Ask HN: What do you think of my group chat app?(yamr.net)

20 pointsby nodnarbvor 17 Jahren27 comments

Ask HN: What do you think of my group chat app?

http://yamr.net/

28 comments

tptacekvor 17 Jahren

The "user" cookie contains a base64'd username, the JSON responses include an echoed User-Agent, and I can rotate the "roomids" parameter to retrieve message logs from arbitrary rooms. Does security matter for this app?

nodnarbvor 17 Jahren

Sorry, it's not really meant to be a secure chat. It's catered to people who don't want to signup or install anything. Who just want to go to a link and start chatting.

rincewindvor 17 Jahren

Do you mean you can't have both?

tptacekvor 17 Jahren

I'm not sure what combination of features you'd want to give up in order to make the logs of a free web chat secure.

Still, it'd be worth putting up a notice somewhere that users can't expect privacy from this site.

omousevor 17 Jahren

store a random session id and store all the room data and all that shite on the server somewhere, not in a cookie. Also, use a random string of characters instead of a number for the room ids. That should take care of most of the problems that tptacek mentioned

tptacekvor 17 Jahren

Sometimes storing session data serverside is clunky, particularly when you have multiple servers; a classic, reasonable approach in that case is to MAC the contents of the cookie with a 256-bit random key, and then AES-CBC encrypt the cookie with that same key. But I agree, for this app, there's no reason there should be structured data in a cookie.

As for the room IDs --- randomizing them is a fine bit of rubber-chicken security. I think it's a good idea. But the right solution is to allow users to erase the chat logs, and to verify that users have access to a given room before dumping all messages starting at message ID 0.

vivekamnvor 17 Jahren

You should consider the ability to embed this as part of a website.

manvsmachinevor 17 Jahren

I think that if this is intended to be anything more than a toy project, you should change the name (http://www.yammer.com). Otherwise, nice job.

arnorhsvor 17 Jahren

Great stuff

- I love the signup "process" :)

- I like the /anychatroom feature

- I like the persistant nature of the chats

- It's interface is amazingly simple/quirky - I love it

- personally i don't care about security, as long as this is intended for OPEN chats and chatrooms (twitter-esque) .. not some private closed sessions between you and your secret lover...

cons

- manvsmachine is right about the domain name.. could confuse some users

Idea

- i don't know how long backwards you have the conversations open .. that is.. can I scroll back and check what John was saying a few months ago? If so: excellent! Then a permalink as in http://yamr.net/chatroom#388332 as an url to every single line of chat would be totally awesome

Good luck with this project!! I think it rocks

arnorhsvor 17 Jahren

- one extra downside: 10 second refresh-rate in a live conversation is very long... I'd try to go down to at least 4-5 seconds (maybe at least for registered users)

nodnarbvor 17 Jahren

I like both ideas of perm-linking to a specific post and bringing the refresh rate down for registered users. I'll see what I can do :)

pclarkvor 17 Jahren

paging axod to this thread. Am sure there is some form of collaboration possible for web chat stuff.

few thoughts:

great signup form

the uploader squashed my non-square picture to a square :(

Privacy Policy. Especially if you're dealing with uploads and chat logs.

avibryantvor 17 Jahren

Nice and lightweight, but useless (to me) if not secure. The latency is also quite bad at the moment (10 seconds or so between me writing "ping" and seeing "ack" from someone else in the room), but maybe that's due to heavy load right now?

ruslanvor 17 Jahren

Welcome to 1988. There are dozens of Web based front-ends to IRC available, just install one and customize a little to meet web 2.0 "standards" and you get all the millions of IRC users at your feet :-).

axodvor 17 Jahren

I wouldn't say there are dozens ;)

axodvor 17 Jahren

Looks like a good start :) Wonder how you're planning to get users...

I got them by leveraging IRC, Campfire got them by having a popular blog to sell to.

tptacekvor 17 Jahren

Nobody in my company (there's quite a few of us) gives a shit about the SvN blog; we use Campfire because it works, it's private, it has strong access control, great searchable transcripts, and file upload/download.

I've ragged on 37s here before, and I don't like being put in the position of sticking up for them, but I really think this meme about how 37s sells everything because of their "popular blog" is getting stale. Obviously, the blog helps them, but it doesn't hurt that they know what they're doing.

axodvor 17 Jahren

OK, But in that case how did you find out about campfire? If it wasn't for their blog posts making it here and Reddit, I probably would never found it.

trevorturkvor 17 Jahren

Very cool! I think you could have a free service with an up-sell (more than 2 people, private rooms, etc) that made sense. Depending on how much it costs for you to run the free site, I guess.

Is there a blog or somewhere to follow development?

nodnarbvor 17 Jahren

No blog currently, just the front page for updates

tontoa4vor 17 Jahren

I like the simplicity. Good job. Keep up the good work.

avibryantvor 17 Jahren

One killer feature from Campfire that I would request is that when pasting an image URL, the image gets inlined into the chat.

nodnarbvor 17 Jahren

The only problem with this, is because the chat rooms are pretty open, porn can be posted, making the site not safe for work.

rsvor 17 Jahren

Moreover lets not forget XSS as well. Need to be careful.

Think if you're going to post an image URL, server will need to do some validation that its an actual image and then spit it inline

run4yourlivesvor 17 Jahren

Not a bad little app, really. Nice job.

joshuarrvor 17 Jahren

Users need to be able to set a handle.

[deleted]vor 17 Jahren

chavarriavor 17 Jahren

how do i hack a myspace account