5 ms·
Some notes: - Privacy policy should direct me to https://www.rssbrain.com/privacy https://www.rssbrain.com/privacy not terms - Selecting email in the support
by neontomo 4y ago
Some notes:
- Privacy policy should direct me to https://www.rssbrain.com/privacy https://www.rssbrain.com/privacy not terms
- Selecting email in the support section doesn't work, which the website encourages me to do
- Are you handling your own logins? Seems like a security issue waiting to happen!
- Do you need to sign up with both an email and a username? Perhaps email is enough
- The logo and the name "RSS Brain" do not match up in height
- The download buttons CSS padding-bottom is too thin
- The scroll down to see more part seems to have some symbols added, I can't see them on my computer (Mac). I assume these are arrow emojis/symbols or something. Replace them with something that works cross-platform
- "Support upvotes and comment count from forums like Reddit and HackerNews" should be "Supports"
- "Powered by transparent algorithm" -> "Powered by a transparent algorithm"
- "Try RSS Brain with 7 days free trial and subscribe with $4.99 per month.
" -> "Try RSS Brain with a 7 day free trial and subscribe for $4.99 per month."
- If I go to the login page, and then the signup page, and then hit the Back button on my browser, it shows "page not found".
- The green design box that contains the screenshots is off center
There's some other smaller inconsistencies but I'll leave it at that. I can see you put a lot of effort into building this tool, and it seems quite cool! I hope you succeed.
- toastercat 4y ago> Are you handling your own logins? Seems like a security issue waiting to happen! Can you explain what you mean by "handling your own logins" and what is the norm?
- neontomo 4y agoYes of course. Generally, for a project with a small team, doing the backend for logins yourself is a good way to get yourself hacked or having your customers data leaked at some point. It is difficult to do this type of validation and security testing well. The most likely outcome is that you overlooked something and later pay the price. On a small website I would default to using Google/FB/etc for logins and let them handle the security.
- PenguinCoder 4y agoThat's pretty flimsy reasoning to allow Google and Facebook to track your users. You "might" have done something wrong. It's unlikely they rolled their own encryption and authentication process. Using well trusted, vetted, local auth libraries is much more preferable than outsourcing your auth for "security reasons" to a third party.
- spockz 4y agoOne could still use something like auth0 to implement authentication without shelling out to social media.
- jeffybefffy519 4y agoAuth0 adds cost overhead for small projects that is hard to justify. I think the original comment about doing your own logins is overblown and theres still heaps of ways that outsourced logins can be broken from an integration POV.
- tryfinally 4y agoI, for one, wouldn't ever use a service that requires login via social media or some other platform, especially FB/Google. This isn’t usually a problem, though - I don’t think I’ve ever encountered an app that would impose this. (Maybe apart from services that are specifically built on top of the app that they’re authenticating through.)
- WirelessGigabit 4y agoTailscale comes to mind.
- thaumaturgy 4y agoAre you thinking the tricky part here is in handling password resets? Because otherwise I've had an easier time with straightforward username+bcrypt(password) in-house versus reliably implementing OAuth2/OpenID/whatever, which has some sharp edges of its own.
- wb14123 4y agoThanks for the feedback! I write much more backend software than frontend ones, so love the feedback on UI details and I will try to fix those.