4 ms·
Show HN: Koi.io
Koi is an open market for sketches and illustration by request.
- orf 13y agohttp://koi.io/p/-1 http://koi.io/p/-1 Nice. Stored XSS everywhere as well - this is 2013, why are sites still effected by BASIC security issues like this? I would never trust any of my details with a site as poorly coded as this, sorry.
- artursapek 13y agoOn my second pageview I was greeted with a big alert saying "this website is not very secure." Kind of ridiculous.
- prezjordan 13y agoLooks like someone went with a SQL injection [0] (right after I read this!) [0]: https://cloudup.com/cttFEZd2cL6 https://cloudup.com/cttFEZd2cL6
- artursapek 13y agoAaaand it's off the front page. It's actually inaccessible now, someone used XSS to redirect here whenever I open the home page. lol
- koi 13y agonot sure how that happened, its a cakephp site and I assumed the framework provided some protection against sql injection. its good its hacked now so I know to fix it
- orf 13y agoStop making websites and start reading about web app security, the OWASP top 10 is a good place to start.
- krapp 13y agoI assumed the framework provided some protection against sql injection. Some frameworks consider security out of the box to be beneath them. You should never assume you're secure even with a framework until you've gone combing through the docs and found where the security is, if it's anywhere, and if it's not anywhere because they spent all their effort on making it look and act like Ruby on Rails, how to get it.
- philsnow 13y agoI'd really like to see the briefest synopsis of what your project does in the post title. Especially on mobile it's a bit of a pain to click through just to see what the site is. That is, unless you just prefer being coy.
- deleted 13y ago[deleted]
- holoiii 13y agoOr do you mean.. koi?
- RyanZAG 13y agoI'm not a lawyer - can the sketches on the site be taken and used in commercial projects if you commission them? If someone else has?
- koi 13y agoits an RF license so they can, a RM license is exclusive
- itakee 13y agoIf you had an iPhone/Andriod app where you can take a picture of your sketch and upload it automatically, that would be awesome.
- munchor 13y ago>Request an sketch >Post a sketch Shouldn't it be "a sketch" on the first sentence too? To be honest, it hurts when I read it, but that might be just my OCD. Also, is there anything preventing people from getting the sketch without paying its author? Perhaps you could give people only a thumbnail of the image and only if they pay the author, can they see the full original size image. On another note, I really like how you explain the purpose of the website on the top header without many words.
- 5vforest 13y agoholy shit, i've been waiting for this for years. couldn't believe it never existed before.
- wallawe 13y agoMy two cents: You should add cursor: pointer; (and potentially a hover color or underline) to the large-7 class so that it's evident those are clickable links.
- deleted 13y ago[deleted]
- corydominguez 13y agoI really like this idea and I appreciate that the terms of service should be written in lawyerese but I would like a more plainspoken explanation about how the licensing works. It would give me a lot more confidence if I were a person who wanted to use one of these pictures for commercial purposes. I would also like the option of requesting a liberal creative commons license. I would love to be able to commission drawings that everyone could use.
- andrewljohnson 13y ago0) I might use this, but not as is. 1) Do you see this as a direct competitor to Crowdflower and and 99Designs, sort of an MVP? How can you contrast your approach? 2) I'd say your terms of use are very problematic: http://koi.io/terms http://koi.io/terms. It seems like you claim the right to use any of the generated content. So if I get someone to draw something for a project for a client, my client might see his unique art show up somewhere else? 3) Who is the intended user? Is it reasonable to use these illustrations for anything commercial? 4) The javascript links in your Terms don't work in my Chrome browser. The Privacy Policy link doesn't work (shudder to think what the privacy policy says). 5) I think I would have seeded this with more jobs.
- aw3c2 13y agoI gave up finding the part of your ToU where I can see what rights I have on commisioned work (if I request an image).
- ghayes 13y agoThe website is currently broken from hosting unsafe JavaScript directing back to this story. That's not a very friendly greeting from HackerNews. :-\ [1]view-source:http://koi.io/briefs/view/or-1-1 http://koi.io/briefs/view/or-1-1 [2]http://koi.io/briefs/view/or-1-1 http://koi.io/briefs/view/or-1-1
- koi 13y agoits good its hacked now so I know to fix it
- feniv 13y agoOn a positive note, the front-end design is pretty good. I like the sketch on the header; it explains the concept pretty succinctly. Most of the page is responsive, but the menu isn't visible on small windows. Other than that, just fix your security issues (sanitize all inputs server-side) and you should be good to go. Good luck!