Security Concerns Paramount After Early Reviews of Diaspora Code

Stoobalou writes with this excerpt from Thinq.co.uk: "Following the release of the source code for the Diaspora social networking platform, hackers and tinkerers the world over have been poring over the code in order to improve, enhance, and otherwise help the project in its attempt to unsettle Facebook. Sadly, the current opinion is that the code just isn't up to scratch. While the team clearly stated that 'we know there are security holes and bugs' in the code that was released, it's possible that they weren't aware of just how many show-stopping issues there are — issues which make it hard to recommend that you roll your own Diaspora server just yet."

Comments

Re:Freetard fail

[Anonymous Coward]

You're wrong. I'm 99% confident that 2011 will be the year of Diaspora on the desktop.

This isn't necessarily a bad thing

[iONiUM]

It might encourage the workers on Diaspora code to work harder for security. I mean, even if you think you have every security hole plugged, until you open that code up to the world you won't really know. So what, there are many more security bugs than expected. That's fine, delay the release a little bit and start patching.

Unless this completely discourages them to the point that they turn emo and start lying in the dark crying, I'm pretty sure they can fix this and still release.

Re:This isn't necessarily a bad thing

[Disgruntled Goats]

Is anyone actually surprised that a bunch of Ruby developers can't write secure code? Besides, the performance is probably going to be as shitty as Ruby on Snails as well.

Re:This isn't necessarily a bad thing

[Anonymous Coward]

I believe this is an end to Diaspora. If the programmers don't have good security education, they will never be able to grasp the whole concept of vulnerabilities on the internet and the system will be always vulnerable. This will end up the same as phpBB2 with a lot of it's holes. Now phpBB3 is completely rewritten and pretty secure but it will never lose it's reputation of bad security software because of phpBB2.

Re:This isn't necessarily a bad thing

[TheRaven64]

Is anyone actually surprised that a bunch of Ruby developers can't write secure code?

No, but then I wouldn't be surprised if you substituted Python, Perl, Java, or C for Ruby in that statement. The proportion of programmers who can write secure code is a relatively small proportion of the number that can write code in any language.

That's one of the reasons why, as I said in the last story, I am more interested in the protocols than in the implementation. A set of standard protocols for social networking (ideally built on top of XMPP) would allow lots of different implementations, which would reduce the damage that could be done by a flaw in one of them.

Re:This isn't necessarily a bad thing

[Anonymous Coward]

So what, there are many more security bugs than expected. That's fine, delay the release a little bit and start patching.

That's not necessarily fine depending on how deep the bugs run. Security isn't something you just patch in at the last moment. They should be thinking about from the start, especially since privacy is supposed to be one of the core principles of the project. Proper security is obviously a prerequisite to protecting user privacy.

Re:This isn't necessarily a bad thing

[MaWeiTao]

Like everyone else, they're never going to be able to completely address security. I suppose the goal should be to eliminate any glaring flaws and stay on top of things for as long as the platform is being used. But people are going to always reveal flaws as quickly as they can be patched. Being open-source doesn't provide any inherent level of security simply because anyone has access to the code.

If anything, it's only a matter of time before we see a fork. Someone is going to decide they can do without certain features for the sake of security. Or someone else doesn't something else works and decides they'll do things differently. But once the base starts fragmenting I'm fairly certain Diaspora is doomed and will never be able to unseat Facebook.

In principle it's a great thing that someone is working on this. But I also think it's been over-hyped, especially since nobody has even interacted with it much. I think they've got the underdog factor going for them. Maybe it will end up being a success, but at this point I have my doubts.

Re:This isn't necessarily a bad thing

[gilesjuk]

These aren't small holes, these are major show stoppers. It's currently possible for anyone using the site to do anything they like to someone else's profile.

If you're designing a portal you need to design it to be secure. Otherwise when you start reworking the code to secure it the code gets messy.

It sounds like they've been designing this thing as they go along, not the best way really.

Re:This isn't necessarily a bad thing

[Tassach]

No, but then I wouldn't be surprised if you substituted Python, Perl, Java, or C for Ruby in that statement. The proportion of programmers who can write secure code is a relatively small proportion of the number that can write code in any language.

A great big helping of THIS. It is insanely difficult to write really secure code in any language. (Although it's harder in some than in others).

Look at Postfix -- it was designed and written specifically with security in mind by one of the world's foremost experts on TCP/IP security, and it STILL has had security bugs. If a hacker god like Wietse Venema has security bugs in his code, what chance do mere mortals like us have of writing secure code?

This is something that has to be tackled on multiple levels -- in library code, at the compiler, at the operating system, and even in the language itself. Modern languages have garbage collection that prevents (most) memory leak issues; we need a similar language-level mechanism to address common security issues. Perl's taint mode is a definite step in the right direction, but there needs to be more research done on language-level security features.

Likewise, we have static and dynamic code checkers that highlight problematic code; while there are some for security, we need more/better tools in this area, and more importantly we need to teach young programmers to actually USE them, or better yet build them into the compiler so you HAVE to use them.

Re:This isn't necessarily a bad thing

[Americano]

It might encourage the people working on the code to work harder - or it might mean they run out of money, energy, and interest and Diaspora becomes another piece of abandoned FOSS code.

If there are so many glaring security holes from the start, it sounds to me like they have accomplished nothing but a basic mockup. How long can they delay the release while they refactor & rewrite? While they implement the many features they haven't completed? While they do thorough security testing, which will possibly uncover *design* flaws in the security, not just "oops I didn't check array bounds here," which could mean that they have to rewrite & redesign entire sections of the application.

How much longer will the money they raised continue to fund their development?

Re:This isn't necessarily a bad thing

[anyGould]

Well, considering they released it saying "Yeah, there are a mess of bugs and security holes here"... I suspect the point *was* to flush them out. The releases I read were pretty clear that this code wasn't remotely ready for production, and that they knew it. If I'm going to poke them for anything, it's that they had promised something by the end of the summer. But that's just over-optimistic young folks.

Re:This isn't necessarily a bad thing

[Anonymous Coward]

You must be new around here. The OP was clearly just trying to start a flame war about Ruby (probably due to language envy, which is just plain silly) and you go and post a perfectly reasonable counterargument.

Re:This isn't necessarily a bad thing

[Bill, Shooter of Bul]

I I've already said it a billion times by now, but if the first implementation sucks, then there won't be a second.

Re:This isn't necessarily a bad thing

[bberens]

Where I work it's more like, "If the first implementation sucks, then the second implementation made by the exact same team will suck equally. As will the third."

Re:This isn't necessarily a bad thing

[seandiggity]

You might be interested in Apache Shindig.

Re:This isn't necessarily a bad thing

[History's Coming To]

More to the point, they're releasing the code and having it criticised by an enormous community. Of course we'll find faults, because the Diaspora team aren't perfect. Thing is, large commercial houses aren't perfect either, and they still roll imperfect software into a incomprehensible binary and release it to a public who will use it because it costs money, and is therefore perfect. See, for example, the fucktards at Facebook.

The Diaspora fucktards, on the other hand, are releasing the code to criticism. The code has now been criticised. Anyone running it has been warned. The next version will sink or swim depending on current criticism. This is a good thing.

(Please note, I'm only referring to the Diaspora bods as fucktards because they deserve to start at Facebook's level if we're going to compare things)

Re:Freetard fail

[Anonymous Coward]

Yeah, but it will be like email is now. People won't need to run their own servers. They will be able to pick from a variety of free diaspora hosts who get their revenue from ad dollars and harvesting your data (and that of your friends, who might host their own diaspora node at home, or on another service), and then we will be free of facebook's horrible privacy violations, and be in a new universe of less accountable companies with even worse problems.

I can't wait, diaspora, here I come!

After how long?

[Sarten-X]

After a few months, a big project has bugs? Really? That's amazing! After all, Windows has been around for only 20 years and it's perfect, right?

I think I'll reserve judgment for sometime in 2012...

Re:After how long?

[Anonymous Coward]

After a few months, a big project written by a bunch of students with no real-world big project experience has numerous showstopper bugs? Really? That's amazing!

Improved that for you.

Re:After how long?

[Kjella]

The time when you did security by making sure you've dotted all the i's and crossed all the t's should be long over. Anything built now should have some clear security layers that prevent input validation attacks, cross scripting attack, database injection attacks and so on. The application may be unfinished but most of those errors sounds like it'll be a steaming pile when it's done too.

Re:After how long?

[truthsearch]

It looks like they've only focused on the front end so far. I was expecting an architectural prototype with a thin front end (in which case security should be baked in from the start). Instead they've only focused on the user interface, which pretty much makes this project pointless so far.

Re:After how long?

[EggyToast]

Yeah, they've only focused on the "fun stuff." Or rather, it sounds more like their purpose was "Facebook's so annoying to use. Let's make one that works like we want!" without really caring about the backend stuff. Maybe they assume that the "open source community" will do all the backend stuff for them -- even though they're the ones getting paid?

Re:After how long?

[ihatejobs]

Irrelevant. A bug is a bug, and can be fixed. So long as they actually fix the bugs instead of pushing out a release, they should do fine.

Re:After how long?

[Sarten-X]

Not if it's anything like every big project I've worked on.

First, projects go through a phase of "how can we do this" where various components are mashed together with the expectation that things will work later. That's a good thing to do while gathering initial funding.

Then they go through the phase of "we can do this" where some parts of the project work, but most is broken.

That's followed by the "demonstration" phase, where things work under perfect circumstances. That seems to be where Diaspora is at now.

Next is the "we can do this well" phase, where the once-connected components are split up and divided into their appropriate layers and security is locked down, now that there's a clear idea of what the security model must support.

Finally is the "continued development" phase, where the project is stable enough that new components don't need major changes to security, and extra features can be added.

I've had a few projects that started with the frameworks and various layers of abstraction, and they've invariably failed after many refactorings and revisions. Heck, one project I worked on was a web-based game engine, which turned into a giant security model, and finally died without a single line of actual game code written. It took eight months to fail miserably. Projects change, and requirements change. Going into a security model too early can be worse than not having one.

Re:After how long?

[Anonymous Coward]

So many rookie Security bugs in pre-Alpha software mean something very significant for the project

Re:After how long?

