Ask HN: Review my App - Freeciv.net(freeciv.net)
freeciv.net
Ask HN: Review my App - Freeciv.net
http://freeciv.net/
47 comments
I only have one real complaint, and that is this:
The email or password contains invalid invalid characters.
Only letters (A-Z) and numbers (0-9) are allowed.
Ignore most of the other comments threading from this point, and HASH THE PASSWORDS with a salted hashing scheme. If it's not salted, it's almost as bad as not encrypting them at all.
Hashed passwords are character-agnostic as well, so the only reason to limit your character-space then becomes preventing injection... which you should be using a library to do for you, because, frankly, "they" know better, and it's been more heavily tested than your code.
If you're storing passwords in ANY reversible format, you're a threat to every user's security. It's part of why I like OpenID: if your server is compromised, I'm not.
If you're storing passwords in ANY reversible format, you're a threat to every user's security. It's part of why I like OpenID: if your server is compromised, I'm not.
Good question. Some banks (and other large companies) also seem to dislike them in passwords.
Some stupid rule thought up by someone that is trying to force users to make passwords that they can remember. Like some sort of Web/IT version Clippy saying, "I see you're trying to enter a password with a '+' in it. Are you sure that isn't a typo?"
Either that or their backend software is incompetent (as well as the people that made it) and can't handle pattern-matching outside of [:alnum:] or can't store character values outside of [:alnum:]. It's the same reason that there are many sites that you can't use the 'md5 a single password against the site's domain name' trick because they limit password length to 8 or 16 characters (as if they are some sort of 'accepted industry standard').
Either that or their backend software is incompetent (as well as the people that made it) and can't handle pattern-matching outside of [:alnum:] or can't store character values outside of [:alnum:]. It's the same reason that there are many sites that you can't use the 'md5 a single password against the site's domain name' trick because they limit password length to 8 or 16 characters (as if they are some sort of 'accepted industry standard').
I like that idea of using some sort of standard hash and password pairing along with the domain to come up with a password that's site-unique. Is that original, or taken from somewhere?
Have you considered using base64 or some other encoding to shorten the string?
Have you considered using base64 or some other encoding to shorten the string?
Maybe I'm misunderstanding, but the string will already be Base64 if it's human readable (I'm not trying to use character 254 as part of my password) and base64 encoding actually grows the data you are encoding (since you are breaking some bytes down into two bytes to make them both human readable).
The problem being length. Human-readable (ascii-armored/whatever) hashes (md5/sha-1/sha-256) have standard lengths which are usually longer than the maximum size of the password fields.
The problem being length. Human-readable (ascii-armored/whatever) hashes (md5/sha-1/sha-256) have standard lengths which are usually longer than the maximum size of the password fields.
I was assuming he was using the hex digest of the hash. You have to use some kind of ascii armoring, and base64 seemed like one that'd be reasonably safe.
I've used the extension from passwordmaker.org for quite some time. It implements this basic idea quite nicely.
Besides passwordmaker there's also the PwdHash firefox extension; I've been using that one for a while.
I think banks to alpha-numeric so you can type them in on the phone.
It reduces the keyspace that needs to be searched when bruteforcing... leading to accounts being compromised more easily. That's about it.
At the same time, I think it's just a really quick/lazy way to prevent SQL injection.
I hate when pages say my email is invalid because it has a plus sign in it.
Is it even possible to enter any valid email address there? I have an email address whose only special character is the dot before the top level domain and it doesn't get accepted.
I see ads on the side, I may be completely misreading your intentions for having them of course (as it could just be why not?) but I am not seeing freeciv on web as being very high in traffic. Main reason is that the barrier to entry is extremely high. Without tutorials, and the way the ui is setup, it requires you to be a former civ player, and a former civ player likely has civ on their computer (or at one point). So with the free advantage gone for a lot of them (eg i have civ4 installed right now), how is this better than multiplayer civ4? my hope is that u have some cool plans for it that takes it beyond the commercial civ titles.
There is definitely an opportunity for browser-based Civilization game, though it's going to be tough to compete with Sid himself:
http://www.facebook.com/civnetwork
http://www.facebook.com/civnetwork
Some notes:
1) I typed "G" to have a settler unit wander out into the wilderness and it founded a city on its own. That was unexpected. I'm almost certain I didn't have it in any kind of automatic mode.
2) It would be good if we had a stronger indication of which tile will be the target of an action, and possibly a preview of the path taken there.
3) More animated indicators in general of where we should be looking at any given moment would be helpful.
