nickbw

6 ms·

1.
by nickbw 15y ago
Hehe. Sorry, that came across more accusatory than I intended. I totally agree with your overall point. I think Twitter's follower numbers are an example of gamification done right. Useful information that's also a dopamine trigger.
2.
by nickbw 15y ago
> Twitter doesn’t have game mechanics ... > You should totally follow me on Twitter Yuh-huh. I think Twitter is genuinely useful, but I'm pretty sure scoring Big Numbers is the driving motivation behind plenty of following behavior
3.
by nickbw 15y ago
Ditto. I've always had the impression that, at least on HN, "weekend project" describes a level of "seriousness" rather than absolute time invested. It lets readers know what kind of scope and polish to expect when they click the link, and
4.
by nickbw 15y ago
Thanks, I hadn't seen that one before. :) Yeah, it's a similar concept, as is http://mlkshk.com/ with their new bookmarklet. I think two things set imagestash apart: 1. The bookmarklet has many more features, and works in more cases. You
5.
by nickbw 15y ago
Clickable: http://imagestash.org/
6.
Show HN: my weekend project, Imagestash - a bookmarklet+ for image collectors
9 points by nickbw 15y ago|3 comments
7.
by nickbw 16y ago
I think this is the salient point for startups. Painfully contrived "fun" can be a short-term win. Tech press and early adopters like it ... but only because they like being clever enough to appreciate it. "Look at that, it gave me a badge!
8.
by nickbw 16y ago
Animal Planet shows animal faces. Anything with a recognizable mouth and set of eyes is still pretty engaging to our wetware. (In fact, I just tried "Animal Planet" on Google images, and got mostly face shots -- human and otherwise.)
9.
by nickbw 16y ago
For brand new/"experimental" projects with both user permissions and a non-trivial set of features, built by a small team, I've always found it easiest to work like this: 1. Build features, ignoring permissions entirely. 2. When the feature
10.
by nickbw 16y ago
Thank you for the insightful comments, and for taking the time to read the code! I really appreciate it. I've added a pseudo-random component to the nonce, and a MAC to the messages. I certainly agree that you can't rely on code from untrus
11.
by nickbw 16y ago
I appreciate your concern, Thomas, but you seem to be telling me that: 1. no one will be able to gauge the integrity of a web app by reviewing the code, and 2. I should fix the security problems sweis found by reviewing the code . I wholeh
12.
by nickbw 16y ago
Actually I really appreciate Weis' comments, because they're actual concrete problems and implementable solutions. (A bit-flipping attack is not particularly interesting by itself, since the server can inject gibberish any time it wants any
13.
by nickbw 16y ago
Most web security systems don't even give you the option. You sends your data off and you trusts your server. You can't read the code at all because it lives on a box you don't have access to. Any security system you didn't code yourself
14.
by nickbw 16y ago
Heehee. Nice!
15.
by nickbw 16y ago
If you would like to propose improved crypto code, I would love it . Honestly. But "javascript is a messy language" is not inherently an attack. You can obfuscate just about any language. Do you actually have an attack in mind based on th
16.
by nickbw 16y ago
Your objections seem to boil down to a superstitious distrust of javascript. The web may be a messy platform, but javascript is not a particularly difficult language to read, and (if I may say so) the relevant chunks of bonchat are written
17.
by nickbw 16y ago
It's using millisecond precision time for the nonce, yes. Nonce collisions in a normal volume chat are unlikely. If you'd like to suggest improved counter code, however, I'm all ears. :) A corrupted server could alter messages without the k
18.
by nickbw 16y ago
... and why did you give your chat password to someone who will use it to turn off the crypto? >_>
19.
by nickbw 16y ago
Transparently? Without anyone being the wiser? The javascript is there for the auditing. The server-side code is not, but you're completely free to analyze the client-side code to verify that it never sends your password to the server. I've
20.
by nickbw 16y ago
A couple folks have kindly pointed out that it's wide open to to XSS attacks, since it allows full HTML posting. This is 100% true ... and doesn't matter one bit. The only information to steal via XSS is the password, and anyone who can sub
21.
by nickbw 16y ago
That's the point. :) Your password is never sent to the server or stored in any cookies. You have to enter it every time because it only lives in browser memory while you view the page. A cute side-effect of this is that you can chat with y
22.
by nickbw 16y ago
Yikes, thanks for pointing this out! I fixed a rendering bug in MobileWebkit and wound up breaking Firefox. It should work now. Gotta love web development.
23.
by nickbw 16y ago
For any HN crypto nerds: I made a little web chat that even the server can't read. Besides boring old SSL, bonchat.org uses a javascript implementation of AES to encrypt chat client-to-client. There are no cookies, no sessions, and no accou
24.
Bonchat - client-side encrypted web chat for the truly paranoid(bonchat.org)
13 points by nickbw 16y ago|48 comments
25.
by nickbw 17y ago
What are you basing that on? To gold rush developers, perhaps. I spend most of my iphone time in safari, and I don't think I'm alone. With a bigger screen I'd use it even more. This thing is good for the web, which is what we all need to
26.
by nickbw 17y ago
No one gave a crap about web apps for the iPhone because they all wanted to develop apps that took advantage of phone features. (Which Apple has been making more and more accessible to web apps anyway.) The entire scare here is that the iPa
27.
by nickbw 17y ago
Hey, look, another doom and gloom article about the iPad and the end of open development. Let's just try searching it for some keywords. "web" ... not found "browser" ... not found "safari" ... not found Yes, well. When did native apps beco
28.
by nickbw 18y ago
I love SubEthaEdit for single-user editing. It's built into Coda, which is my preferred web development app. http://www.panic.com/coda/ For collaboration, continuous editors drive me nuts. Someone inevitably winds up typing over someone e
29.
by nickbw 18y ago
Thanks for the feedback! The screencast sucks. We know it, and we're in the middle of redoing it. We threw it together quickly because we'd heard from a few people who wanted to demo the service to bosses or co-workers, but thought signing