[randomencounter]

Don't diss the interface.

The open source landscape is littered with elegant backends with totally unusable interfaces, a good interface is not a trivial exercise.

They did a solid start on the part that they had talent and interest for, then went to the community. I'd say that they are doing it right.

Re:After how long?

[Posting=!Working]

Yeah, students with no real-world big project experience should all just get jobs with large companies and stop trying to be innovative until they've spent a few years updating comments and doing bugfixes in other people's code.

After all, no one has ever gotten ahead in computers by jumping into a huge project they had no experience in while they were young. They need to wait until they're in their 40's so they have enough experience and then start a small project.

Security problems in pre-Alpha code? The whole project is obviously a failure and should be abandoned. What idiots they are for trying!

Re:After how long?

[Anonymous Coward]

GP was in no way intended to imply that it should be abandoned, merely that it should come as absolutely no shock to anyone that something big and complex, executed by amateurs, when released as a pre-alpha, would contain not only a few bugs, but numerous showstopper security flaws.

Personally, I would expect it to be a gigantic mess— but a fixable one. This is a learning process, and I hope those involved keep at it.

Re:After how long?

[Rival]

Yeah, they've only focused on the "fun stuff." Or rather, it sounds more like their purpose was "Facebook's so annoying to use. Let's make one that works like we want!" without really caring about the backend stuff. Maybe they assume that the "open source community" will do all the backend stuff for them -- even though they're the ones getting paid?

Or possibly, that they are smart enough to recognize that having "something" to show possible investors (and more importantly, current investors) is worth a great deal more than a framework that can't be demonstrated.

Don't get me wrong -- I really, *really* hope that the security model gets implemented well in Diaspora, and they don't get destracted by "ooh, shiny!" syndrome. But expecting them to go to folks who have given them money -- people who likely know even less about security than these college students -- and say, "This mystery code will work, it's really better, we just can't demonstrate it," is unreasonable.

Prototype first, then refine. Bugs happen, just fix them and move on. It looks like they're on their way to me. If you (or others) think you can fix these bugs or fundamental flaws in their security model, talk to them. You might just find yourself a job at a potentially big startup.

Re:After how long?

[16K Ram Pack]

On the other hand, getting people seeing features that they might be interested keeps some buzz going about it. No-one gets excited about security, they expect security.

Re:After how long?

[BJ_Covert_Action]

Instead they've only focused on the user interface, which pretty much makes this project pointless so far.

Unless, of course, one of their primary goals is to attract more users, in which case a well developed, well tested UI is probably one of the most important parts of the project. After all, 90% of social networkers (number out of my ass) probably judge software based on "How easy is it to click what I want?"

Now that doesn't mean they should neglect the back-end code, however, if they are trying to raise awareness of their product and make it more attractive, then I would think having a nicely developed UI and screenies would be pretty important right from the get go. While people find flaws in their UI, they can start to hash out the back end code.

Re:After how long?

[danny_lehman]

Perhaps they put some effort into the GUI to establish a brand image of sorts before the Open Source Community got their hands on it, wouldn't you? They got Paid because they had the initiative to start it, that's how it works.Also, the amount they got paid is kind of representative of the amount of demand out there for an alternative to Facebook - So

"Facebook's so annoying to use. Let's make one that works like we ALL want!"

FTFY...

They announced they would release a semi-working version's code, and that's exactly what they did. Their "mission statement" has a large emphasis on security so i sincerely doubt they will allow another major release with a "Patched" backend. The open source community Is large enough and kind enough to contribute where they may have fallen short. If you want to get paid for helping, you may want to go start your own.

Re:After how long?

[TheRaven64]

Bugs are not all the same. Sometimes, a bug is just doing something wrong in the local scope and can be fixed trivially. Sometimes, a bug is an artefact of a design flaw and can only be addressed by a significant redesign of the system.

Re:After how long?

[ihatejobs]

That is true, but looking through their github repo the issues don't appear to be significant enough to require a major redesign. I think they got pretty damn close to what they needed. All they have to do now is do a little spit shine and polish things up, correct security flaws, etc. I mean one of the more significant issues listed in the article was that you can inject HTML into comments. As big of a security hole as that is, its not terribly difficult to fix either.

Pre-alpha

[mseidl]

zomg! Pre-alpha! This thing is sure to be a failure!

Re:Pre-alpha

[AnonymousClown]

zomg! Pre-alpha! This thing is sure to be a failure!

I think it will - Facebook has the market locked up.

I may be wrong, and I usually am, but Dispora has no chance.

Re:Pre-alpha

[somersault]

I may be wrong, and I usually am, but Dispora has no chance.

If you usually are wrong, then it's probably that they have a chance here!

Facebook is the big player right now, but that doesn't mean it's going to be the leader forever. You can easily be a member of more than one social networking site at a time, and all it takes is for a site to come along with a cooler interface or set of features, a few people to move to it, their friends join too, then their friends, etc, and eventually everyone could end up on the new site and FB slowly dies. It's already happened with MySpace-->Facebook, hasn't it?

Re:Pre-alpha

[WalkingBear]

Yeah, we used to call this level of code a functional prototype. Build the features that let you test you concepts and ideas. Get as many eyeballs on it as possible. Not all of the defects, holes, changes, bugs, etc.

Now take that information, go back to a blank slate, and start coding towards a v1.0 release.

What I've seen of the Diaspora code, and what I've seen others post about it tells me this is definitely in the prototype / conceptual release phase. It's called a Pre-Alpha for a reason.

And that was to be expected

[e065c8515d206cb0e190]

Seriously, a bunch of kids from NYU... what did you expect?

It's not a bad thing though, as long as people are willing to constructively collaborate on the project.

Re:And that was to be expected

[MoonBuggy]

Is that a jab at NYU or a jab at college kids in general?

Re:And that was to be expected

[DJRumpy]

Am I missing something here? This is the way it should work, and the true strength of open source. Assuming they have the skillset to address the security issues found, I just don't see an issue. This isn't release level software yet, and I would expect that anyone putting up such a site based on it would publish that fact. I'm pleased that they are getting such great input on key security flaws.

Re:And that was to be expected

[e065c8515d206cb0e190]

Maybe it wasn't a jab at all?

Re:And that was to be expected

[yincrash]

I think the implication is that a few kids still in school don't have the skill set to address those issues, let alone write quality code yet.

Re:And that was to be expected

[poetmatt]

I think people forget that it's open source, so it's easily modified.

Able to code, and spot a vulnerability? Fix it yourself!

Re:And that was to be expected

[suomynonAyletamitlU]

Most college-level kids don't have experience coding a secure, distributed social networking site from scratch, and wouldn't be aware of all the potential snafus and pitfalls. In fact it's likely that they haven't written ANY software that is going to have enough traffic that security becomes a critical issue, and I doubt any college courses would focus on that in particular.

I don't see how that could possibly be considered a jab at anyone.

Re:And that was to be expected

[yincrash]

Just because software is open source does not mean it is easily modified. In many cases, it could be easier to rewrite it from scratch to do the same thing than to modify existing code that is terrible.

Re:And that was to be expected

[gparent]

It's not a jab at all. It's perfectly normal for inexperienced coders to have security issues in their applications, just like you can have any other bug.

Re:And that was to be expected

[Anonymous Coward]

Most college-level kids don't have experience coding a secure, distributed social networking site from scratch

Wasn't that how Facebook started?

Re:And that was to be expected

[GreatBunzinni]

Seriously, a bunch of kids from NYU... what did you expect?

I don't know. What do you expect from a 21-year old kid from University of Helsinki? Personally I don't believe anyone expects much from it but nowadays you have the entire IT world being carried by a pet project made by a little Finnish kid from University of Helsinki.

Is this also the case? I don't know, really. Yet, I hope it is.

Re:And that was to be expected

[idontgno]

FWIW, my take-aways on this topic are:

• Never install the "dot-zero" version of ANYTHING for production
• The devs are young. That means energetic and possibly well-intentioned, but inexperienced. If this works out, the OS community will be enriched by skilled and savvy devs who have seen the elephant and have the scars to prove it.

After all, "good judgment comes from experience, and experience comes from bad judgment."

Re:And that was to be expected

[coldfarnorth]

They have been admitted to the school of practical experience with a great idea, but less practical experience than you would prefer. We have two choices: 1) Tell them "You suck", and throw them out on their asses. -or- 2) Teach them the skill sets they need. Choose wisely.

Re:And that was to be expected

[poetmatt]

and? They could fork it.

Re:And that was to be expected

[coldfarnorth]

They have been admitted to the school of practical experience with a great idea, but less practical experience than you would prefer. We have two choices: 1) Tell them "You suck", throw them out on their asses, and consign their idea to the scrap heap -or- 2) Start to teach them the skill sets they need, and try to realize some of the promise of their idea. Choose wisely.

Re:And that was to be expected

[Lunix Nutcase]

I think people forget that it's open source, so it's easily modified.

It's "easy to modify" but not "easy to modify" and make sure that you don't break other things or introduce bugs. That is unless all the open source software you deal with is extremely trivial in nature.

Able to code, and spot a vulnerability? Fix it yourself!

Because all users are programmers, right?

Re:And that was to be expected

[Archangel Michael]

And your point is??

Learning is part of the experience we all share. Nobody learns to write perfect code, with no security holes in it, from the beginning.

The biggest problem with experience is that we tend to forget where we came from, and the big errors we've made in years past, or worse, we don't even know of the big errors we had early on, because we don't use that code any longer so the holes were never plugged.

Who here thinks that High School Standout can play professional Baseball right away? You don't tell that standout they "suck", and that they "make fundamental errors" and discourage them so they quit. A good coach takes what is good, and works on it to improve weaknesses .

Re:And that was to be expected

[coldfarnorth]

Bloody double-posters!

These idiots can't manage to read the simplest of instructions. I'm going to track down this idiot in meatspace and give him a piece of my mind!

Oh wait . . .

Re:And that was to be expected

[Anonymous Coward]

Most college-level kids don't have experience coding a secure, distributed social networking site from scratch

Wasn't that how Facebook started?

And your point is?

Re:And that was to be expected

[WinterSolstice]

Exactly true. Experience is something you don't get until AFTER you need it.

