Isso – Open Source Alternative to Disqus | Hacker News Reader

Isso – Open Source Alternative to Disqus

posativ.org

110 pointsavinassh27 comments

I noticed they use a Bloom Filter based on ip address to prevent people from voting multiple times. According to the implementation[1] it uses a 256-byte structure and limits the total number of votes on a post to 142 [2] (more than that and the false-positive rate > 0.001). This is stored as a sqlite BLOB on the same row as the comment.

But if you're limiting votes to ~142 anyways, you can just store the exact ip address of every voter (packed in the BLOB at 4 bytes each) and it would only reach up to double the space (~560). But since the overwhelmingly vast majority of comments won't get nearly that many votes, you'd actually be saving space compared to keeping a bloom filter for each comment.

It seems like an overengineered and unnecessary technical complexity.

[1]: https://github.com/posativ/isso/blob/master/isso/utils/__ini...

[2]: https://github.com/posativ/isso/blob/master/isso/db/comments...

I guess the point is to not store ip addresses.

Given the focus on allowing anonymous commenting [1] this seems to make sense.

[1]: http://posativ.org/isso/docs/#what-s-wrong-with-disqus

In that case you could store a hash of the IP instead.

With a known structure, a hashed IP could be reversed quite easily couldn't it?

We're limited to ipv4 so even if you hash it you could still test every possible address within a few minutes. You can even do the same with the bloom filter, since there's at worst only a 1/1000 false positive rate (and likely much smaller). The bloom filter isn't designed to provide security, and trying to make (ipv4) IPs private if you're using them as identities is a lost cause.

Is there an XKCD[1] comic about over-engineered solutions?

I'd be tempted to go with exponential back off for voting. eg. the more votes, the less effect they have on the total score.

[1] http://en.wikipedia.org/wiki/Randall_Munroe

I love the idea, but I don't love forcing non-technical users to learn Markdown.

Hmmm, actually, it occurs to me that formatted comments are in general, annoying and ugly, so perhaps hiding the fact that formatting is even possible by not providing formatting buttons, is just fine.

Nobody likes Markdown. And even who does, can't really use it.

Here is an analysis worth reading: http://ux.stackexchange.com/a/15929/57347

No mention of the word 'spam' anywhere on the site, apart from rate limiting. To me, spam handling is pretty much the primary feature of a comments system.

Thoughtbot is also working on something Discuss-like:

https://github.com/thoughtbot/carnival

Made in Haskell, so it compiles to a binary for you deploying pleasure and performance needs :)

Link to GitHub - https://github.com/posativ/isso/

Nice! I have a stupid blog generator (https://github.com/tallesl/deadsimplelog), might add support for it :)

P.S.: I may be completely wrong but... isn't that a Pokémon (on the logo)? Being so, is possible that you guys would have copyright issues (right?).

yes, its a pokemon - a Wynaut

Which (apparently) is named "Isso" in the German version of Pokemon.

Added your blog generator to StaticGen now :)

http://www.staticgen.com/deadsimplelog

I didn't know StaticGen...

Ty :)

I can get that comments are not "big data" but SQlite seems underwhelming.

Any reason why this choice was made?

Underwhelming? Do you have a case for this where SQLite wouldn't be good enough?

When having more than one web server (and no shared file system) ?

"SQLite is not designed to compete with Oracle. SQLite is designed to compete with fopen()."

http://www.sqlite.org/whentouse.html

How about something towards the Cloud direction, like AWS RDS? MySQL, Oracle, SQL Server, PostgreSQL or Aurora might work better.

For me, it's not really so much "not good enough" as much as it is "I'm already using PostgreSQL as a database and I'd rather not have to maintain two separate SQL database implementations on my servers if I can avoid it".

Well on the plus side, sqlite has no daemon and pretty much requires no care and feeding.

However, I also think it is totally wrong for this use case.

True, though it still means having to check yet another place to make sure everything's backed up properly, etc.

If you are going to run your own comment system why not embed them in the HTML? At least then the search engines could index them. Does it have this option?