5 ms·
Show HN: CMS Server written in Go (alpha)
- wilsonfiifi 13y agoStill needs quite a bit more documentation, code comments, architecture revisions etc... your suggestions/comments/feedback are most welcome. cheers
- tuananh 13y agoI read the domain as 'By tengine'. Does it has anything to do with tengine web server?
- ConceitedCode 13y agoI read it as ByteEngine at first glance. Maybe it shares an E?
- wilsonfiifi 13y agoyes the e from byte & engine are fused :-)
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- shadowmint 13y agomongodb + redis instead of sql? ...because?
- wilsonfiifi 13y agoIMO Mongodb makes it easier to add and query file metadata and Redis is really just for session info.
- dualogy 13y agoDon't get it. You already have a Mongo, why also use Redis just for that? I mean your Mongo is in-memory too. Or do you anticipate a larger-than-RAM dataset for the MongoDB?
- wilsonfiifi 13y agoexpiring keys makes session timeout easier. also array access in mongodb isn't as versatile as with redis.
- hendzen 13y agoFYI: http://docs.mongodb.org/manual/tutorial/expire-data/ http://docs.mongodb.org/manual/tutorial/expire-data/
- wilsonfiifi 13y agoThanks for the link. I'm of the view though that redis offers better and more convenient implementation. cheers
- dualogy 13y agoInteresting, thanks!
- ExpiredLink 13y ago... because it's web scale.
- deleted 13y ago[deleted]
- 13y ago
- mappu 13y ago> Password must be composed of only alpha-numeric characters. Okay, why? This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something. It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that. Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.
- wilsonfiifi 13y ago:-) put me on the spot! thanks for going through the code though. security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
- mappu 13y agoNo problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords. Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
- ryalfalpha 13y agoHaven't done much golang and don't have it installed on this laptop, but are string comparisons constant time? If not, I think there is potential for a timing attack here? if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }
- omra 13y agoGo does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
- 13y ago
- xSwag 13y agoWeird headers The main page is active in the browser but the header says 404 Not Found, maybe it's a bug? ~$ curl -IL http://www.bytengine.com/ HTTP/1.1 404 Not Found Server: nginx/1.1.19 ~$ curl -IL http://www.bytengine.com/should_404 HTTP/1.1 404 Not Found Server: nginx/1.1.19
- wilsonfiifi 13y agomust probably be an issue with my nginx config and the proxying. will have a look at it. thanks
- xSwag 13y agoYeah, just thought I'd point it out because it will cause issues with spiders.
- wilsonfiifi 13y agoactually nginx config is fine. I wasn't properly using "github.com/gorilla/mux". Sorting it out now. cheers
- the1 13y agowhat's wrong with webdav?
- wilsonfiifi 13y agocan you elaborate further
- klibertp 13y agoI think that all that's wrong with alternatives to this kind of projects is that they are not written by the author. It's ok actually, many people and many great technologies started as pet projects; it just means that asking questions like this makes no sense :)
- reedlaw 13y agoI'm having trouble understanding the motivation or use case. The documentation gives examples of logging in, creating filesystem-like structures, and uploading files. How is this an improvement upon a regular filesystem and scp/sftp? I do like the web console though.
- dualogy 13y agoWell, from the docs: -- Therefore, instead of dealing with key-values, objects ids and primary keys, you can access your data using file paths just as you would with a regular file system. Bytengine’s file system is modelled on the linux file system where you have a root directory ‘/’ and file paths separated by a forward slash ‘/’. Bytengine stores your content in Files that can further be organised in Directories. -- So there you have it! Wait...
- wilsonfiifi 13y agoAppart from being able to access your content as you would a regular file system, you can also query and modify your content metadata. So you could upload pictures, tag them in JSON and later run live queries based on the tags from your client app (to sort them based on location for example). I'll be adding more/better docs in the coming days. cheers
- ams6110 13y agoHow is this an improvement upon a regular filesystem and scp/sftp scp/sftp is great, but if you've ever had to deal with large numbers of users trying to properly manage ssh key pairs you will know it's not an approach that will work at scale.
- garysweaver 13y agoneat. is this a bug? server.newuser line[1]: expected string in New User; got EOF
- wilsonfiifi 13y agoHi! please run: 'help server.newuser' to check the syntax. cheers