3 ms·

I have some security concerns. Consider the HN mod. You can try to log in there... http://hnews.tomodo.me/newslogin?whence=news http://hnews.tomodo.me/newslogi

I have some security concerns. Consider the HN mod. You can try to log in there... http://hnews.tomodo.me/newslogin?whence=news http://hnews.tomodo.me/newslogin?whence=news That form does post but not to HN.

odedgolan 13y ago
You are right, it posts to the proxy, not to news.ycombinator.com but this is how it works, it's a proxy. This reply was posted using the HN mod, so you can see the proxy then posts to HN server.
tekacs 13y ago
This is without doubt a reason for concern. To be fair to them, however, the security of this platform is comparable [1] to that of many users who are willing to download (and update) arbitrary Greasemonkey scripts and browser plugins to achieve the same thing without ever a glance at the source. For those of us who might perform such an inspection there is, of course, a difference. Their comment (from their FAQ page) is: > Can I trust modified sites with my private information? What about my logins and passwords? > We care about, and do a great deal to ensure our users’ privacy and security. You can trust our service in the same way you trust your emails with Gmail or files with Dropbox. Trust is at the essence of our platform. > If you write a Mod yourself, you can be 100% certain it is secured and your data is protected. > We constantly review Mods that have been created to make sure they are safe to use. If we have even the slightest doubt, the Mod is immediately suspended. In addition, in case of reported abuse, the Mod in question is immediately removed. [1]: With rather some counterpoints and nuances of course, from lack of SSL cert identity (hell they don't even have HTTPS) to potential compromise of Tomodo's servers at any time. Edit: Also, supposedly, code sharing and review features are on the way - with the caveat of still having to place some trust in Tomodo, this might allow for more transparency. Similarly, given the nature of the mods, it might even be possible to throw up one's own self-hosted server/service to use Tomodo mods. Should be fun to find out. :)

odedgolan 13y ago

You are right, it posts to the proxy, not to news.ycombinator.com but this is how it works, it's a proxy. This reply was posted using the HN mod, so you can see the proxy then posts to HN server.

tekacs 13y ago

This is without doubt a reason for concern. To be fair to them, however, the security of this platform is comparable [1] to that of many users who are willing to download (and update) arbitrary Greasemonkey scripts and browser plugins to achieve the same thing without ever a glance at the source. For those of us who might perform such an inspection there is, of course, a difference. Their comment (from their FAQ page) is: > Can I trust modified sites with my private information? What about my logins and passwords? > We care about, and do a great deal to ensure our users’ privacy and security. You can trust our service in the same way you trust your emails with Gmail or files with Dropbox. Trust is at the essence of our platform. > If you write a Mod yourself, you can be 100% certain it is secured and your data is protected. > We constantly review Mods that have been created to make sure they are safe to use. If we have even the slightest doubt, the Mod is immediately suspended. In addition, in case of reported abuse, the Mod in question is immediately removed. [1]: With rather some counterpoints and nuances of course, from lack of SSL cert identity (hell they don't even have HTTPS) to potential compromise of Tomodo's servers at any time. Edit: Also, supposedly, code sharing and review features are on the way - with the caveat of still having to place some trust in Tomodo, this might allow for more transparency. Similarly, given the nature of the mods, it might even be possible to throw up one's own self-hosted server/service to use Tomodo mods. Should be fun to find out. :)