7 ms·
Moot 1.0 launches with embeddable forums and commenting without iframes
- davekt 14y agoFor 3rd party widgets, I actually prefer iframe for security. The same domain policy makes it more difficult for xss in the iframe to compromise the parent page. For HTML5 sandbox iframes, the security boundaries are even more strict and tunable. There are some disadvantages to current iframes that Moot addresses like the lack of CSS cascading from parent page to iframe. The seamless iframe spec addresses this issue, but it's not widely adopted yet.
- tipiirai 14y agoMoot uses IFRAME for the authentication since that's the on that needs security.
- davekt 14y agoAn example attack iframes would make more difficult is XSS in the comment fields, e.g. an attacker bypasses sanitization and injects js into a page. With a sandbox iframe, the comments section could be restricted from compromising the top level page, e.g. stealing cookies, redirecting, etc.
- tipiirai 14y agoYou mean someone could put JS into the comment box and inject it into the page somehow?
- davekt 14y agoCorrect. If the 3rd party js properly sanitizes user input, this xss attack is moot. However, browsers love to eval stuff (http://html5sec.org/ http://html5sec.org/), and sandbox iframes provide good defense in depth. Secure programs like qmail have been using separate, sandboxed processes forever, but this secure design model has only recently been possible in the browser thanks to iframes and postMessage (http://www.cs.berkeley.edu/~devdatta/papers/LeastPrivileges.pdf http://www.cs.berkeley.edu/~devdatta/papers/LeastPrivileges....).
- tipiirai 14y agoThe client obviously strips out any SCRIPT/HTML tags from the input but I guess your're talking about something more clever here. Can you provide an example attack that could potentially pass our security?
- courtneycouch0 14y agoSanitization and protection from attacks is handled by the API itself instead of the client. We feel it's inherently risky to rely on the client at all for any security.
- davekt 14y agoThanks for responding. I would argue the opposite, that the browser is the safest place to sanitize because it better understands the context where user generated strings will be inserted. An example where the server may not understand the correct context occurs in this utf7 attack (http://html5sec.org/#charset http://html5sec.org/#charset). The server sanitizes the user input as utf8 where it passes. The client forces the browser to interpret the input as utf7 instead, and the string that was harmless as utf8 now becomes active js.
- tipiirai 14y agoThank you for this good example. We'll study this one more closely.
- bentlegen 14y agoIframes are easily spoofable. I can generate an iframe, style it exactly like your authentication page, and trick users into entering their username/password into my phony form. This is why mature platforms use dedicated windows for logging in (Facebook, Twitter, Disqus). I'd recommend you consider making this change.
- trumbitta2 14y agoThis appears amazing and promising. I'd really like to witness the rising of a proper competitor for Disqus.
- JLehtinen 14y agoAnd of course Moot also offers forums, which Disqus does not.
- polskibus 14y agoBy "You will have full access to your data at all times (*)" - do you mean for the user or for the site that embedds a forum or maybe both? Do you plan for data export for both user and site ?
- tipiirai 14y agoData export is coming for the site. For user.. yea, good idea, we can do it but it's not on our roadmap yet.
- overload118 14y agoThis is awesome. How are you able to offer it for free?
- tipiirai 14y agoOur infrastructure is designed from the ground up to handle the kind of spikes and massive loads that viral and social sites tend to generate. A million init- requests costs us very little. We can cover the expenses with paid products that are introduced later: these paid products allow private posts and custom branding for example. The features you see on our site now will always be free.
- hcho 14y agoAnd yet it came crumbling down with some traffic form HN. Snark aside, looks very promising. Keep up the good work.
- courtneycouch0 14y agocrumbling? median api response times are 1.446ms at the moment and basically all our servers are completely idle. Any issues would be new bugs for us to track down!
- jsherer 14y agoI'm getting a lot of "We're experiencing problems and this post was not saved. Please copy/paste this post somewhere and try posting later. Sorry!"
- tipiirai 14y agoThanks. Checking this out. Looks like a connection issue. Servers are up all the time.
