Fluin: Like a cross between IM and a Forum | Hacker News Reader

Fluin: Like a cross between IM and a Forum

fluin.com

54 pointsfluin38 comments

Open articleView on HN

http://fluin.com/?search=%22%3E%3Cscript%3Ealert%28%27XSS%27...

A little security flaw ;)

And another:

http://bit.ly/eN40yI

Edit: Using a bit.ly link, since HN's URL parser is leaving out the closing ].

but that doesn't work?

It does. If you look closely, you'll see that HN's URL parser ignored the ] at the end of the URL. If you click on the URL and then add a ] to the end of it, your JSON will be valid and you'll see two alert boxes.

Edit: But yeah, my bad for not noticing that earlier. I've swapped it out for a bit.ly link now, so it works properly. I'm headed to sleep. :)

It shouldn't affect the feed though (at least it doesn't seem like it)

That isn't the goal of an XSS attack. :P

http://en.wikipedia.org/wiki/Cross-site_scripting

Thanks for your help!

This one is fixed :)

It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box.

http://fluin.com/?search=Search%22%20onclick=alert%28documen...

Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.

thanks! I'll have that fixed

So you crossed Reddit with Google Wave?

I worked on Wave (and loved it) and I am similarly falling in love with the real-time thrill of this. (And the anonymous nature... finally, all my true feelings can come out).

Plus 4chan

It's for that reason alone I give it a chance of wild success.

Why not put Helvetica before Arial in your stylesheet? Mac/iOS/Galaxy tab users will see better typography, and nothing will change for everyone else.

Other than that, super cool concept!

http://minimali.st/2010/03/helvetica-and-arial-font-stack/

I would argue "a large percentage of Windows users" do not have Helvetica installed as a system font (CS fonts are not used for web rendering unless you also install them as system fonts), and I would argue Arial looks bad no matter which platform it is rendered on :).

Helvetica, Verdana, Arial, sans-serif

Precisely.

Interesting; kinda threaded live chat. Hard to know where to look for new messages, with them appearing arbitrarily in middle locations.

Perhaps all new messages could appear at top or bottom, with really long background thread-lines tracing them back to their antecedents?

And some sort of quick expand/collapse, or focus/defocus, for narrowing in on just one thread?

Or maybe even: the thread you're 'watching' if left-justified in a generously-sized font, and everything else is right-justified in a very compact font – making it possible to focus on one thread, but maintaining peripheral awareness of (and one-click-focusability) on all others?

Added: I see that there is some sort of click-to-focus, but thus far the logic of its effect eludes me.

love the idea. lots of fun. a few usability ideas:

-make hyperlinks clickable.

-the top menu bar is hard to click -- make the surrounding whitespace clickable as well.

-on http://metal.fluin.com/, if I click the black large font text on a list item, it should expand the thread all ajaxy.

-give anonymous users names like "user14232" or gravatars so we can see conversation threads/replies. no-register account! track them with cookies, it's ok. some people will get riled up, but not your users, because they'll think it's fun.

Making hyperlinks easily clickable will overrun the site with spam.

Good point. You can blacklist ips, perhaps.

At the very least, only registered users?

Very interesting indeed. How is it hosted? I am impressed that it can withstand traffic from both Reddit and HN without feeling sluggish.

"I wish I could anchor the page to one comment, prevent it from scrolling." - anon

If the mouse has focus on a post, it should stop the scrolling. (roll over or input selected)

Also, I think there should be a timer to auto hide comments from a root node, so only recent posts show the nested trail. This will stop the page from getting giganto

I tried to create a fluin called (lisp programming) and it attempted it but then subsequently died as obviously the parens aren't welcomed in the subdomain. Maybe make it clear that the name must be a valid subdomain name or put an input filter/mask on the text box?

Things move too fast for me. I'm trying to understand what I'm looking at exactly.

Now someone needs to write a script to compare the writing style in the posts to the writing style of hackernews commentors and reveal who is who. :)

[Also take into consideration any comments on gender, location, time, etc.]

This is awesome. You may want to add a linkify script to turn URLs into clickable anchors.

I really like it! I think it has some potential.

agreed, just asked a question, got a reply almost immediately.

Kind of like a text version of chat roulette?

Ok, testing 1, 2, 3

Foo is Bar! Bar is Foo!

definitely holds potential

chat room anyone?

good times

Reply on news.ycombinator.com