I have checked out the Alpha, even though I am not a fan of facebook or social networking. It's always worth playing with new OSS stuff, because you never know where the next really good project (or even really good idea) will come from. It takes a lot of "almost good" attempts to make one that is good.

Re:And that was to be expected

[insertwackynamehere]

As a kid at NYU doing compsci who knew these guys (not well but we had classes together), I can say that at my internship is where I learned what it was truly like coding outside of small scale and you do learn a lot about things you would not have otherwise accounted for.

Re:And that was to be expected

[drooling-dog]

You have to wonder where Linux would be today if Torvalds had tried to commercialize it instead of releasing it into the wild at such an early stage of development....

Re:And that was to be expected

[iamhassi]

"Seriously, a bunch of kids from NYU... what did you expect?"

I would expect better from a bunch of "kids" that were given $200,000 to make the site. I think most of /. could have done a better job if we were given $200,000.

Re:And that was to be expected

[Anonymous Coward]

I believe that we can look at Minix as an indicator of where Linux would be today if Torvalds tried to make it proprietary instead of releasing it to the public. What's Minix? Exactly.

Re:And that was to be expected

[luis_a_espinal]

Most college-level kids don't have experience coding a secure, distributed social networking site from scratch

Wasn't that how Facebook started?

It started like that, but with limited scope (only among students in the same university). Once it got momentum and decided to expand, they raised capital and got a bunch of experienced full-time programmers that *gasp* do that for a living, and on payroll. Diaspora OTH started as a school project (just like Facebook), but aimed at going global right from the start, without capital and without having a full-time, on payroll staff accountable for it.

Don't take that as a jab to Diaspora or projects that are 1) initiated by college kids, and 2) that are not meant to have people on payroll. But the dynamics of development and accountability are different (with their own pros, cons and challenges.) Can't compare one with the other dude.

Re:And that was to be expected

[severoon]

It's too bad there's so many problems with this project...I was really looking forward to a good alternative to Facebook.

If only there was some kind of development methodology where these issues could be discovered early on and addressed by those that do have the necessary experience...alas, I forget myself—such a thing is and shall forever remain unattainable fantasy.

I guess we should just be glad they published the source code so the facts are out and we can all agree: the only path forward is to toss the whole idea.

Re:And that was to be expected

[Subm]

I don't know. What do you expect from a 21-year old kid from University of Helsinki? Personally I don't believe anyone expects much from it but nowadays you have the entire IT world being carried by a pet project made by a little Finnish kid from University of Helsinki.

Is this also the case? I don't know, really. Yet, I hope it is.

You know, there was a bit of code there before Linus started. Linus's pet project was one of many many people's pet projects.

Sometimes I question calling the operating system GNU/Linux, but when people imply Linus wrote the entire OS, I see why people press for the recognition to everyone who contributed all the free code.

Re:And that was to be expected

[linzeal]

I highly doubt that you could hire 2 competent programmers for 200k, let alone release a prototype in less than 6 months.

Re:And that was to be expected

[david_thornley]

And suddenly there's thirty-seven kinds of Diaspora servers, all incompatible. Or, even if they are compatible, so many as to confuse any potential consumer.

Re:And that was to be expected

[clong83]

Did Tannenbaum (sp?) really try to make it proprietary? I thought he just wasn't all that interested in being involved in a large community-style project, it was more of just a pet-project/teaching tool for his college classes. Someone here will undoubtedly correct my Linux history if I'm wrong...

Re:And that was to be expected

[vux984]

I highly doubt that you could hire 2 competent programmers for 200k, let alone release a prototype in less than 6 months.

I'm betting you just insulted a lot of very competent programmers out there.

Re:And that was to be expected

[phantomfive]

I don't know what other people feel like, but any time I've had code that I've told people, "we know there are security problems with this code" it means there are really, really, seriously bad security problems. It means the thing is riddled with security problems, you know they are in there, but the effort of fixing them is greater than the embarrassment of telling people that there are problems. It means there are probably fundamental issues with the system. And it's bad. Especially if it's among the first things they tell you.

Re:And that was to be expected

[Anonymous Coward]

I sincerely doubt that, as no decent programmer should be doing work for less than 50 bucks an hour. Which is around 100k a year before taxes. If you are getting paid less, it is either because of the industry you are in is surfeit with programmers or you are not specialized enough.

Re:And that was to be expected

[mr100percent]

It states very clearly that this is ALPHA code. It's a bit too soon to formulate opinions on if its useable, right?

Re:And that was to be expected

[severoon]

(To anyone that may have missed it, perhaps I should have included —coughcoughopensourcecough— at the end of that second paragraph.)

Re:And that was to be expected

[vux984]

I sincerely doubt that, as no decent programmer should be doing work for less than 50 bucks an hour. Which is around 100k a year before taxes.

Wow. I hate replying to AC's but this is just idiotic and arrogant...

http://www.worldsalaries.org/computerprogrammer.shtml
http://www.indeed.com/salary?q1=Programmer&l1=United+States
http://www.suite101.com/content/computer-programming-career-information-and-wage-expectations-a247160

All of these vary somewhat on what they report incomes to be but they all solidly put the vast majority of programmers short of 6 figure incomes. I'm more than confident that there are a LOT of competent programmers out there making making less than 100,000/year.

If you are getting paid less, it is either because of the industry you are in is surfeit with programmers or you are not specialized enough.

The vast majority of programmers make less. I'm sure some of them are incompetent. And some of them are inexperienced. But there are a lot of experienced competent programmers making less than 6 figures.

Re:And that was to be expected

[Anonymous Coward]

Did Tannenbaum (sp?) really try to make it proprietary? I thought he just wasn't all that interested in being involved in a large community-style project, it was more of just a pet-project/teaching tool for his college classes. Someone here will undoubtedly correct my Linux history if I'm wrong...

You're right, but the reason Linux took off was the community involvement. Minux's licensing and advocacy were structured in a manner that didn't appeal to the kinds of hackers that Linux attracted. Without the GPL, Linux would have been a great school project that failed to gain any further attention. Had Torvalds been lucky in attempting to commercialize it, it could perhaps have followed the same trajectory as BeOS, but Be had certain GUI aspects going for it.

Re:And that was to be expected

[iamhassi]

"I highly doubt that you could hire 2 competent programmers for 200k"

Hire? I was thinking a contract position, and yes given this is the internet and they could have hired someone from anywhere in the world (outsource to India?) I'm very sure they could have found 2 or more programmers to create a secure site for $200,000

Re:And that was to be expected

[Iskender]

Sometimes I question calling the operating system GNU/Linux, but when people imply Linus wrote the entire OS, I see why people press for the recognition to everyone who contributed all the free code.

No one mentioned him writing the entire thing. What he did though was put the things together into something that could be successful in the real world.

There's no way of knowing whether any of the other similar projects would have been successful. All we can know is that Linux was, and that it's huge today. You could think of it this way: the idealism and contributions of others would have been for naught if there had never been any success or adoption. For whatever reason Torvalds' project met with success, and because of that RMS and many others have actually managed to change the world.

Givable credit isn't about to run out, so let's give some to everyone: RMS has done awesome work on the rights part of it all (and early coding), whereas Torvalds successfully set popularization in motion. The millions of other coders who have contributed meant they have done something good too: in no way does it mean the "superstars" suck because they didn't (stupidly) do all of it themselves. They all did good work!

Re:And that was to be expected

[Lanteran]

Actually, it's PRE-alpha. Far too soon indeed. As for all of you people bitching about security, two words: full disclosure.

Re:And that was to be expected

[poetmatt]

apparently you didn't miss the "able to code", part, huh?

That didn't mean it applied to everyone. thanks for the troll!

Re:And that was to be expected

[Anonymous Coward]

if you dont like it, then dont contribute. Whatever it is, the code can be fixed, maybe pieces can be tossed, or eventually the whole thing is re-written, but your statements are a bit childish and junior. Unless you happen to be Mark Zuckerburg operating under a pseudonym, I am guessing you haven't taken on the task of spearheading something of this level and complexity. More likely, you work for someone else, get a paycheck and think you are a major risk taker because you bike to work.

Sorry to get so personal, but it is in response to your statement.

Hats off to these kids for taking this bold step and starting the project. Their code might not be perfect, but they gave a starting block for people to move forward. No one says you have to contribute...

Re:And that was to be expected

[severoon]

Yep, I definitely should have included the "coughcoughopensourcecoughcough" at the end of the second paragraph. Apparently at least one person missed it. :-)

My point was that it's completely stupid for someone to expect pre-alpha code released as part of an open source project to be bulletproof. I'd be surprised if even all the fundamentals were in place. The entire point of open source coding is to get your product out there early so you can get collaboration from those who know better.

Good thing it's free...

[metamechanical]

Okay, I have no horse in this race, as I only have a passing interest in online social networks (enough to read the article, but not enough to join one), so I am not very passionate about this news in one way or another, but...

Isn't that why it's called pre-Alpha software?? I mean, bugs happen. In open architectures, you fix them. If this were a closed software project, you wouldn't even know about them. If there were endemic, critical flaws inherent in their underlying assumptions going into this project, then that would be news, but "oversold Alpha software contains bugs!!!" is hardly worth noting. Being free software, many eyes will ensure that the Beta version is better, presumably.

Re:Good thing it's free...

[Lunix Nutcase]

If this were a closed software project, you wouldn't even know about them.

If this were true, no independent researchers would ever be able to find security holes in things like Windows or Adobe products. Having access to source code is a nicety but the vast majority of security holes aren't found staring at source code it's by poking around at the binary.

Re:Good thing it's free...

[AnonymousClown]

Okay, I have no horse in this race, as I only have a passing interest in online social networks (enough to read the article, but not enough to join one), so I am not very passionate about this news in one way or another, but...

Dude! Are you that paranoid about being labeled a "fanboy"?

Re:Good thing it's free...

[alen]

and by that time facebook will add some more features and get up to a billion registered users

Re:Good thing it's free...

[metamechanical]

Biases and accusations of bias run rampant on slashdot. So yes, I was trying to avoid just that. I've followed them mostly because I found their way of getting funding novel, and have been curious how it would pan out in the end.

Re:Good thing it's free...

