark 6y ago
    Super glad to see that OP posted the code! :) We as a community also need to do a better job of embracing unpolished projects and emphasizing a “don’t be bashful” approach. I’ve seen far too many hobbiest projects posted here where the comments have nitpicked them apart in a derogatory, non-constructive way.
    - MR4D 5y ago
      > ...a better job of embracing unpolished projects and emphasizing a “don’t be bashful” approach... Absolutely. One thing I've found is that the tone of HNers varies a lot. As you pointed out, many are very constructive ("have you thought about...") while some are more critical ("you don't have ..." or "the UX is horrible"). If more people could work on doing the former, then I think we can create a more constructive environment for people to do this. In my opinion, work in progress type projects (or "research projects" should have only constructive feedback, while Finished Products(tm) can take a more critical approach to comments.
- ebfe1 6y ago
  Thanks for sharing the code mate. May i also suggest adding a token/password if you want to reduce attack surface. Also from a quick glance, this looks like it is vulnerable to ssrf style attack. This type of service is often vulnerable to it given the nature of it is fetching url on user's behalf. I would suggest either isolate it, have a whitelist of domains that you trust or having iptables to deny internal access. Nice work regardless!
  - jimmies 6y ago
    Thanks for the suggestions. I know this implementation has more holes than a swiss cheese, but I will try to plug them as I figure out how to deal with js callbacks :)
    - andrewstuart2 5y ago
      And you may very well know this, but keep in mind that if this is on a LAN only and not port forwarded in from the internet, that substantially reduces your exposure; to exploit anything on your server code they'd need to be running behind your firewall. And there are probably juicier targets at that point.
      - ebfe1 5y ago
        Ohh I am 100% agree with this! sorry if I missed the LAN part in the original post. :Facepalm:
mlyle 6y ago
At the same time, there's been plenty of things that I've held off sharing for a week or two, for a chance to clean things up, and this isn't a crazy thing to do.
jbarberu 6y ago
I was messing around with the BMW iBus a while back and found a few repos with complete garbage code that was super useful for getting an idea of what the protocol looked like. Of course I didn't end up sharing mine, but ended up selling that car before getting beyond "wow it works!" :(
- ghostbrainalpha 6y ago
  What did you want to do with the iBus ?
  - jbarberu 5y ago
    I had a 2003 530i, which didn't have aux in, nor bluetooth. My use of the iBus was to emulate the CD changer in the trunk (basically just a heartbeat every 7s or so) which allowed me to use that line-in. I also picked up button presses on the bus in order to respond and control audio playback. Tied it all together by using a raspberry pi as a bluetooth sink and command hub between connected phone and the iBus.
    - ghostbrainalpha 5y ago
      That's really cool man! "Working on cars" is way different than it was in Grandpas day, but it's nice to know there are still people hacking together cool stuff.
      - jbarberu 5y ago
        To be fair, that car saw quite a few instances of the other type of "working on the car" too. I have 58 entries in my work log from two years of ownership...
comeonseriously 6y ago
The only people who care what the code looks like are the people who are jealous they can't do this and want to shit on someone else's project. Honest, no serious coder gives a shit what the code looks like. Only loudmouthed trolls do.
throwaway19419 6y ago
> Anybody who's judging you by the state of your repos clearly doesn't understand that coding is iterative and happens better in the open, and is probably safe to ignore Counterpoint: I applied for a job a few months ago which required a coding sample. I listed a link to a project of mine on GitHub. Rather than commenting on that project, they instead found another repo under the same account -- an open source project I started 6 years ago, but had not returned to since -- and told me they weren't happy with the quality of the code they saw represented there, which killed my application. I was annoyed. That wasn't a project I had looked at in some time, and I don't feel it represents my best work. It was just a proof of concept that I hoped to later refine. But it cost me an employment opportunity. I deleted the public repo.
boatsie 6y ago
As someone who wants to try his code, this is easy to say. But more often than not, hacks and imperfections in the code will be pointed to and laughed at. Companies interviewing him might think less of him, etc. They will get angry with him if he doesn’t fix bugs they find. And do we really expect the community to be appreciative of what he’s done? Open source developers talk about how they maybe make $100 in donations for libraries that millions of people use. It’s easy to tell someone to share something without understanding there’s usually more harm than good.
- andrewstuart2 6y ago
  I think I write decent code. But I haven't always. And I've at least always tried to put everything I can up on my public GitHub, and even when my employer has been cool with it, just tossing generic non-competitive code (not core to the business) up on GitHub as well. My experience has been the opposite of what you say. I've never had a single person mock me, I've only ever really learned things from comments/issues, gotten value add from PRs, or been encouraged to see that people like/use my code. It's been one of the single greatest sources of learning in my career. Quite honestly, the employers who are out there that would look at code I've put out there, see a bug, and pass up my resume, are the kind of employers I would almost certainly be just wasting time with if I was to work there. So in that sense it probably only does me good too; I get to spend my time at companies that understand the journey, understand differences of opinion and design, and don't expect perfect code that 100% matches their style guide every time. The reason I write code is not at all exclusively to make money. And the code I use daily is free and open source by probably a factor of 10:1. So I like to give back where I can. I'm not looking to make a buck, but I'm also obviously gonna put my GitHub on my resume because I'd much rather be matched to employers who can observe my approach and appreciate it enough to bring me to the interview stage.
- wyldfire 5y ago
  You can always drop it on an anonymous pastebin if you want to disavow low quality code.
Uehreka 6y ago
I’ve said this kind of thing before, usually it’s because the code I’m not releasing has a number of dependencies that are pre-installed on my machine. For something like a Node.js server, this isn’t usually a problem since everything is in package.json. But for more complicated stuff, I often have to write an installation guide, which takes time (you really have to test an installation guide on another machine or you _will_ leave out something critical and non-obvious). This may sound like perfectionism, but if you have incomplete installation instructions, many of the people currently complaining about lack of code will complain about that instead.

