9 ms·

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full secu

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web https://github.com/kyledrake/neocities-web Pull requests welcome!

mattl 13y ago
Can you put up a license for it?
slg 13y ago
Good to see. This is the way to respond to these type of mistakes, be completely transparent. Now if only the NSA subscribed to the same plan... And since it wasn't directed toward me, I guess we all can forget my little rant regarding the "trashing" comment.
egeozcan 13y ago
Hey, I'll try to hunt this down for you but just to give you a heads up, the server gives me a 500 internal server error when I use characters like "ğ" or "ü".
csense 13y ago
Why did you choose Ruby as the language?
- thomasfl 13y ago
  I think it's a pure joy to read the ruby source. Allthough ruby is not fast, it's got some of the simplest most elegant frameworks out there. Sinatra is not much more than a router config file with some logic. Sequel is the simplest database orm and migration tool around. And slim makes very readable templates. All frameworks perfect for the first minimum viable product. If this site takes off, I would perhaps pay someone to rewrite some bottlenecks of it in java.
  - csense 13y ago
    > it's a pure joy to read the ruby source If you like it so much, here's a copy-paste from the project for your edification [1]: def new_tags=(tags_string) tags_string.gsub! /[^a-zA-Z0-9, ]/, '' tags = tags_string.split ',' tags.collect! {|c| (c.match(/^\w+\s\w+/) || c.match(/^\w+/)).to_s } @new_tag_strings = tags end I don't mean to pick on this project in particular. In fact, this project as a whole is quite possibly the cleanest Ruby code I've ever seen. That being said, Ruby's syntax makes me want to gouge my eyes out. There's equal signs, unquoted regular expressions, exclamation points, absolute value bars, and at signs all over the above code. You can't even sort-of follow what this code is doing without searching through the manual every third character. Ruby syntax is worse than C++ and almost as bad as Perl. Someone tried to explain Ruby syntax to me last week [2], and I'm not sure if I understood it more, or less, as a result, because my conclusion was that Ruby's syntax is so bad, the language shouldn't even be able to exist! I.e., there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible! [1] https://github.com/kyledrake/neocities-web/blob/933c3549264ee809c0e09f0af73cdd2f2236a63d/models/site.rb#L53 https://github.com/kyledrake/neocities-web/blob/933c3549264e... [2] https://news.ycombinator.com/item?id=5872899 https://news.ycombinator.com/item?id=5872899
    - dragonwriter 13y ago
      > equal signs I fail to see how using equal signs for assignment (or for defining assignment methods) is a problem with syntax, rather than an enhancement to clarity. > unquoted regular expressions What's wrong with that? Regexes are a different type than strings. Why should they look like strings? > exclamation points ...again, so, what? > absolute value bars vertical bars used to set off block argument lists aren't absolute value bars. (Neither are vertical bars used for logical-or.) > at signs Again, so? > You can't even sort-of follow what this code is doing without searching through the manual every third character. Yes, I can, and not just "sort-of follow" it. > Ruby syntax is worse than C++ and almost as bad as Perl. There's no accounting for taste, I suppose. > there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible As Ruby does exist, and is parsed, this is clearly not the case. That said, ruby's syntax is not optimized for machine parsing, its designed to be ruby-developer-friendly rather than ruby-parser-developer-friendly. If you want something optimized for the developer of the language's parser, look to Lisp.
- kyledrake 13y ago
  It's what I know. And very productive in general. Nginx and the kernel (sendfile) does all the heavy lifting of serving the static files.
catshirt 13y ago
great response. the bug's existence alone made me question the project intent and viability. even though i probably won't read your code, just making the source available mitigated my biggest concerns.
fragsworth 13y ago
I don't think it's a smart idea to publish the source code to your site (especially while on the front page of Hacker News) until you've spent a significant amount of money on auditing the security internally to the point that others are comfortable with a public release. Now it looks like something happened, and you've got no site, and thousands of people trying to access it!
- contingencies 13y ago
  Disagree! Publishing is laudable. Paying customers might tip the scales otherwise, but apparently that's not yet an issue.
pak 13y ago
You are the man for doing this. If only others, including myself, were so brave for every web project that they attempt.
jancborchardt 13y ago
Do you have a logo already? I would really like to add NeoCities to http://libreprojects.net http://libreprojects.net
weland 13y ago
I can't believe what I just witnessed. Something expressing a valid concern in a somewhat uncivilized manner, the developer answering in a nice way, the original poster apologizing and the developer linking to the source code to quench other similar concerns. WHAT HAS THE INTERNET COME TO? Cheers to you, fine folks!