[metamechanical]

That's a fantastic point. I should have been more specific - what I meant was the only reason security concerns and bugs are being found out in a pre-alpha is that it is open. It is exceedingly rare that a closed piece of software releases up a pre-alpha for general review (and hence, you wouldn't have ever even known about them). In more mature released closed software, though, you're right that my point holds no water.

Re:Good thing it's free...

[nine-times]

I think the point was that, if this were a closed project, no one would have acess to anything yet-- not the source, not the binary, nothing.

This was not intend to be a secure release or a complete release. This was the first release of an open source project, just to say "here, we have something, so let's get started.". If you expected to be rolling your own diaspora server right now, then you really didn't understand what was going on.

Re:Good thing it's free...

[shish]

This was not intend to be a secure release or a complete release

An empty project has no features, and the desired result is lots of features, so having half features at the half way point is expected; but an empty project has no security holes, and the desired result is no security holes, so if there is a hole at the half way point then something has gone wrong.

Re:Good thing it's free...

[Spansh]

The problem about this is that many of those types of flaws have been well known about and well publicised for many years now (and many high profile sites have had widely publicised exploits ecause of them).

However, there are now many standard practices which seasoned/experienced programmers/developers/system designers use to mitigate most of those issues (Hell, whilst I may have some issues with Ruby on Rails, with the current release I believe you'd have to explicitly allow unescaped HTML into your pages).

Anyone who has been developing any web applications for any decent length of time should be treating security (XSS, SQL Injection, Request Forgery etc) as a matter of principle, because it's much harder to retrofit security once you're finished. So that their source has so many holes in it does not bode well for any underlying protocol, they are not approaching the project with security in mind at all (and it may seem that they are not experienced enough yet to approach it so). This would be fine if it was just your average open source project, however it's not. They have been donated some $200,000 with which to develop it, and the benefit that could be gained from it is immeasurable. If the code they write is full of flaws, you can probably expect the protocol to have issues as well.

As has been suggested, the very first thing they should have done is come up with the protocol/data schema/api with which the sites would communicate . This would include allowing extensions/non base data as if there isn't a standard way of doing this then many of the various companies who run the servers will attempt to extend them (ala Microsoft) to get their own kind of vendor lock in (The best way would probably be something similar to the RSS v2.0 modules via namespaces, though I haven't spent too much time thinking about it).

Re:Good thing it's free...

[mwvdlee]

If I bring my car to the garage to have the tires changed, it starts with four tires and the desired result is four tires. If somewhere halfway it does not have four tires, has something gone wrong or were they just actively working on it.

If you tell me you've ever started a software project that DIDN'T have any security issues halfway, then you lie.

Re:Good thing it's free...

[Monchanger]

If you expected to be rolling your own diaspora server right now, then you really didn't understand what was going on

Exactly. Like much of the dumbed-down "news" we're subjected to, this is just a little more sensational nonsense.

Breaking news! Infants can't grasp quantum physics. Are they stupid? You decide!

The little coverage I've seen sticks strictly to usability ("aspects" and this very early revision of the UI) . If that's all they built, I wouldn't bother criticizing the more difficult areas of security, scalability and reliability (that's not to say one shouldn't report bugs). Since hearing of the project I've assumed that these problems may be something these kids are looking for others to pitch in. Releasing the code isn't a bad way to get other people to start working, and as we've seen that actually worked out well, significantly multiplying the number of contributors to the project.

Diaspora, done right, is not a weekend project. Doesn't help that these naysayers are too immature to seek positive reinforcement.

Re:Good thing it's free...

[nine-times]

The little coverage I've seen sticks strictly to usability ("aspects" and this very early revision of the UI) .

Personally, I don't even this it's fair to be too critical of usability at this point. From the Diaspora website:

Getting the source into the hands of developers is our first experiment in making a simple and functional tool for contextual sharing. Diaspora is in its infancy, but our initial ideas are there.

So this really is just an initial alpha release of an open source project. It's not really meant to be seen or dealt with by anyone who isn't involved in the development. It's like we're posting reviews of the first internal built of the next version of Microsoft Office and saying, "Well it's buggy and it's not ready for prime time. This throws the future of Office into doubt."

Like with all creative endeavors, you need to start somewhere. At this stage of development, you mostly just want something to start with, to capture the basic overarching ideas. By all means, be critical and make suggestions. Submit bug reports if you find a bug. It doesn't make sense, though, to say, "well this will never work because it's not release-quality right now!"

Re:Good thing it's free...

[shish]

If somewhere halfway it does not have four tires, has something gone wrong or were they just actively working on it.

While they're /actively/ working on it (ie, it's still on the developer's desktop), ok; but they don't go for a test drive while it still has three

If you tell me you've ever started a software project that DIDN'T have any security issues halfway, then you lie.

There have been issues in my local branches, and occasional bugs I didn't know about; but I've never committed any code to a repository where I knew it was broken (especially not with "eh, it's beta, it's ok to fix it later" as an excuse)

Re:Good thing it's free...

[Looshi]

Releasing the code isn't a bad way to get other people to start working, and as we've seen that actually worked out well, significantly multiplying the number of contributors to the project.

Exactly. "Release early, release often." Isn't that the open-source way?

Protocol, not code

[ath1901]

I'm more interested in the protocol than the code. If the protocol is vulnerable to attacks/fraud then it is a show stopper.

If the ruby-web-stuff-code contains bugs and security holes, I'll just write my own (read: wait for someone else to do it).

I couldn't find any relevant info about the protocol in TFA. Am I missing something?

Re:Protocol, not code

[truthsearch]

It doesn't look like they started out by documenting any new protocols (which is probably what I would have worked on first if this were my project). From the code it appears they've mostly focused on the user interface.

They also could leverage something like XMPP.

Re:Protocol, not code

[crf00]

This should hardly surprise anyone. In fact, I realized it early that what matters is the protocol not the code, but you can't offer privacy protection in a decentralized protocol. A centralized social network like Facebook can actually offer more privacy protection, because Facebook is the only party that holds your information.

Decentralization on the other hand, means broadcasting information to multiple parties, in this case your friends. A protocol can be designed to be P2P, but you cannot prevent any peer from choosing a provider to host data on behalf of themselves. Just like email, any corporation can make use of this protocol to host a user's social network. When this become the norm, and when you, who host your own social server, try to broadcast a status update to some friends on Facebook/MySpace, then bang! Now both Facebook and MySpace holds a copy of your status update.

I'm actually surprised that the Slashdot crowd is naive enough to expect a protocol to protect one's privacy. As far as I know, none of the protocol we have today holds any claim that it can protect user's privacy, including email, IP, IPv6, HTTP, Tor, XMPP, FOAF, and the semantic web. In fact, the newer protocols such as IPv6 and FOAF are in fact far more privacy invasive than any kind of web 2.0 services today. Sure, we have protocols that protects user's anonymity, but anonymity is different from privacy that anonymity hides the true identity of the user, but the anonymous user's activity is always public. Furthermore, communication protocols such as email and XMPP never guarantee any kind of privacy protection, and they even encourage users to find a provider instead of forcing them to host server themselves.

My point is, either Diaspora will be extremely successful in privacy protection but nobody uses it, or everyone will use Diaspora but it will have serious privacy loophole that can never be fixed.

I'm pretty sure that supporters of Diaspora will be very upset if this happens:
1. Social protocol forks out of Diaspora and becomes standard.
2. Facebook refuse to join. MS jumps in but provides sucky service.
3. Diaspora founders startup Sporazzora social hosting, earns big bucks, starts data mining.
4. Google jumps in as second mover and kill everyone else, now becomes top social network.
5. Facebook joins in too late, but still has enough users for data mining.
6. Data exchange chaos to communicate with friends located at Facebook, MySpace, and Hi5. Privacy settings getting out of control.
7. Evil MySpace discloses all users' data to public. Everyone yells but nobody cares. MySpace users continue to stay there, while Google users unfriending MySpace friends.

Many privacy issues are caused by people misunderstanding about the privacy features of various protocols (which is none). For example, it actually take people by surprise that the server will know the client's IP address for every TCP/IP connection established, and that HTTP is transfered in plain text and cached in various proxies.

But we geeks didn't correct user's misunderstanding, but instead even use it as our own arguments against corporations. We think that, sure, the protocols expose these problems, but we'll just use brute force to restrict how websites can make use of these data. Sure that there are a few responsible one who want to invent new protocols that can protect user privacy, such as the one who made free proxy pools that connect to Google through the shared proxy. But they failed and instead raised more privacy issues in the protocol.

Protocol designers usually aware of the privacy issues that might arise from using their protocol. However they usually keep quiet and do not warn users about the potential danger. This is reasonable since nobody likes to be blamed at, and everyone likes to see their product to s

Re:Protocol, not code

[Rogerborg]

It doesn't look like they started out by documenting any new protocols (which is probably what I would have worked on first if this were my project). From the code it appears they've mostly focused on the user interface.

Flashback to my game dev days: "Never mind if it works, make it spin!"

I guess they're not locked into a death march yet, but it's not a good start. "Pre-alpha" bollocks aside, you've either got a zero defect mentality, or you don't. Since nobody forced them to release in this state, it looks clear that they don't. The problem isn't the code, it's the coders.

Re:Protocol, not code

[Dragoniz3r]

You've heard of encryption, right? You make a lot of bold claims but I don't see any facts to back them up. Doesn't matter how many globs of data your provider is hosting, if they don't have the encryption keys to read them. Of course the challenge then becomes making sure that your friends have your decryption keys, and only your friends. Getting the keys to your friends is relatively easy. Making sure they don't share them with dataharvesters/other people is a little more complicated, and I don't know of a general solution to that problem, but that doesn't mean it's an impossible problem.

Re:Protocol, not code

[Sarten-X]

Maybe it's the $200,000 investment from the community that "forced them to release" whatever they could as soon as possible. Having something to show for that initial investment is likely to bring in more support. There are two kinds of projects: Those that need to show progress to get support, and Duke Nukem Forever.

Re:Protocol, not code

[Anonymous Coward]

Remind me never to let you near any projects I work on. A zero-defect mentality is one of the worst things you can possibly have.

Put simply, it means nothing gets done because everyone is too afraid to make a mistake or is too busy fiddling fixing bugs when there's the pressing issue of getting something out the door lest nobody get paid.