4) Try to test the game on a large display (I'm testing on 2560x1600). It looks fantastic, but some of the UI could be better-delineated and tightened up. It seems to be a little spread out right now.
Overall, this is awesome. Thank you for creating it! Civ is very high on a lot of people's top-10-of-all-time lists, so this should become very popular very quickly. Good luck.
1) I typed "G" to have a settler unit wander out into the wilderness and it founded a city on its own. That was unexpected. I'm almost certain I didn't have it in any kind of automatic mode.
2) It would be good if we had a stronger indication of which tile will be the target of an action, and possibly a preview of the path taken there.
3) More animated indicators in general of where we should be looking at any given moment would be helpful.
4) Try to test the game on a large display (I'm testing on 2560x1600). It looks fantastic, but some of the UI could be better-delineated and tightened up. It seems to be a little spread out right now.
Overall, this is awesome. Thank you for creating it! Civ is very high on a lot of people's top-10-of-all-time lists, so this should become very popular very quickly. Good luck.
Thanks mate, you have just destroyed my marriage.
and my finals week
I signed up but the game never finished loading, so I had a play with the UI for a few minutes.
http://i.imgur.com/fzB6i.jpg
http://i.imgur.com/fzB6i.jpg
Is there a tutorial you could point me to that'll teach me how to make buttons with a style similar to that 'Play Now' button?
It's something that I always saw and one afternoon decided to try and replicate. You can search for "MetaLab" style buttons, but it's as simple as fine-tuning the settings for inner shadow (normal mode, white) a darker stroke, a gradient overlay and a subtle drop shadow.
That's probably not my best ever example of that button style either.
EDIT: A pretty poor substitute http://blog.creativityden.com/design-a-pixel-perfect-menu-me...
That's probably not my best ever example of that button style either.
EDIT: A pretty poor substitute http://blog.creativityden.com/design-a-pixel-perfect-menu-me...
Edit: nevermind what I wrote below. I just figured out I didn't understand the controls. Would it be impossible to create "drag and drop" for units?
I tried a single-player game in Firefox (3.5), but it hardly reacts to my input (even though top tells me it's barely consuming any cycles). I thought I'd give it a try with the Chromium Beta (but couldn't login anymore, so I created a second account) too - same thing there though.
In any case: love the idea!!!
I tried a single-player game in Firefox (3.5), but it hardly reacts to my input (even though top tells me it's barely consuming any cycles). I thought I'd give it a try with the Chromium Beta (but couldn't login anymore, so I created a second account) too - same thing there though.
In any case: love the idea!!!
Cool! Works for me on a firefox 3.6b4, but I found the interface a bit clumsy and lacking visual feedback, and also some may not notice the commands area in the lower-right corner. Otherwise, thanks!
It might not actually be unresponsive but it certainly feels that way. There is no feedback, the screen just violently blacks out, units just jump from A to B, buttons don’t react to clicks at all and so on and so on. This games needs a ton of polish. If anyone ever again claims that animations are useless eye candy I will show them this game.
I love turn based games – but, sorry, not this one. I gave up after a short time and was very frustrated.
(By the way, I changed browsers, too. From Safari to Chrome to Firefox, just to see whether it might be the browser.)
I love turn based games – but, sorry, not this one. I gave up after a short time and was very frustrated.
(By the way, I changed browsers, too. From Safari to Chrome to Firefox, just to see whether it might be the browser.)
Thanks for the feedback. How should the controls be for this to be more usable? The game is still under development, so any feedback would be very useful.
You've done a good job.
I've been looking through the sources and found the "patches" directory. It would be cool if you had comments on top of every patch why it is needed.
I've been looking through the sources and found the "patches" directory. It would be cool if you had comments on top of every patch why it is needed.
Chrome says "Waiting for freeciv.net..." but nothing loads.
In the chat console, the blue text on black/dark grey background is totally unreadable.
So far I'm very impressed.
So far I'm very impressed.
Thanks for the reviews from everyone. I'll use this to improve the game soon.
That was one of tasks on my list of "Projects to do before I die"!
checked out, love when people are making things real, thanks man
Ah, then next one is tough, "have threesome with japanese twins".
checked out, love when people are making things real, thanks man
Ah, then next one is tough, "have threesome with japanese twins".
It hangs. (2 minutes pass) No! But still slooow
I would not be surprised if by reducing the barrier to entry, you get three times as many players. Your bounce rate must be staggering right now.
Please implement this and then post another YC article with the stats on your bounce rate. :) I'd be very curious how big of a barrier requiring an email, etc. really is on a site like yours.