Hacker News Reader

Comment by jorjordandan | Hacker News Reader

The web site says apps cant perform psych experiments, and links to the contentious facebook emotion split test. I'm pretty sure you'll be able to do split testing on these apps...

That small criticism aside, I'm very curious how developing for sandstorm would be different from from developing for a typical host. Anyone know the major differences?

View on HN

Once our sandbox is complete, apps will not be able to "phone home" unless the user grants permission, so users will need to opt into any experiments.

Currently there are two reasons this isn't true yet:

* We haven't implemented client-side sandboxing yet. It's not incredibly hard (content-security-policy header, some tweaking of apps), but hasn't hit the top of the priority queue.

* The server sandbox currently has some intentionally-poked holes allowing apps to do things like pull RSS feeds from the internet. We plan to close these once the Powerbox UI is implemented, which is the main permission-granting interface, but that's a major project and we wanted to get some useful apps working in the meantime.

Couldn't you do an AB test by having the code choose a random number on install (or first write to the datastore) and have it leak the results by loading an image or iframe with a special url/query parameter?

With Content-Security-Policy we can prohibit an app from using images or other assets from third-party servers.

Sure, you could write an app that does A/B testing, but the whole idea is that people will use Sandstorm to run _personal_ servers/apps. And A/B testing your own reaction to an app doesn't make much sense.

Runtime permissions of these apps will be easy to control, so the Sandstorm platform will prevent apps from phoning home without your permission.

Again thanks! But using Facebook was still a poorly chosen example of what their apps won't do, since they aren't aiming for hosting large customer facing apps like a social network. Perhaps that is what contributed to my confusion in the first place. Now I have a better understanding of what it's for.

Ah, but you could write an A/B testing page and then share it easily with your friends - part of the value proposition is 1) hosting your personal apps and 2) fine-grained sharing of it with others. So it wouldn't be a huge sampling, just your friends.

I see that many old and new web applications run inside sandstorm, so it's a framework to manage apps. They probably have to be adapted a little but I don't think that WordPress has been rewritten to fit into sandstorm. Anything will do, probably.

Furthermore you can download sandstorm and install it on your server.

One major thing that I can think of off the top of my head is that they provide the login and authentication for you and you just plug into it. They also have a sharing system in place that I think you can easily plug into.

Reply on news.ycombinator.com