Diaspora marketing

[jdfox]

I don't understand why Diaspora has had saturation coverage in the mainstream press (and pretty heavy coverage here, for that matter) before it even went alpha, but identi.ca gets so little.

Re:Diaspora marketing

[Anonymous Coward]

You said it yourself: Diaspora marketing. Does identi.ca do any marketing?

Re:Diaspora marketing

[Anonymous Coward]

because identi.ca is grass roots, not astro-turf?

Re:Diaspora marketing

[GreatBunzinni]

If I'm not mistaken, identi.ca is a microblogging platform, not a full blown social networking platform. So, while Diaspora goes directly against the main area of investment where major multinational corporations are heavily dedicated, which has a profound impact on humanity's views on fundamental rights such as the right to privacy, identi.ca is designed to only offer a very specific and limited service which is currently seen as a novelty. To put it in other terms, while Facebook alone racks about 800 million dollars anually and myspace racks in around 400 million dollars annually, twitter only manages to get a comparatively meagre million or so.

So, it is quite natural that people pay much more attention to the next Facebook/myspace/whatever killer, which is currently where the big money is at.

Re:Diaspora marketing

[ihatejobs]

What is identi.ca?

I think that should answer your question.

Re:Diaspora marketing

[Anonymous Coward]

Once Diaspora gets all hammered into shape, I think it would be awesome to link the profiles amidst the two, for those who want it. Distributed microblogging and distributed social networks... IRC after it eats Manhattan!

Re:Diaspora marketing

[painandgreed]

I don't understand why Diaspora has had saturation coverage in the mainstream press (and pretty heavy coverage here, for that matter) before it even went alpha, but identi.ca gets so little.

Because a lot of people have their eyes on Diaspora for a variety of reasons. This is not just a test of Diaspora but also Kickstarter which is the fundraising site they used to get the money to make this project. They went on Kickstarter and proposed to write "Diaspora - the privacy aware, personally controlled, do-it-all distributed open source social network" if they got $10,000 worth of funds. Because Facebook privacy, or lack of it was in the news at the time, they ended up with just over $200,000 in funds from several thousand donators, some who donated more than $2000. The way Kickstarter works is if the level of funding is reached, then the money is with withdrawn and given to the people it was pledged to. If they had gotten the money and never even produced code, it would not only have been a disaster for Diaspora, but also Kickstarter. Now that code has actually be produced and it is open source, it bodes well not just for them but also Kickstarter and using the internet for fund your projects.

Then there is still the core goal of producing that Facebook replacement with privacy in mind. Lots of people want that if only to put pressure on Facebook to pay attention to their own privacy concerns.

Re:Freetard fail

[oldspewey]

a variety of free diaspora hosts who get their revenue from ad dollars and harvesting your data (and that of your friends ...

So this model is different from Facebook how exactly?

Why is there so much bad press at the moment.

[He who knows]

Many people are reporting that it doesnt do what they want and is missing lots of functions that it needs as well as all the security vulnerabilities. of course lots will be missing this is a very early release. If you want to judge it at least wait till the first consumer release in october.

Re:Why is there so much bad press at the moment.

[Lunix Nutcase]

It's being judged so harshly probably due to the all the hype about how it's going to be unseating Facebook, etc. If you are going to hype yourself that much any misstep is going to be hounded on mercilessly.

Re:Why is there so much bad press at the moment.

[Anonymous Coward]

I think it's being judged harshly because the bugs are naive, mostly covered by a not-so-advanced book like "19 deadly sins of software security".

Re:Why is there so much bad press at the moment.

[MonsterTrimble]

What worries me is that from the sounds of it that there is so much wrong that they will miss their deadline of the october launch if they do it right and address the show stoppers before release (Ubuntu-itis perhaps?) If they make the deadline and it sucks it will fail. If they miss the deadline by a couple months or more, the hype will be gone and Diaspora will be tossed aside.

I honestly hope they succeed. I use facebook and I like it, however the endless amount of drivel I see (and have to ignore) plus all the security changes and stuff means the clock is ticking on the site before the mass exodus begins. I have high hopes for Diaspora because it's open source and not centralized, and I hope it hits before the next awesome social networking site pops up and takes the glory.

Re:Freetard fail

[Pojut]

Something doesn't have to convince every user just to succeed. To me, Diaspora represents everything RIGHT with the FOSS community. Collaboration on software that, on its own, would never survive. However, with people working together on it, they can increase its usefulness (and increase their own skills, which by proxy would improve any future projects they worked on.) Diaspora is a grand experiment, one that I hope works out.

I fail to see how working with people dedicating their time and knowledge can be seen as a bad thing.

Horse before cart

[drewhk]

Again, a project that was way overhyped before any code became available.

Re:Horse before cart

[drewhk]

Of course cart before the horse. Whatever.

Re:Horse before cart

[CannonballHead]

hehe, yeah I hate it when the horse gets in front of my cart. :P :)

Re:Horse before cart

[painandgreed]

Again, a project that was way overhyped before any code became available.

Yes, because it is more than just an open source alternative. It is a test bed for crowdsourced project funding. They went on Kickstarter.com and asked for $10,000. They ended up with $200,000 instead. A good number of people with no interest in computers are watching this because if it fails, it would also be a failure for using the internet to raise funds for any project and stifle donations to other projects. If it succeeds, it increases the likelyhood that using sites like Kickstarter is a viable method of not only getting funds but also providing a place to donate funds to projects you support.

Re:Horse before cart

[drewhk]

Then it's even worse. This big hype means failure will be bigger, too.

I am really interested in this project, I am just afraid that this hype will backfire.

Re:Horse before cart

[painandgreed]

Well, now that they've actually produced code, it's going to be hard to call it a failure.

Specialized servers offering ad-free accounts

[tepples]

Unlike Facebook, the Diaspora network is planned to have more than one server operator. Some might offer ad-free accounts to subscribers. Others might be run by a company that offers ad-free accounts to its employees, a school that offers ad-free accounts to its students (echoing the original meaning of the word "facebook"), or a church or other non-profit club that offers ad-free accounts to its members.

Re:Specialized servers offering ad-free accounts

[oldspewey]

But as I understand it, an end user does not necessarily have control over where their information is routed/stored. So if there are a few rogue server managers out there acting the way FB does today (selling personal info as a source of revenue) then every member of the user base will (potentially) be affected.

Please correct me if I'm wrong, because I'd like to be wrong about this.

Re:Specialized servers offering ad-free accounts

[koiransuklaa]

All actual data like messages is (supposed to be) encrypted. So the rogue seed can see your network or parts of it but should not get anything else.

My understanding is from a quick glance, it would be awesome if the developers would document things a bit more and lay out the design and roadmaps properly.

Re:Specialized servers offering ad-free accounts

[Anonymous Coward]

This is nonsense. If my friend uses a server that harvests user data, my only choice is to un-friend him. There is no way the "rogue" server can allow my friend to see my pictures and messages I send him, but not see them itself. If the server can see these things, it can do whatever it wants with them.

I can tell my friend to use a server that doesn't do this, but he will respond that he doesn't want to pay money, and doesn't understand why I am not happy that he switched from facebook to diaspora.

Now if you are talking about "rogue" servers as servers that have no connection to me or to any of my friends, sure, they won't have access to any of my data. That isn't what is being discussed here though. The issue is the "free as in webmail" servers people keep talking about as the practical side of diaspora. It should be seen as "free as in facebook", not "free as in email", since that is much more to the point.

Re:Specialized servers offering ad-free accounts

[plazman30]

So this is going to be a network of server all sending messages back and forth? Wow! Fidonet is back!

Re:Specialized servers offering ad-free accounts

[Quantumplation]

It's called a Distributed Hash Table. All servers are networked, and data is encrypted (and thus unavailable) and duplicated across your network. Your data may be stored on rogue servers (in order to be accessed while you're offline), but without the right key they cannot decrypt this. "Befriending" someone involves sharing with them some key that allows them to decrypt certain subsets of your data. De-friending them will cause you to "recraft" these keys, and re-encrypt your data, thus preventing them from seeing the data anymore. Obviously if you BEFRIEND someone using a rogue server, they can mine your data. But your data being duplicated across the DHT is no inherent danger to your data. At least, this is how it will work ideally. Likewise, you can run your own seeds.

Re:Specialized servers offering ad-free accounts

[Anonymous Coward]

You are just changing the subject with this DHT stuff. My point all along is that if your friend uses a "free as in facebook" server, that server gets any data you share with them.

Talking about how a third unrelated server won't get your data is nifty, but off-topic.

Re:Specialized servers offering ad-free accounts

[Anonymous Coward]

I see many more problems with web2.0 than fidonet.

Re:Specialized servers offering ad-free accounts

[lonecrow]

Sure sort of the way that pretty much 100% of us use email that is stored and routed by any number of intermediaries.

The difference between FB and Diaspora is that no one seed need be big enough to have enough social graph to be able to sell it.

Re:Specialized servers offering ad-free accounts

[CarpetShark]

So this is going to be a network of server all sending messages back and forth?

That idea is not so crazy. It's what makes blogging with pingbacks so cool; everyone can have independently owned blogs, in their own style, professional or personal, with their own comments, yet link up with everyone else, even if they don't care and use some big-name community site. It's a huge improvement over earlier attempts like livejournal and so on.

The crazy part is that they think everyone is going to move away from facebook to this.

Good idea to realise the code

[BobsPlumbers]

Sure there may be some sniggling going on when we look over the code but these guys have took the necessary steps to start something which hopefully will become huge for them. I know if it is within my power to point out some helpful hints and tips i will and i would encourace everyone else to do the same. Best of luck to all on the team! The journey of a thousand miles begins with a single step, and whilst your first step may be shakey in this case you have the support of the development comunity to help u stay afloat. Bobs Belfast Plumbers

This shouldn't be looked upon as a 'bad thing'...

[antiparadigm]

Yes, I understand that any security vulnerability is a bad thing. In that merit this is a bad thing. BUT...

These are people fresh out of college, and haven't gotten a lot of real world experience. I, myself, am only out of college by a year and a half. The first year was spent as a sys admin, but the past 6 as a developer. They have probably heard of some types of attacks, but are unfamilier with details. Others, if they are like me, they haven't even thought of. All of this comes from being "in the trade".

