Show HN my holiday project: thingsand.me, simple image blogging
13 comments
A little security tip:
http://thingsand.me/media/images/image_228.html
Your uploader is blindly trusting the file extension for an image being uploaded. It's possible to upload valid images that contain HTML or other content within them.
Deletions are also done via a GET request, which makes them vulnerable to a CSRF attack. An attacker can figure out the URL for a deletion based on the content of the post: once they've done that, all they have to do is trick the user into visiting a site controlled by the attacker.
http://thingsand.me/media/images/image_228.html
Your uploader is blindly trusting the file extension for an image being uploaded. It's possible to upload valid images that contain HTML or other content within them.
Deletions are also done via a GET request, which makes them vulnerable to a CSRF attack. An attacker can figure out the URL for a deletion based on the content of the post: once they've done that, all they have to do is trick the user into visiting a site controlled by the attacker.
Thanks, I'll check this out!
Clickable: http://thingsand.me/
Looks very nice and I can see a few ideas to monetize this.
Is the directory "empty" because it's a new service or is there a limit to the number you're displaying?
What about image copyright? I can easily imagine users just using images they found on the internet as opposed to shots they've taken.
API would be cool, yes. Keep it simple please! I was thinking a Posterous-like email blogging approach would be useful.
Also, consider adding basic online image editing tools. Things like cropping, lightening/darkening, saturation, etc. Nothing too fancy but enough to get people to use this on the go, like when on holiday.
Looks very nice and I can see a few ideas to monetize this.
Is the directory "empty" because it's a new service or is there a limit to the number you're displaying?
What about image copyright? I can easily imagine users just using images they found on the internet as opposed to shots they've taken.
API would be cool, yes. Keep it simple please! I was thinking a Posterous-like email blogging approach would be useful.
Also, consider adding basic online image editing tools. Things like cropping, lightening/darkening, saturation, etc. Nothing too fancy but enough to get people to use this on the go, like when on holiday.
You can subscribe to other blogs and their updates are shown in the directory when logged in (you can also check latest from all users with min. 3 things added). Not really clear but directory was a last minute addition. I should improve it.
Image copyright is tricky but I don't change the images and there's links to original sources so it should be about ok. The service is hosted inside EU and I don't take credit for outside images (see footer). This is also the reason there won't be any editing features for the time being.
If you have some cool ideas for monetizing I'm all ears :)
Image copyright is tricky but I don't change the images and there's links to original sources so it should be about ok. The service is hosted inside EU and I don't take credit for outside images (see footer). This is also the reason there won't be any editing features for the time being.
If you have some cool ideas for monetizing I'm all ears :)
I like this a lot and the barrier to entry is really low. Plus the simple design is a major plus.
What's a big negative to me is the design of my feed. It's actually what's preventing me from sharing this with my friends who are fellow designes/creatives. Specifically too much real estate for the sort option on the right, dropshadows are little bit distracting, and do you need "Thing from?" Just by having the URL, I can tell that's the source.
I think what makes more sense is if the tags run across the top horizontally (above the images), and there is an add button. The reason is so that the grid remains completely full width across your container and so more results are per row.
This would also help put the name of the person above the image results instead of to the right.
What's a big negative to me is the design of my feed. It's actually what's preventing me from sharing this with my friends who are fellow designes/creatives. Specifically too much real estate for the sort option on the right, dropshadows are little bit distracting, and do you need "Thing from?" Just by having the URL, I can tell that's the source.
I think what makes more sense is if the tags run across the top horizontally (above the images), and there is an add button. The reason is so that the grid remains completely full width across your container and so more results are per row.
This would also help put the name of the person above the image results instead of to the right.
Very impressed. A few minor points though:
I'm using Firefox 3.6.13 on a Macbook and every page appears to be a pixel or a few pixels wider than the window meaning there is an unnecessary horizontal scrollbar. It doesn't look very good.
The login could do with SSL protection.
If you don't have cookies enabled, trying to log in complains about a CSRF error. Might be worth detecting cookies being disabled and putting up a note on the login page to enable them. I admit this would only affect a tiny number of people, but still worth it imo.
