Show HN: We open sourced our social website (built with Play) and mobile apps | Hacker News Reader

Show HN: We open sourced our social website (built with Play) and mobile apps

labs.steren.fr

20 pointssteren12 comments

Open articleView on HN

Another biiiiiiiiiiigest hole is config :)

https://github.com/beansight/beansight-website/blob/master/c...

Guys,

you had to hide your gmail account user/pass

had to hide facebook keys

twitter keys

application secret..

I just successfully authorized on gmail with your account and can read lots of mails, responses.. not saying that I can send emails on your behalf..

Thanks. The DB credentials were in variables, but not these. I am changing the mail credentials. Regarding TW and FB login, application have been disabled as social login are not properly working anymore and we don't have the manpower to fix them.

np, don't forget to clear commit history for config :)

some of db details are in history too

And that's now done. Thanks. They were old DB details, but anyway, I cleaned the file.

And I don't want to pile up on the guys, and I'm happy that they open sourced they code, but this is why you really need a bit more professionalism and yes, a bit oversight in our profession. While I doubt it, xytop (and many others) were able to log into your email account, collect addresses, spammed contacts, etc.

Please, be careful with these kinds of things.

Apart from that, thanks for open sourcing it. Not my choice of framework but I'm sure others will find it a valuable source of knowledge.

https://github.com/beansight/beansight-website/blob/master/a...

51 lines for imports and 45 lines for code..

that's all about java..

Well you know these imports are added automatically by your IDE. They probably were not cleaned.

Sincerely, I did a lot of languages, and dependency management in Java is working much better than... say JavaScript :)

In modern PHP frameworks (Zend, Laravel..) there are usually no dependencies at all in classes :)

Thanks to autoloading

That is a lie. There are plenty of dependencies, you just don't know what they are.

Yup. I'm not sure why the .* in imports were always considered a bad practice!

You are right, I don't know, maybe it was a way to clearly see the dependencies.

It may also be due to IDE: a regular way to add package is often: I write my code, IDE is not happy because I did not import Class, I automatically fix the issue, which leads to importing only the required class.

It's not that many packages, I'm not sure why they didn't just use import models.* rather than importing 32 classes from that package independently.

Reply on news.ycombinator.com