This is why Open Source is good. It can rapidly increase a programmers competency if they get constructive criticism. It sounds like they are getting plenty of that, but the article kinda makes it sound like the should know all this.

I, for one, am glad they are doing this, and that they have decided to release some code early for review. Not only will it allow bugs to be fixed early, but it will also give them lessons for future use.

Re:This shouldn't be looked upon as a 'bad thing'.

[Lunix Nutcase]

These are people fresh out of college, and haven't gotten a lot of real world experience.

So these are the people we should be trusting to make a highly secure network protocol and implementation? Really?

Symptom of a closed development model

[seandiggity]

I respect what's been done so far with Diaspora, but for all the hype and money poured into this project, this is a bit embarrassing. To me, it looks like a byproduct of a closed development model with a small team...I'm glad there can be community participation on the project now but I don't understand why the community wasn't involved in the beginning.

Re:Symptom of a closed development model

[CannonballHead]

I can't think of any open source project where it was completely community designed/programmed from the beginning. Most communities don't care enough to do that, bicker too much to do that, would have way too many different ideas to do that, etc.

I can be corrected, of course... but aren't most open-source projects started with just a couple people?

This isn't a symptom of closed or open development model. This is a symptom of young, inexperienced programmers who, frankly, it seems don't really even care about the security holes as much. Sounds kinda like Facebook?

Shocking, I know, but most young people don't care about security or privacy holes. Until something bad happens, of course.

Maybe the "community" could have helped, but I didn't see any highly experienced and wise open source programmers begging to spend their time (for free) programming this... I'd assume most of them have other things on their list of things to do, and an even longer list of things they want to do eventually. Diaspora, a Facebook-ish application that appeals to young people, probably isn't high on either of those lists :)

Re:Symptom of a closed development model

[seandiggity]

I can't think of any open source project where it was completely community designed/programmed from the beginning. Most communities don't care enough to do that, bicker too much to do that, would have way too many different ideas to do that, etc. I can be corrected, of course... but aren't most open-source projects started with just a couple people?

There are certainly a lot of complications with community development and all projects do things a little differently. Even if development was something like VLC (where the majority of changes come from developers at the same university in France), you can have a loose meritocracy where people work their way into the development process by virtue of the quality of their code. All you have to do is have the source code available in a repository from the beginning, and then you try to figure things out as time goes on. How you organize depends on how much interest there is in your project, but I view a project like this as software activism and I think it needs to be handled accordingly; not with the "cathedral" model. As such, I've been awaiting the release of this code with baited breath.

This isn't a symptom of closed or open development model. This is a symptom of young, inexperienced programmers who, frankly, it seems don't really even care about the security holes as much. Sounds kinda like Facebook?

This project was a response to a call to arms by Eben Moglen, and has received so much attention because of his influence as well as others associated with the FSF, SFLC, ISOC-NY, etc. To be fair, this is an alpha release. But to people like me who were waiting for months for this code to become available, it's a bit of a disappointment. I was planning on using at least pieces of it for a project I call Foojbook, with similar aims, and maybe I still will. But there's definitely cause for concern.

Maybe the "community" could have helped, but I didn't see any highly experienced and wise open source programmers begging to spend their time (for free) programming this... I'd assume most of them have other things on their list of things to do, and an even longer list of things they want to do eventually. Diaspora, a Facebook-ish application that appeals to young people, probably isn't high on either of those lists :)

There were quite a few people who wanted to work on this project, even before it was called Diaspora. I was one of those people, although I can't claim to be highly experienced or wise. Interest was very high in Diaspora, and still is. The Diaspora crew has done some great work; however, it seems like this was managed way too much like a young startup, and now we'll see what the result is with the code available to all.

Re:Symptom of a closed development model

[man_of_mr_e]

Indeed. Everyone knows they got $200k, so why would anyone want to work on it for free when they're being paid to work on it?

It's interesting, but the very idea of social networking is to "share" information. As such, the concept of security is often lost in the frenzy of sharing. This is what leads to crap like Buzz.

but how usefull will it be?

[Anonymous Coward]

But will I still be able to play Bejeweled?

Questioning the Whole Concept

[am 2k]

So, they started from scratch whipping up a solution that's potentially huge, with programmers that apparently aren't that experienced.

I question how intelligent this approach really is.

My solution would have been: Take a standard XMPP server, use its capabilities in the area of code stability, pubsub technology, server-to-server communication and properly documented communications protocol (as an RFC), and just write a javascript-based client (based on jQuery and strophe.js for example) that uses it. Any common server like ejabberd would be perfectly able to handle the stuff they need, no server-side coding required at all. As a bonus, the code has already been tested for security and has fewer bugs due to being out in the open for much longer.

Additionally, it would be trivial to have competing implementations. They already exist.

Re:Questioning the Whole Concept

[gVibe]

Dude...they aren't making an Instant Messenger client. They are making a Facebook killer, social networking website. XMPP and eJabberd are both chat protocols. Maybe you should brush up on just what this Diaspora is all about before you comment.

Re:Questioning the Whole Concept

[am 2k]

If you think XMPP is only about instant messaging, you haven't looked into the protocol at all. I'm actually on facebook, so I know very well what's required for a direct competitor.

Here, let me help you with the spec on pubsub via XMPP.

In other words: Maybe you should brush up on just what this XMPP is all about before you comment.

Re:Questioning the Whole Concept

[Anonymous Coward]

http://onesocialweb.org/

Re:Questioning the Whole Concept

[TheRaven64]

XMPP is two core specs and a load of enhancements. The core spec defines a way of transferring arbitrary chunks of XML about the place. The XMPP-IM spec builds on top of this to provide services required for instant messaging (roster management, that kind of thing). Various XEPs also add publish-subscribe, multi-user chat, vCard publishing, microblogging, video chat, and so on.

Re:Questioning the Whole Concept

[Anonymous Coward]

XMPP and eJabberd are both chat protocols

Dude.... you need to keep the condescending attitude to yourself if you're going to say stupid things like this..

Re:Questioning the Whole Concept

[neiras]

Dude...they aren't making an Instant Messenger client.

Dude, you're getting a Dell!

They are making a Facebook killer, social networking website.

They hope.

XMPP and eJabberd are both chat protocols.

You are wrong.

XMPP is a generic messaging standard. Chat is just one service that can be implemented using XMPP. Go have a read.

eJabberd is a piece of software that implements the XMPP spec and a number of extensions.

Maybe you should brush up on just what this Diaspora is all about before you comment.

Congrats on managing to get both your foot in your mouth AND your head in your ass all at the same time!

Take a photo, post it, and you might be the next goatse man!

What did people expect? And it *does* matter.

[Anonymous Coward]

It is a web service created by a bunch of kids still in school. Unless they have been doing professional web design and service coding since they were 12 then I don't see why this would turn out any better than the internal web service I let the interns learn on.

Security, scalability, and maintenance concerns at the start of a project are a big deal. These are all foundations of a computer system that you cannot change or fix later without basically doing a complete rewrite.

Re:This shouldn't be looked upon as a 'bad thing'.

[antiparadigm]

My point is, then obviously new they were inexperienced and that the code would have numerous problems. That's why the article said only the die-hard fans with blinders on would try to set this up and be subject to the security holes.

What I'm trying to say in my post is that since they knew there were problems, they went ahead and released the code so others can look. This is one of the great strengths of open source. If you know you have problems in your code, you can release it and have others look over it and provide insights into what you are or are not doing correctly.

Should inexperienced people be trusted to create a highly secure network protocol and implementation? No. Not even remotely. BUTThey took it upon themselves to get the process started. Once they felt they had something worth others looking at, they released the code, and professionals with more experience provided feedback.

Oh come on...

[__aayejd672]

BURN THE WITCHES

Version 0.0.0.0.1 of something more complicated than "Hello world" released along with huge warnings that it is not ready for production and people are shooting the entire project down. It has had 4 people working on it, now they've stuck to their word and opened it at the time they said they would. Why is this news surprising or bad? Why is it even news?? People have found gaping holes, said people will close gaping holes - that was the whole point of it being open wasn't it?

“If you've been on the Diaspora mailing list, there are people who are clearly not security professionals who are asking each other, 'OK, what do I need to do to get this running because I hate being on Facebook,'” he said. “They are going to get burned in a very serious manner very, very quickly if they actually succeed in doing what they're trying to do.”

(screams into pillow)

Re:Oh come on...

[Chang]

There is something to be said for wasting the summer and wasting the enthusiasm. Had they opened it from start it might have turned out differently.

Of course, it also might have turned into design by committee marathon flame war. We'll never know.

What is readily apparent to me after getting a seed up and running this week is that these guys are not the web devs to lead this effort. I predict another effort will pick up steam. Maybe GNU social, although that's in a pretty bad alpha state right now also.

The protocol is the key right now - the front end will sell this thing eventually but if the protocol sucks it will never go anywhere.

Re:Oh come on...

[Lunix Nutcase]

Maybe because it's hilarious to see a bunch of people who claim they are going to dethrone Facebook and give us this highly-secured social networking framework but instead that it is full of amateur-level security issues?

Re:This shouldn't be looked upon as a 'bad thing'.

[Anonymous Coward]

Good thing the world took the same attitude about those kooks Gates, Jobs, and Torvalds.

Diaspora, have you stopped beating your wife yet?

[Anonymous Coward]

Seriously, all of this hulabaloo is astro-turfed FUD. Inside of a year diaspora will be the most secure social network there is, and will end up providing a nucleus for a tremendous number of AGPL cloud services, from webmail to upper body strength increase.

Call me old-fashioned...

[pedantic bore]

... but after skimming through the code, I'm not terribly surprised to hear that it has issues, because there are virtually no comments or design docs.

Each one of the coders probably thinks the other coders are responsible for security, because it's nobody knows exactly what the other modules actually do. It's not written down anywhere.

To be fair, this isn't the only system I've seen like this... and kudos to the team for sticking their code out where everyone can see it. I'm sure that there are similar problems in many widely-used systems, but since they're closed source, we can only guess about the details.

Re:Call me old-fashioned...