jimmies 6y ago

Author here. I was actually somewhat worried that someone gonna get to my Pi that has some other stuff running on it, because I am absolutely not doing any security and sandboxing on this nodejs server... But I guess you made a good point, here you go :) Welcome to the wonderful world of random code copy-and-pasted from Stackoverflow! https://gist.github.com/htruong/692b1bca7b94db20051b601c89a44de9 https://gist.github.com/htruong/692b1bca7b94db20051b601c89a4...

bakatubas 6y ago
I found a vulnerability! ... Just kidding. :)
opan 6y ago
Could you add a LICENSE file?
- jimmies 6y ago
  I have edited the code on the link above and added the license text.
mixcocam 6y ago
What you built is super cool. If I would like to hack on an m5paper myself what ressources would you recommend that I start with to kick off a small project?
- jimmies 6y ago
  I read the M5paper Factory Test app [1] and it has tons of interesting details. m5stack has several other example applications in their repo, but I learned a lot from reading their source code in the test app. Their code is quite sane and organized. You just need to be tolerant to their spelling from time to time, I figure English is not their first language (just like me). 1: https://github.com/m5stack/M5Paper_FactoryTest https://github.com/m5stack/M5Paper_FactoryTest
cpach 6y ago
https://github.com/mozilla/readability https://github.com/mozilla/readability I had no idea that Readability.js was available as a standalone library. That’s awesome!
MR4D 6y ago
Kudos to you! We need more people to take this approach for things they want to share. It makes for a better community.
- HowardStark 6y ago
  Super glad to see that OP posted the code! :) We as a community also need to do a better job of embracing unpolished projects and emphasizing a “don’t be bashful” approach. I’ve seen far too many hobbiest projects posted here where the comments have nitpicked them apart in a derogatory, non-constructive way.
  - MR4D 5y ago
    > ...a better job of embracing unpolished projects and emphasizing a “don’t be bashful” approach... Absolutely. One thing I've found is that the tone of HNers varies a lot. As you pointed out, many are very constructive ("have you thought about...") while some are more critical ("you don't have ..." or "the UX is horrible"). If more people could work on doing the former, then I think we can create a more constructive environment for people to do this. In my opinion, work in progress type projects (or "research projects" should have only constructive feedback, while Finished Products(tm) can take a more critical approach to comments.
ebfe1 6y ago
Thanks for sharing the code mate. May i also suggest adding a token/password if you want to reduce attack surface. Also from a quick glance, this looks like it is vulnerable to ssrf style attack. This type of service is often vulnerable to it given the nature of it is fetching url on user's behalf. I would suggest either isolate it, have a whitelist of domains that you trust or having iptables to deny internal access. Nice work regardless!
- jimmies 6y ago
  Thanks for the suggestions. I know this implementation has more holes than a swiss cheese, but I will try to plug them as I figure out how to deal with js callbacks :)
  - andrewstuart2 5y ago
    And you may very well know this, but keep in mind that if this is on a LAN only and not port forwarded in from the internet, that substantially reduces your exposure; to exploit anything on your server code they'd need to be running behind your firewall. And there are probably juicier targets at that point.
    - ebfe1 5y ago
      Ohh I am 100% agree with this! sorry if I missed the LAN part in the original post. :Facepalm:

mlyle 6y ago

At the same time, there's been plenty of things that I've held off sharing for a week or two, for a chance to clean things up, and this isn't a crazy thing to do.