I'm using Firefox 3.6.13 on a Macbook and every page appears to be a pixel or a few pixels wider than the window meaning there is an unnecessary horizontal scrollbar. It doesn't look very good.
The login could do with SSL protection.
If you don't have cookies enabled, trying to log in complains about a CSRF error. Might be worth detecting cookies being disabled and putting up a note on the login page to enable them. I admit this would only affect a tiny number of people, but still worth it imo.
Also, you need a privacy policy so people know what you can/will do with their data.
And terms and conditions which deal with your rights and your users rights, and which explicitly deal with copyrighted data concerns.
And terms and conditions which deal with your rights and your users rights, and which explicitly deal with copyrighted data concerns.
Also. A Facebook app would be good so people who decide to upload their photos to your website can still make them available within Facebook to their friends. Most people aren't going to want to upload to more than one site, or upload to one site and then have to log into another site to post links to it.
Thanks for the notice. I'll look into FF problem. CSRF is taken care by Django and at the moment this being as a weekend project I don't any plans to support people without cookies.
Do you know about or are you influenced by: ffffound.com ? Great site.
Keeping it (or having an option to style it) VERY bare bones like that would be awesome.
Also, think about what you can do on your site that would be impossible on tumblr. For example I think they have a limit of something like 15 posts per page. Beat them in the images-only game.
Plans for custom domains?
Keeping it (or having an option to style it) VERY bare bones like that would be awesome.
Also, think about what you can do on your site that would be impossible on tumblr. For example I think they have a limit of something like 15 posts per page. Beat them in the images-only game.
Plans for custom domains?
Agree, ffffound is awesome :)
You nailed it: limiting posts would be interesting approach but for now I just want people to get started. Have to think about it more.
Not sure about custom domain as the platform doesn't allow much customization. But lets see after it gains little traction. Until then I'll go with about.me approach.
You nailed it: limiting posts would be interesting approach but for now I just want people to get started. Have to think about it more.
Not sure about custom domain as the platform doesn't allow much customization. But lets see after it gains little traction. Until then I'll go with about.me approach.
Holy crap. I know tons of people who would use this. Only problem is getting them to migrate from using facebook to blog their images, to using this, which is (in my opinion), a much better user experience.
Then again, I'm not a big fan of facebook.
Then again, I'm not a big fan of facebook.
This is very nice and simple, I like it a lot. One thing I would change is to make the "Select the thing to be added" pane disappear after I've selected something, or add a close button so I can get rid of it.
Pretty badass. I might be crazy for suggesting this for this idea(as this is pretty off) but it'd be terrific if I could take a snapshot of a page. For instance, I run the tool, the page I'm currently fades to black opacity(~60%) and I select the portion I'd like to share and click SAVE. It's automatically posted to my unique photoblog without me having to login(ugh, the login part is really too much work). As a user, I'd love to open up a photoblog of parts of sites which I love.
Cheers and good luck with the project, you're on a great track
Cheers and good luck with the project, you're on a great track
In-page screenshots would be awesome (especially for designers). Unfortunately I don't have mad skills with JS but if there's someone who would like to make this I'm all ears :)
Hey, just checked it out. Awesome stuff, but what's the difference between this one and Posterous, or Tumblr?
I tried to make much simpler and image focused service than Tumblr and Posterous. I love Tumblr and have been using it in the past but I feel it's too close to Blogger/Wordpress level blogging platform.
There's a reason why posts at Things are limited to only images with max 160 chars of text and link to source :)
There's a reason why posts at Things are limited to only images with max 160 chars of text and link to source :)
This is just beautiful. Love idea, love design, love execution :)
Keep working on it and good luck!
Keep working on it and good luck!
It would be cool if the bookmarklet text was "♥".
http://thingsand.me/
And an example blog: http://thingsand.me/jori
I tried to keep the platform as simple as possible and focus on the images instead of making yet another blogging platform. Time will tell for what people are going to use it. I hope to add API soon (iPhone uploader would be awesome to blog daily activities).