[Anonymous Coward]

Each one of the coders probably thinks the other coders are responsible for security

Call me old fashioned too, but everyone's responsible for security, and anyone coding like they're not can expect to be sharply re-educated.

Re:Call me old-fashioned...

[kegon]

... but after skimming through the code, I'm not terribly surprised to hear that it has issues, because there are virtually no comments or design docs.

And they used the old coversheet for their TPS reports.

Seriously though, how can you expect them to have design documents ? Four guys putting together a prototype version of something they have no idea what will come out in the end. Once interested parties have had a chance to play with it and see what can be done with it, then a serious attempt can be made at defining exactly how it is supposed to work.

But how does it compare with the alternatives?

[Linux_ho]

The release of pre-alpha source code for their Diaspora social Website was only a few hours old on Wednesday when hackers began identifying flaws they said could seriously compromise the security of those who used it. Among other things, the mistakes make it possible to hijack accounts, friend users without their permission, and delete their photos.

"The bottom line is currently there is nothing that you cannot do to someone's Diaspora account, absolutely nothing," said Patrick McKenzie, owner of Bingo Card Creator, a software company in Ogaki, Japan.

So in other words, yes, it's a little bit worse than Facebook at this point.

The fact that it gets coverage

[Anonymous Coward]

says a lot about how pissed off such a large majority of people are with Facebook. People want it to succeed because they are tired of dealing with Facebook changing privacy pretty overwhelmingly without much notice or instruction guides and exposing your data more often that most on /. change underwear.

I've been a facebook user since the first year it rolled out at my college in 2K4 and it just sucks ass now. The fact that if you want to share info with your friends about what bands you like or interests they are now Pages with no way to hide them from anyone who sees your profile is "gayer than all the guys in the pile". If Diaspora takes these suggestions keeps up the hard work and makes a good product with a few bugs that has a regular patches I will drop Facebook like a rock.

Why Would You "Roll" off a Developer Release???

[ideonexus]

"...issues that make it hard to recommend that you roll your own Diaspora server just yet."

Umm... Am I missing something here? Why would you set up your own Diaspora server using a Developer's Release? It's in development, as in not ready for prime time yet. There might be too many security issues for it to go live in October, as is scheduled, but if the open source community gets behind the project, that could easily be overcome.

Unfortunately, this seems to be the catch-22 of many open source start-ups: You need outside developers to help you work out the bugs in your software, but when you publish your development software, everyone beats you up for all the bugs they find in it.

Stop criticizing and start coding.

Re:Why Would You "Roll" off a Developer Release???

[Bigjeff5]

Why would you set up your own Diaspora server using a Developer's Release?

Could be a masochist.

Re:Why Would You "Roll" off a Developer Release???

[man_of_mr_e]

To be fair, most open source projects are eternally in "developer release" and the only way you'll ever get to use them is to use them in whatever state they are in.

Re:Why Would You "Roll" off a Developer Release???

[Anonymous Coward]

Stop criticizing and start coding.

I see, so the four students will share the donated 200k USD with all the volunteer developers who help them get the code working?? Now that's cool.

This report brought to you by...

[mdm-adph]

Facebook, LLC.

Open Source Best Practices

[Bob9113]

It is excellent that security analysts have taken the time to investigate this code base. I think Eben Moglen made a very strong case for the value of this project, and the voluntary efforts by global security researchers is extremely valuable to the long-term health of Diaspora. Getting security people involved early is a Very Good Thing.

issues which make it hard to recommend that you roll your own Diaspora server just yet

Well, yeah. It is brand new pre-alpha code from a small team. If you are going to run brand new pre-alpha code from a small team on a network connected computer, it would be best to know about things like tripwire, process monitoring, traffic monitoring, and chroot, just for starters. You should probably be running it, if anywhere, on a sacrificial box that you can kill remotely. If you are considering running highly experimental code, you should either know how to handle it or know your limitations (I know I don't know enough to run this code in the wild).

Some products, like OpenBSD, start with high security as job one. Perhaps such projects can be somewhat trusted in their early state (though they will likely be deficient in other important areas). Others start with other prime motives, and should not be so trusted in the early days. The key value of Open Source is not that it is perfect in all critical areas on the first day of publication. It is that it can be collectively enhanced to become very strong in all areas over time. The first step in that process is publishing the broken stuff so the global system of experts can get together for a barn raising.

In short, this is exactly how it should work. This is not a sign of weakness but a significant step forward on the Open Source best practices road.

It's got potential

[Ancalimar]

I admit that I haven't read through the code, and I am not a programmer. But it seems to me that if this can be hosted and run by individual institutions, it could have a fairly large impact in higher education in the next few years. Employees could use this like intranet-lite, and alumni and students could use this the way Facebook was originally used -- a social network for the school itself. The only difference is that it could provide very useful data directly to the school instead of an individual. I've also read a lot of complaints about how the project focused first on user interface instead of back-end programming. Isn't that similar to how Facebook itself started? I don't think there were a bunch of new protocols declared for the "Face book" launch.

How to clean up the code

[killmenow]

The Diaspora guys should hire Austin Heap.

Re:This shouldn't be looked upon as a 'bad thing'.

[Lunix Nutcase]

Jobs never was a programmer. Torvalds had help from other experienced programmers and Gates didn't single-handedly write all the software Microsoft put out and also hired experienced programmers. So I'm failing to see what analogous situation you are trying to build.

Re:This shouldn't be looked upon as a 'bad thing'.

[cparker15]

Can you do better? If so, are you going to be contributing to the project?

Doing it Rong

[Anonymous Coward]

Ginning up an architecture and a code blob while holed up in a basement, THEN asking for input is wrong. The initial architect and developers are married to the design and code. They will maybe grudgingly try to "fix" what should never have been typed in the first place.

Open source should start at the drawing it on a napkin phase, not the first alpha release. Often it can't because nobody cares that early. In this case it could have.

Yes but...

[HalAtWork]

If there's a security bug or privacy hole in Facebook, all you can do is play with your profile options and pray it helps, or start a petition. Here, we have a chance to define the way we want to use such a system. It doesn't start out perfect, but Facebook as-is isn't perfect either after years of work. This project has started out with a foot forward in a much better direction.

Re:This shouldn't be looked upon as a 'bad thing'.

[Anonymous Coward]

No, I'm not going to be. I have better things to do than wade through the amateur-quality code of a bunch of Ruby noobs.

This could be good...

[Voltas]

I think this could be good for this project. Its good to get nailed with security issues as early as possible. This just means that focus on security will get higher...end result could be a very secure system. GL!

Re:Freetard fail

[iamhassi]

"Something doesn't have to convince every user just to succeed."

Maybe not every user, but it does need to convince everyone I want to know and I just don't see Diaspora doing that. Facebook, after ~5 years, has 500 million users, and it's steadily been growing by 100 million users every 160 days. That's huge, and unless Facebook really messes up, I mean messes up to the point that it's on the nightly news and 20/20 saying how horrible they are so every grandma that doesn't read /. even knows how horrible they are, I just don't see anyone knocking them out of the way.

Facebook has 2 billion results
Diaspora has 20 million, and many of those are wiki entries, music, and a video game.

And these latest reports that Diaspora is riddled with security issues has hit the news big time.

I think this is the last we'll hear of Diaspora. They were given $200,000 and couldn't even make a secure site. That's pretty damn disappointing.

WTF?

[Sheik Yerbouti]

Release early and release often is one of the fundamental tenets ESR spelled out in the Cathedral and the Bazaar I believe. Why should anyone be surprised or disappointed that early versions of the code aren't perfect yet? Seriously that's just dumb. The open source model can not be brought up to speed to fix anything until there is source code released to look at and improve.

Re:Freetard fail

[hierophanta]

article and this comment sponsored by the makers of Facebook: the original and premier stalker tool and dont you forget it

Re:Freetard fail

[Xacid]

PRECISELY. To me this is showing that the idea has its own momentum now - which is absolutely what it needs. I even almost shed a tear over this - it's like watching a community get together to help put out a fire.

"pre-alpha" not an excuse for poor coding

[Anonymous Coward]

it's expected to be missing many features but if the code quality is pure rubbish the final product will be... surprise, surprise... pure rubbish!

Pressure kills quality once again

[patchmonster]

Imagine the pressure on them. They had $200k of donations to show for and every privacy activist has been following them for months. I bet half those holes would've been patched if it weren't for all the pressure to release.

Re:Pressure kills quality once again

[sorin7486]

I bet you're wrong. Does "release early release often" ring any bells ?

Summary of article and comments

[Posting=!Working]

Article - A Pre-alpha release of the User Interface has security holes. For some reason this surprises people, and those who do know better are acting shocked, despite the fact that compiling "#include " by itself can be considered a pre-alpha release and that they have no idea about the project path.

Comments - Since I wouldn't have started with the user interface, this project is a failure. Stupid kids with no real-world large project experience can't do anything. The money they raised is completely wasted, even though we've no idea how much of that they've actually spent, with 4 programmers living in NYC working on this, they must have spent the $200,000 on gold plated Ferraris. They are not following my formula for creating large successful social networks (my current success rate: 0/0), therefore it is worthless. Trying is the first step towards failure.

Remind me never to show a work in progress on Slashdot.

Taken

[BlackHawk-666]

To me the real story here is how four students with no real skills or experience managed to convince people into giving them $200,000.

Of course their code is going to be utter rubbish, they are uni grads with no experience, discipline, standards, or any of the myriad other factors that are required to make rock solid code. It sounds like they don't even have a documented protocol to work, and I'm guessing that means there's nothing in place for inter-communication with add-ons or third party code.

Even if you assume they worked mainly on the front-end, that's seriously only a week or so of work for four developers, especially when so much has been cribbed from elsewhere.

I'm expecting a delay to their release to fix the major obvious flaws, massive security concerns, and a lacklustre launch of a product no-one really needs that much. If Facebook is so bad that you have already removed your account, or haven't subscribed yet - then you might be a contender for this product. Most others will simply stay where their friends all are - because that's the whole ********* point of a social network.

Never underestimate the power of inertia.

Re:Taken

[Anonymous Coward]

Except for the fact that's it not just them - they have a lot of connections with NYU Computer Science and the downtown New York startup community.

