Hacker News Reader

Comment by ploggingdev | Hacker News Reader

Shameless plug : As someone who was fed up with Disqus, I decided to build my own commenting platform ( https://hostedcomments.com/ ) with a focus on privacy : no ads, no tracking scripts. Having come across numerous instances of people complaining about Disqus and some even willing to pay for an alternative, I realized that this could potentially be turned into a SaaS. You can see the commenting system in action here : https://www.ploggingdev.com/2017/08/building-a-disqus-altern...

Any feedback is welcome.

Edit : If you're interested, you can register and add comments to your website. Currently there are no limitations on user accounts and there is no payment processing built in to the signup flow, so no CC required.

View on HN

Good idea!

Two things:

1. Please make sure you support all languages (utf-8).

2. Some public forums want anonymous posts that they can check and allow manually but still need to know who it came from (newspapers in Sweden does this a lot). Usually requires entering an email adress every time and a checkbox "I preffer to be anonymous".

> 1. Please make sure you support all languages (utf-8).

I'll need to cross check, but I think with the default settings, it's currently supported.

> 2. Some public forums want anonymous posts that they can check and allow manually but still need to know who it came from (newspapers in Sweden does this a lot). Usually requires entering an email adress every time and a checkbox "I prefer to be anonymous".

Good idea, I'll add support for anonymous posting with appropriate moderation policies to prevent spam/abuse.

Thanks for the feedback.

I almost did this, there are a couple around (remarkbox.com for example). What I contemplated, as a way to circumvent ad blocking, was to offer a "white label" service, so the user could configure "comments.mysite.com" with a CNAME to point to www.hostedcomments.com so the comments would appear to be hosted by the same domain.

I guess that would fool most ad blockers, and users would have to blacklist the "comments.mysite.com" on an individual basis. Seems kind of shady to me. Have you considered this?

Two points:

There's nothing wrong with using the CNAME if you're only serving comments off that domain.

Also, I'm pretty sure you can regex adblocking DNS entries, so you could block on comments.. pretty easily with minimal casualties. You'd have to intentionally randomize it to bypass adblockers... Which will probably get your domain listed as a badhost by most peers.

(Smarter adblockers would check for CNAMEs and IP blocks, but let's not ecalate the arms race for no reason.)

Is this open source and can be self-hosted? If not, it's just another Disqus.

>Just copy paste a little code snippet and we manage everything.

It's another Disqus.

This does not mean that ads are the only possible model, of course.

It's closed source.

> it's just another Disqus.

The main difference is the privacy aspect since I don't track users or serve ads. Disqus' business model depends on collecting user data and monetizing it, unlike mine where I directly charge website owners to embed comments.

Closed source means users unable to verify your marketing claims about tracking. Privacy conscious users like myself would prefer an open-source commenting platform, even one with tracking, since we could verify how it worked (and also take it a step further and circumvent tracking by examining the source).

Also, what's to prevent a provider from double-dipping? If you can sell the product plus your users data you can presumably generate even more income. For example, mobile phone carriers sell monthly plans to users and some sell users location and usage data (usually "anonymised") to advertisers.

I don't mean to imply that you are doing these things, or that you ever would, but without independent verification by a trusted third-party, all the users have to go on are your marketing claims. What's your plan for dealing with sceptical users?

I guess I'll have to earn trust the long, hard way :

* clear policies on how user data is handled

* explicit commitment to never sell user data to third parties

* transparency about any specific concerns users might have

* no dark patterns to trick users or website owners

* a track record of good decision making and staying true to the commitment to privacy

And for people who find me through forums (including HN) or via my blog, I think my privacy + no bullsh*t leanings are pretty clear.

Since I'm solo and bootstrapped, I don't know what options I have regarding independent verification of my claims, but if I get to a point where I can explore such options, I'm all for third party verification of my claims.

Could you tell why you choose to make it closed source?

Not op, but here is an obvious and valid one: Because it is easier to monetize that way.

You don't make money with open source unless you are big enough.

To prevent people self-hosting and selling an overpriced service to people who do not know better and will be disappointed when the service closes or when they want to migrate their data to another service.

Appreciate the quick response. That's a very good list, and I would only add "all user data will be deleted if service is sold to another company" to it.

What do you mean user data ? As in every commenter owns his comment or as in the paying customer owns the data from the commenters ?

This may make quite a legal difference when the justice system gets eventually involved.

Most of those are not a problem with closed source per-se (closed source binaries you run yourself can still be inspected, monitored and even reversed). It's a problem with SaaS model. Even if you open-source everything, how can I know you're actually running the same code you've open-sourced? I can't. And since most SaaS businesses track users like there's no tomorrow, you get perfectly reasonable distrust by default.

Closed source means there is no way to migrate from you as a provider and no way to keep the comments when your service eventually folds. That's a "no deal" proposition, thank you - but no thank you.

> I don't track users or serve ads.

That's probably what Disqus would have said too if you asked them when they were in your phase. Privacy concerns aren't solved by promises, it's solved by infrastructural and technical decisions that make tracking impossible or/and simply not profitable.

…and if I was looking for a hosted solution I'd probably go for https://www.discourse.org/ as it's open source and possible to self host if I'd like to migrate to that some day.

> The main difference is the privacy aspect since I don't track users or serve ads.

If history has shown us anything, it's that everyone has a price and if someone comes along with enough money you'll change your tune. No thanks.

what do you mean privacy aspect ? Is there any encryption going on ? Who has the key ? How is the code audited ? What's your stance with law enforcement ? Is there zero knowledge ? Is it possible to export all data to migrate to another service ?

AFAIK I agree that this is another disqus, third party hosted, no privacy expectation, vendor lock-in, etc. also very expensive.

You have the ability to turn off data sharing in your admin settings. You can also opt for a paid plan to turn off ads or if you are small enough then you can use the service for free w/o ads. There are options.

Following that logic any non-open-source comment platform would be another disqus.

Yes, that's exactly what it means.

Still, I would say the problem isn't open source or not, it's the SaaS model. SaaS is the ultimate closed source, because you have no way (nor right) to tell what the service is doing with your data.

Are facebook comments "just another disqus" then?

In the sense that is under discussion, yes.

Will it survive sesta ?

Reply on news.ycombinator.com