- courtneycouch0 14y agoIf I could ask a quick favor from you: Can you create an account and try to post on our sandbox forum: http://moot.it/demos/forum.html http://moot.it/demos/forum.html We have quite a bit more logging there. The production system is not showing any errors. If you could do that THANKS! If not, sorry that you are having some issues!
- kmfrk 14y agoThis looks seriously interesting. It could be everything I've wanted Disqus to be - and their service has only really gotten worse over time. Don't know about the forum aspect, but the comments design is great. I hope you can enforce whether it is linear or threaded from an admin point of view.
- courtneycouch0 14y agoYes, you pick whether your comments are linear or threaded and you can mix and match (use threaded in some places, and linear in other places). It's configured simply by how you embed it.
- kmfrk 14y agoI was wondering, with the JS and all, how are the forums from an accessibility perspective?
- Narretz 14y agoWow, seems to cover a lot of use cases. I wonder how it compares to discourse.org What confuses me a little is the part in the manifesto, where they basically claim, Moot will reduce trolling and memes and make conversation more meaningful. I think that any technical platform can be compromised, no matter how sophisticated. Sure, you can reduce trolling by voting etc., but how is technology supposed to help if the users themselves are not providing enough meaningful content?
- tipiirai 14y agoThe biggest difference Discourse is a Ruby application that is installed on your own server - and it cannot be integrated on your site, at least at the moment. We can reduce trolling and memes with UI design and by not allowing pictures or rich text editing. You can see it already on our new forums: http://moot.it/forum/ http://moot.it/forum/ The things are properly aligned and clutter is gone.
- lelandbatey 14y agoThough you're probably right that rich text editing does enable less meaningful discussion, I'm still sad that it's not a thing. I've always quite liked being able to write using, say, markdown.
- tipiirai 14y agoYou can do quoted- and syntax highlighted text. That's all. I'm sure someone sees this as a limitation but this is what is important for us.
- EvilTrout 14y agoDiscourse founder here. I tried their demo forum but it currently isn't responding. Probably too much load from HN although their home page claims they can handle 1k posts per second (trollface). From a cursory point of view, it seems to have more in common with Disqus than Discourse. It's embeddable, doesn't allow rich posts or markdown or our support for embedding videos, github, wikipedia, amazon, etc. It's also closed source, although it is free and they claim they'll never insert ads. I have no idea about their support for the other challenges we've faced such as infinite scrolling that is compatible with the back button. I am skeptical of redis as their only data store. We use redis too in Discourse but this would demand that all forum content can fit in memory at once, and there is a chance if a server crashes you'd lose so. Not to mention querying it is much more difficult especially when filtering. Either way, we're glad to have the competition!
- pn1000 14y agoWill you offer the ability to backup comments / forums in the future?
- kmfrk 14y agoProblems with log-in, and when I manage to log in, my posts get canned due to server problems. Any scoop on the problem? Is it traffic or something in the code?
- tipiirai 14y agoChecking this out...
- tipiirai 14y agoWe're not seeing anything unusual on the server side. Can you post your issue here: http://moot.it/issues/ http://moot.it/issues/ Please describe what steps you did to get the error. THANK YOU!
- kmfrk 14y agoI would, but the reports bug out, when I try to send them. :P
- courtneycouch0 14y agoI suspect it's a websocket upgrade issue that you must be having. Please email support@moot.it if you can with details! This is the first public availability for moot so it's not too unexpected to have a few bumps.
- Irregardless 14y agoInteresting to see the creator of 4chan working on a more conventional forum platform...
- courtneycouch0 14y agoMr. Poole has no relation to this.
- jlgreco 14y agoAnd has in fact, according to wikipedia anyway, sent them a C&D.
- Irregardless 14y agoThen that makes your choice of name very interesting, because the conventional meaning of 'moot' is 'irrelevant' (unless you're British). Something seems fishy here.
- kmfrk 14y agoIrregardless. :P (Not that I don't agree with you.)
- kmfrk 14y agoThat's absurd. Why the name, then? Just as I got my hopes up.
- zacharyz 14y ago