They also hired a consultant to help with UI:
http://www.joindiaspora.com/2010/08/26/overdue-update.html

Disclosure: I work for NYU Computer Science, but I'm not involved with Diaspora in any way (beyond rooting for it).

Bigger security bug is the design its self

[Posts]

(I might be making an assumption with how this is "distributed", friends and trusted servers might be acceptable. But i'm not going to give them the benefit of the doubt because they did a very poor job explaining important details like these.)

Encryption should never be your only line of defence for PRIVATE information.

"Distributed Encrypted Backups" and "distributed" is scary because this is PRIVATE information and not PUBLIC information, not only is this uncharted territory but it is fundamentally wrong. With Tor and Freenet there was nothing of value stored or transferred.

A malicious user could archive torrents of encrypted personal information, even if it takes 20-50 years to crack this is unacceptable. Normally you are just packet sniffing on a small fraction of the population.

This project could be a false prophet that will that will doom the success of any future social projects.

Also, these client diversity and data portability concepts may not be compatible with attempts at real privacy and security, for example your perfect email client and server is at the mercy of the client on the other sending/receiving end. These concepts make the assumption that the indefinite storage of information is a good idea, while i happen to think that the expiration of messages is a good idea, and an idea that can look appealing with the right spin. (well, these concepts are may be ok for making the transition to something better, but i think it encourages defeatism, accepting to be average)

disclaimer, i'm about to finish a security/privacy focused social networking website that isn't exactly 'open' for the foreseeable future but its not feature fancy/flashy either.

Re:This shouldn't be looked upon as a 'bad thing'.

[keithjr]

Facebook was made by people still in college. I'm and sure it wasn't highly secure, and probably still isn't. But we'll never know will we?

Re:Freetard fail

[Prune]

All that's really needed here is managing the hype until the system is deployment-ready. I know it's a difficult for a small team already overloaded with to-do lists to have to deal with PR as well, but this is critical to a project with a planned large social scope. They need to do all they can to keep this lying low until the resolution of all major issues that would sour the public's fickle and first-impression-is-everything opinion.

Why can't we just.....

[bickerdyke]

Why can't we just put our own profiles on ome webspace and model this "friend" thing with something I would e.g. call "link"?

Throw in some decentralized profile hoster (think of geocities) with the possibility to add your friends as links in the html-header (like googles social graph suggests) and some simple profile-page building tools where you upload your pictures and stuff and your profile is generated automatically. For anything else (messages, groups, status updates) use WHATEVER ANYONE ELSE uses too. (Email, Newsgroups, Twitter)

seriously ?

[sorin7486]

Blah keep your pants on... it's a technical preview !!! Tho whole point of them releasing the code and making it open source is so that people can find these bugs before it even gets close to a testing final release. This is just another case of corporate rats not understanding open source software development.

Pre-alpha

[Anonymous Coward]

I think the headlines of news websites are being a bit too harsh. It is a pre-alpha release after all.

Re:This shouldn't be looked upon as a 'bad thing'.

[Anonymous Coward]

Wouldn't you consider making it open source and putting it out there for review, comment, and code submission to be similar to getting help from (a la Torvalds) or the FOSS equivalent of "hiring" (a la Gates) experienced programmers? You're failing to see the analogy because you're viewing it so narrowly so you can stick to your claim that good/secure programming can't come out of young people without much experience and this is being developed in a vacuum. I'm not sure of the validity of either of those suppositions.

They should have created an API

[psyclone]

If the developers set out to create an API, protocol, or specification, and then simultaneously released an initial implementation, this might be less of a big deal.

Take XMPP for example. It is a specification, and there are many implementations to choose from to run a Jabber server. Different languages, platforms, and features are up to the user to choose.

A well documented API, supplemented by buggy code, would be best. If you don't want to hack Ruby, implement the spec in your language of choice.

The Pre-Alpha Code

[Anonymous Coward]

OH GOD the pre-alpha code HAS FLAWS

Re:Freetard fail

[crf00]

Mod parent up. A lot of people didn't realized that as long as there is a single user who is willing to allow his/her diaspora host to access his/her unencrypted data, the privacy of the entire group of his/her friends will be completely compromised, whether his/her friends run their own server or encrypt everything up.

How long will it take for people to realized that under this all-new-super-perfect-diaspora-protocol, Facebook will still get all your data anyway, and now together with a whole new bunch of less accountable diaspora-hosting companies?

Server bans in home ISP TOS

[tepples]

Likewise, you can run your own seeds.

Most people aren't going to want to upgrade from residential Internet service, whose TOS bans servers, to higher-priced business-class service, whose TOS allows low-bandwidth servers, just to run Diaspora.

Re:Server bans in home ISP TOS

[dondelelcaro]

Most people aren't going to want to upgrade from residential Internet service, whose TOS bans servers, to higher-priced business-class service, whose TOS allows low-bandwidth servers, just to run Diaspora.

There's no effective difference between a server and a client when coupled with methods of penetrating NAT and firewalls. ISPs realize that enforcing their TOS is a bad business decision when a large enough group of people are using diaspora and freedom boxes and similar network devices and the impact to the network per customer is low enough. This is doubly so in areas where there is competition between residential ISPs.

FreedomBox confusion

[tepples]

ISPs realize that enforcing their TOS is a bad business decision when a large enough group of people are using diaspora

Which is why the ISPs would feel need to nip Diaspora in the bud before the TOS violation that would undermine ISPs' market segmentation becomes widespread.

and freedom boxes

ISPs' response: "If you want to use your FreedomBox, feel free to upgrade to business-class service." Even if you're talking about a different FreedomBox, ISPs won't know nor care about the difference.

This is doubly so in areas where there is competition between residential ISPs.

ISPs' response: "Of course there's competition. Our service is just two orders of magnitude faster than the 0.05 Mbps that our dial-up competitors provide."

Re:FreedomBox confusion

[Quantumplation]

*shrug* I've moved a lot, so been with a variety of ISP's (from the big names like Bell South and Comcast, down to small-timers like RCN Internet here in Boston. I run servers quite frequently (Ventrilo, various games, FTP and web, servers I code, VPN) and have never, ever had them contact me or limit access to those servers. In fact, I wasn't even aware that there were TOS restrictions on running servers. (The internet bill has always been in someone elses name, so I haven't had a chance to read the TOS in detail).

Running a small DHT seed among a large network of federated seeds for your own personal use isn't even so much as a server, as a client in a Peer to Peer architecture.

Nomenclature fail

[nloop]

I've said it before, I'll say it again: A project named "Diaspora" will never take off. Seriously, a catchy name is ridiculously important. Yahoo, Google, Facebook, Myspace, Friendster, Digg, Reddit, Slashdot, Diaspora? One of these names is not like the others. I'm really trying hard to think of another popular website with four syllables but am coming up short. Epic fail on so many levels for this project.

Give'em A Break

[Ukab the Great]

It's not any dumber than two college dropouts in Cupertino building a personal computer in their garage or some lone crazy finish student making his own OS.

Budgets considerably larger than $200,000 have been spent on software projects written by professional programmers that don't run at all.

"Hard to recommend..."

[suprcvic]

"issues which make it hard to recommend that you roll your own Diaspora server just yet." It's not even alpha yet people, of course there are going to be issues that would cause one not to recommend you roll your own server. Dayum.

Re:Freetard fail

[marcello_dl]

I do not make predictions about diaspora, too early for that.

I have been suprised by the reported problems, esp. with html injection.
Diaspora seems a rails app.
Rails, like most web frameworks, takes precautions against such injections, and IIRC even basic tutorials mention those, so an unskilled coder that RTF tutorials ought to avoid those.

So I guess they released very early and the code and protocol will have to be massaged a lot. Changing the code is trivial, the protocol is a bit more delicate.
It's also probably too late to use gnunet, freenet, other p2p or stuff as i2p or tahoe-lafs as an infrastructure, too. Like every other coder out there, including me, they are gonna pay for the NIH syndrome :)
But ok, let's see what happens. Good luck to diaspora.

Re:Freetard fail

[KazW]

I'm not entirely sure, but I think the HTML injection is caused by their use of WebSockets, which uses EventMachine and then ties back into the Rails app or bypasses it and goes straight into the MongoDB. That's my basic understanding of it, if I'm wrong someone should correct me.

As for people criticizing the project, I think that it's way too early, it hasn't even hit Beta status, it's an Alpha release.

WebSockets is actually the aspect of this project that interests me the most, if they can make a "standard" social communications protocol or API that functions over WebSockets, I think that'd be the greatest outcome for the project. If it succeeds in creating that protocol, it wouldn't only kill FaceBook, but Twitter as well. Also, that would allow other developers to create other implementations in different languages(sans Rails) , user interfaces or mashups.

Either way, I watch this project with great anticipation and bated breath.

P.S. MongoDB is a NoSQL database...... HA! Now the Web 2.0 synergy in this post is complete.(Yes, I did throw in a few terms just for shits and giggles.) /endpost

Much a fuss about nothing

[horza]

Hopefully the developers will ignore many of the idiotic comments on this thread. It doesn't matter if the prototype has a few security flaws, in fact I would be surprised if it didn't. The idea is to get something out there and people playing with it, evolving it according to the feedback people give, saying what they like and what they don't like, what they would like to see, etc. There is no point shifting the focus onto security whilst it is still evolving rapidly. Eventually the feature list will stabalise and an API becomes fixed. Alternative back-ends and front-end can then be developed in Java, Python, etc.

Patience everybody.

Phillip.

Re:Freetard fail

[silanea]

[...] Facebook, after ~5 years, has 500 million users [...]

...of which currently 14 are relevant to me. Do not mistake size for usefulness.

Re:Freetard fail

[CarpetShark]

People won't need to run their own servers.

He didn't say that people won't setup their own servers to go to it. He said that people won't go to it. Period. Which I agree with, of course. The first thing you need to overcome a social site like Facebook is a way to interact with all the existing Facebook accounts seamlessly. The second is a way to import/invite them that's attractive enough that people will go for it.

No, wait... the first is a sensible name. The second is a way to interact...

Re:Freetard fail

[CarpetShark]

I fail to see how working with people dedicating their time and knowledge can be seen as a bad thing.

Oh no? Are you aware that it's made with Rails? ;)