mattl 13y ago

Can you put up a license for it?

slg 13y ago

Good to see. This is the way to respond to these type of mistakes, be completely transparent. Now if only the NSA subscribed to the same plan... And since it wasn't directed toward me, I guess we all can forget my little rant regarding the "trashing" comment.

egeozcan 13y ago

Hey, I'll try to hunt this down for you but just to give you a heads up, the server gives me a 500 internal server error when I use characters like "ğ" or "ü".

csense 13y ago

Why did you choose Ruby as the language?

thomasfl 13y ago
I think it's a pure joy to read the ruby source. Allthough ruby is not fast, it's got some of the simplest most elegant frameworks out there. Sinatra is not much more than a router config file with some logic. Sequel is the simplest database orm and migration tool around. And slim makes very readable templates. All frameworks perfect for the first minimum viable product. If this site takes off, I would perhaps pay someone to rewrite some bottlenecks of it in java.
- csense 13y ago
  > it's a pure joy to read the ruby source If you like it so much, here's a copy-paste from the project for your edification [1]: def new_tags=(tags_string) tags_string.gsub! /[^a-zA-Z0-9, ]/, '' tags = tags_string.split ',' tags.collect! {|c| (c.match(/^\w+\s\w+/) || c.match(/^\w+/)).to_s } @new_tag_strings = tags end I don't mean to pick on this project in particular. In fact, this project as a whole is quite possibly the cleanest Ruby code I've ever seen. That being said, Ruby's syntax makes me want to gouge my eyes out. There's equal signs, unquoted regular expressions, exclamation points, absolute value bars, and at signs all over the above code. You can't even sort-of follow what this code is doing without searching through the manual every third character. Ruby syntax is worse than C++ and almost as bad as Perl. Someone tried to explain Ruby syntax to me last week [2], and I'm not sure if I understood it more, or less, as a result, because my conclusion was that Ruby's syntax is so bad, the language shouldn't even be able to exist! I.e., there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible! [1] https://github.com/kyledrake/neocities-web/blob/933c3549264ee809c0e09f0af73cdd2f2236a63d/models/site.rb#L53 https://github.com/kyledrake/neocities-web/blob/933c3549264e... [2] https://news.ycombinator.com/item?id=5872899 https://news.ycombinator.com/item?id=5872899
  - dragonwriter 13y ago
    > equal signs I fail to see how using equal signs for assignment (or for defining assignment methods) is a problem with syntax, rather than an enhancement to clarity. > unquoted regular expressions What's wrong with that? Regexes are a different type than strings. Why should they look like strings? > exclamation points ...again, so, what? > absolute value bars vertical bars used to set off block argument lists aren't absolute value bars. (Neither are vertical bars used for logical-or.) > at signs Again, so? > You can't even sort-of follow what this code is doing without searching through the manual every third character. Yes, I can, and not just "sort-of follow" it. > Ruby syntax is worse than C++ and almost as bad as Perl. There's no accounting for taste, I suppose. > there are a large number of syntactical ambiguities, so writing a parser for it should be completely impossible As Ruby does exist, and is parsed, this is clearly not the case. That said, ruby's syntax is not optimized for machine parsing, its designed to be ruby-developer-friendly rather than ruby-parser-developer-friendly. If you want something optimized for the developer of the language's parser, look to Lisp.
kyledrake 13y ago
It's what I know. And very productive in general. Nginx and the kernel (sendfile) does all the heavy lifting of serving the static files.

catshirt 13y ago

great response. the bug's existence alone made me question the project intent and viability. even though i probably won't read your code, just making the source available mitigated my biggest concerns.

fragsworth 13y ago

I don't think it's a smart idea to publish the source code to your site (especially while on the front page of Hacker News) until you've spent a significant amount of money on auditing the security internally to the point that others are comfortable with a public release. Now it looks like something happened, and you've got no site, and thousands of people trying to access it!

contingencies 13y ago
Disagree! Publishing is laudable. Paying customers might tip the scales otherwise, but apparently that's not yet an issue.

pak 13y ago

You are the man for doing this. If only others, including myself, were so brave for every web project that they attempt.

jancborchardt 13y ago

Do you have a logo already? I would really like to add NeoCities to http://libreprojects.net http://libreprojects.net

weland 13y ago

I can't believe what I just witnessed. Something expressing a valid concern in a somewhat uncivilized manner, the developer answering in a nice way, the original poster apologizing and the developer linking to the source code to quench other similar concerns. WHAT HAS THE INTERNET COME TO? Cheers to you, fine folks!