timg

Correct. Simple frameworks that you then add more complex components to are better. Same for OS'.

Yes, correct on the second part also.

Can you explain to me how unsexy problems like browser incompatibilities (yes a major pain) lie anywhere within the scope of webpy? Those seem to lie within the scope of the templating system and js library that you choose.

A larger, more complex framework does present serious problems when you have to architecture everything in strange ways to meet scaling needs or otherwise.

Note how much the twitter guys were so scared by ROR's complexity that they resisted doing the most trivial modifications? I want to understand my framework "all the way down." This is much the same reason I use linux.

Yes, I understand your concern. For sure, aaron was on drugs when he mentioned this quick, non-secure fix -- even though the asker most definitely had very loose security requirements given that he was using nothing more than CGI.

\But\ from the beginning, everyone using webpy has seem to know flup sessions to be the recommended way of doing sessions:

http://webpy.org/track/wiki/SessionsWithFlup

Let's look at this another way though. If you really need security, then which is better: a simple, quickly verifiable codebase like webpy, or a massive, magical code base like django and turbogears? Do any frameworks make any guarentees of security?

I have seen several high profile sites within the last two years with major, obvious security problems. As hard as this is to believe, I no longer think that security is what will determine the success of most any web app -- at all. Unless you have special needs, feelings of security should not be your primary metric in evaluating a framework.

Exactly. Webpy is for programmers, django for people who want to feel like programmers, but are really just walling themselves into pre-defined ultra-boring patterns.

That security gaffe was in Markdown - a piece of junk that I've been pointing out flaws in for the past year.

When you have this many people on your app, this will always be true.

90% of people in general are not net savvy.

No and Yes. I am thinking of releasing tons of code for it though as soon as I wrap up the large project I'm working on.

I highly recommend webpy.

edit: downvote?

I was going to make a joke about this topic before I read your comment but this is actually true.

You know it's not cool anymore when grandma is on it.

Hey thanks! Do they cover all subdomains also though?

How about you give us an example of one?

If you are wondering about the volume of planning we do, there's no question that I've thought about marketing for a huge amount of time.

Not the only thing.

You do realize that this would be the death of so many startups, right? They're already demonstrating that they would rather lift ideas from other companies than buy anyone.

I don't care for the founders much at all. They obviously got very lucky in choosing their product. Their technology is as boring as they come (PHP et al.)

More that I don't like about facebook, the product:

They "sell" privacy. So much of their marketing revolves around the idea that what you do on facebook will only be known among those you want it to. And yet here, facebook fails miserably. It lets in exactly the worst people: law enforcement, employers, school officials.

Oh and the content of their photo galleries is trash because the design encourages people to upload every single picture on their harddrive. Early, early myspace even had them beat in this area.

I don't know, I just never liked it or them much at all.

Was thinking of doing something very similar a while ago. Good luck.

This is why I hope that all of facebook's new apps fail. They have a large enough userbase already to crush anything new.

Wait, he doesn't say why.

I have always been amazed at how few people end up creating a new product where there is a need.

What must it be, 1 in 100,000?

K, I was just confused about the story. I think I even recall the POF guy saying that SEO is totally useless for dating sites. Who knows.

Read Schneier's take on it that I linked to. He agrees that this false sense of positive identification can be WORSE than none at all. And that has to do with the warnings that the browser gives, not the matching up of the domain names.

Second, my argument has always been that the browser should not harass the user of a site that has not taken part in this PHONY identification procedure.

Heck, even google adsense has seen through this scam and not bothered to pay the fee.

Edit: To clarify, most users equivocate signed SSL certificate == trustable site. That is WRONG. Verisign does not vigorously establish the non-evilness of your site.

Example: http://blog.washingtonpost.com/securityfix/2006/02/the_new_face_of_phishing_1.html

"""Anytime you use a self-signed certificate ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you nor the second party has any way of knowing what's going on. That's why we NEED a warning every time we encounter a self-signed certificate."""

I believe that you misunderstand the technology.

"""I don't see what's terrible about browser makers trusting certain authorities"""

Because the authorities trust anyone who pays them 20 bucks. THEN, the users trust any site where the address bar turns yellow. Do you see the break in the chain here?

That's terrible in my book. What if you are running an entertainment site with lots of subdomains and for every single subdomain the user gets harassed with this question?

These certificates have nothing at all to do with "authority." Just think about it, what exactly do they prove?

Why should you only be allowed to speak in confidence with well identified parties (not that verisign remotely attempts to identify anyone)? Think carefully.

Related: http://www.schneier.com/blog/archives/2005/12/new_phishing_tr.html

famous last words.

"""I once again complained in my thread about my sites lack of SEO results it was September of 2003, I had 10k signups now and only a ~100 visitors a day from google and other 2,000 unique visitors a day from who knows where."""

So you guys were flat out wrong in the other thread when you said this guy got all of his traffic from SEO.

What I hate is that firefox/IE complain if you don't get one of these paid SSL certificates. The encryption of HTTP traffic should be free and without unneeded burden.

Almost none are remotely capable of this.

Start compiling Gentoo. When it's done, you'll be ready for it.

At the rate buyouts are increasing, let's put it at a nice round $60B.

Agreed.

But, shouldn't we be asking the poster "why"? If the "why" is because he wants to be good at programming, then I would suggest that he first does some light c, a tiny bit of assembly, and a get a basic understanding of FP languages and the insanity of advanced OO in java.

In the end though, be sure you are using Python. Heck, even if you get bored along the way, throw some python in.

A [Warning] though: python will spoil you. Good luck going back to a more verbose, rigid language, should you be forced to.

Demo not working for me. Even if it did though, I agree that you should make more apparent the immediate use that the site has for the new user.