jbarberu 6y ago

I was messing around with the BMW iBus a while back and found a few repos with complete garbage code that was super useful for getting an idea of what the protocol looked like. Of course I didn't end up sharing mine, but ended up selling that car before getting beyond "wow it works!" :(

ghostbrainalpha 6y ago
What did you want to do with the iBus ?
- jbarberu 5y ago
  I had a 2003 530i, which didn't have aux in, nor bluetooth. My use of the iBus was to emulate the CD changer in the trunk (basically just a heartbeat every 7s or so) which allowed me to use that line-in. I also picked up button presses on the bus in order to respond and control audio playback. Tied it all together by using a raspberry pi as a bluetooth sink and command hub between connected phone and the iBus.
  - ghostbrainalpha 5y ago
    That's really cool man! "Working on cars" is way different than it was in Grandpas day, but it's nice to know there are still people hacking together cool stuff.
    - jbarberu 5y ago
      To be fair, that car saw quite a few instances of the other type of "working on the car" too. I have 58 entries in my work log from two years of ownership...

comeonseriously 6y ago

The only people who care what the code looks like are the people who are jealous they can't do this and want to shit on someone else's project. Honest, no serious coder gives a shit what the code looks like. Only loudmouthed trolls do.

throwaway19419 6y ago

> Anybody who's judging you by the state of your repos clearly doesn't understand that coding is iterative and happens better in the open, and is probably safe to ignore Counterpoint: I applied for a job a few months ago which required a coding sample. I listed a link to a project of mine on GitHub. Rather than commenting on that project, they instead found another repo under the same account -- an open source project I started 6 years ago, but had not returned to since -- and told me they weren't happy with the quality of the code they saw represented there, which killed my application. I was annoyed. That wasn't a project I had looked at in some time, and I don't feel it represents my best work. It was just a proof of concept that I hoped to later refine. But it cost me an employment opportunity. I deleted the public repo.

boatsie 6y ago

As someone who wants to try his code, this is easy to say. But more often than not, hacks and imperfections in the code will be pointed to and laughed at. Companies interviewing him might think less of him, etc. They will get angry with him if he doesn’t fix bugs they find. And do we really expect the community to be appreciative of what he’s done? Open source developers talk about how they maybe make $100 in donations for libraries that millions of people use. It’s easy to tell someone to share something without understanding there’s usually more harm than good.

andrewstuart2 6y ago
I think I write decent code. But I haven't always. And I've at least always tried to put everything I can up on my public GitHub, and even when my employer has been cool with it, just tossing generic non-competitive code (not core to the business) up on GitHub as well. My experience has been the opposite of what you say. I've never had a single person mock me, I've only ever really learned things from comments/issues, gotten value add from PRs, or been encouraged to see that people like/use my code. It's been one of the single greatest sources of learning in my career. Quite honestly, the employers who are out there that would look at code I've put out there, see a bug, and pass up my resume, are the kind of employers I would almost certainly be just wasting time with if I was to work there. So in that sense it probably only does me good too; I get to spend my time at companies that understand the journey, understand differences of opinion and design, and don't expect perfect code that 100% matches their style guide every time. The reason I write code is not at all exclusively to make money. And the code I use daily is free and open source by probably a factor of 10:1. So I like to give back where I can. I'm not looking to make a buck, but I'm also obviously gonna put my GitHub on my resume because I'd much rather be matched to employers who can observe my approach and appreciate it enough to bring me to the interview stage.
wyldfire 5y ago
You can always drop it on an anonymous pastebin if you want to disavow low quality code.

Uehreka 6y ago

I’ve said this kind of thing before, usually it’s because the code I’m not releasing has a number of dependencies that are pre-installed on my machine. For something like a Node.js server, this isn’t usually a problem since everything is in package.json. But for more complicated stuff, I often have to write an installation guide, which takes time (you really have to test an installation guide on another machine or you _will_ leave out something critical and non-obvious). This may sound like perfectionism, but if you have incomplete installation instructions, many of the people currently complaining about lack of code will complain about that instead.