DogeHouse and I have been officially rejected from Y Combinator. dogehouse.tv/ github.com/ben... #benawad #dogehouse #dogelog ---- Follow me online: voidpet.com/be... #benawad
I gotta say, these logs are probably the best content I’ve seen on RUclips. It’s so interesting to see you discuss issues and how you’re resolving them.
The IP ban and IP sharing thing is even worse. There are providers that save up IP adresses by using carrier grade NAT. So a IP ban could not only affect a whole building but even a whole street or more.
Why don't you make whispers off for everyone by default and when a person whispers you, you get a request saying that x user is requesting. It could last a day until you have to request the user again. If they say no, disable the ability to whisper to that user (and in case the person receiving puts "no" by mistake, they can just whisper back to let them both talk).
@@kukosek It's technical word salad that in no way contributes to the conversation. Yes, Doge used the Litecoin protocol. It was/is a meme, everyone knows this.
If you want to go real-secure on the hashing, use an algorithm that allows salting. A small string of random characters that is different for each user, so that even if a secret salt is leaked, it will only affect that one IP. Also makes bruteforcing basically unfeasible.
It's interesting to hear your thoughts on securing your platform. It all makes sense - phone numbers, social logins, tracking - from the platform perspective, but these are all things that I'd absolutely try to avoid like the plague as a user. Not for nefarious reasons, just for privacy protection/anonymity. Regardless, I love the dogelogs, keep up the good work!
The tech is really coming along nicely. I hope you figure out a way to get good casters(?) on your platform. Maybe if you do your own casts to set an example, or release some "How do make a popular/interesting room" with some documentation/materials? I dunno the answer... Right now it's just lofi and people going "uhhhh". :|
Fingerprinting is way to easy to bypass and the only way you can get Hardware ID info is if you break out of the browsers sandbox (which is considered a vulnerability in most case)
You could categorize each room like educational , music etc. You can have a searchbar to let users search rooms by category. Also in educational rooms have a screenshare option.
You may look into the img-src CSP if you only want to allow images /avatars from certain domains / urls. Quite a simple implementation but super effective.
For the IP hashing you can't calculate the hash every request, otherwise you'll spend most of your compute on hashes. You'll need to use a table. In that case, you might as well generate random IDs for each IP and give those out. In either case if the DB is compromised you're done anyway, but with random IDs at least you'll have forward secrecy (bc they are random)
Network engineer here, do not use mac addresses for bans. Mac addresses are only locally significant. (what does this mean?) It means that duplicate mac addresses do exist out in the world. Additionally source mac address changes depending on the last device that touched the packet, so you would actually be banning the closest layer 2 device (usually a switch) to your server effectively breaking all communication to the server if you decided to try and use the mac address of a given packet to the server as a potential banning mechanism.
A popular site decided to IP ban few IPs when I was in college. You wouldn't realise how messy it gets from there on where randomly people were seeing IP bans after rotation.
What about having the whisper a shadow feature at first and asking the person if they want to enable whispers as they receive a whisper (something like a notification: someone send you a ... do you want to enable whispers)
What I think about the spammer feature is that the time should increase gradually if a user is trying to spam. For instance, the follower will wait for 30 minutes and then he/she will be allowed to send messages even after those 30 minutes if that person is still spamming then we should check the number of messages he or she is sending per second / minute and based on that dynamically increase the time for another 30 minutes or 60 minutes or 60 days or 60 years. IDK maybe this feature is hard to implement or useless
Hi there! We love your idea. We are using this RUclips account to reach out to entrepreneurs with technical skills who we would love to work with or at the bear minimum get to know. Respond to this comment so we can chat!. Oh yeah and one important fact: Our team of like-minded individuals is based in Miami and India. 100% of great ideas stay in the idea phase without a team. Talk to you soon.
On when IP banning is likely to hit other users: I live in an apartment complex that ONLY allows tenants to purchase service from their own ISP.* Their ISP purchases bandwidth from a different provider, then splits it out over a CG NAT to the entire complex. Because they have a monopoly, there is no incentive to offer the ability to purchase a dedicated IP. If one of the other devs in my complex got the CG NAT's dedicated IP banned, I imagine that IP ban would apply to everyone else in my complex as well. *: Yes, I know this is illegal. For brevity, I didn't say "they don't allow other ISPs to install infrastructure on their premises" which is effectively the same.
If they get into the database they can get banned on purpose, and can brute force the secret from the known IP address (so make sure the secret is large)
To avoid banning multiple users / devices all behind the same IP you can make the ban on a hashed user-agent string / IP combo. This is a poor man's fingerprint and gets you very far with identifying unique users, without adding loads of complexity.
I think they didn't have anything against the project itself but the fact that the development is done so differently. Right now you are at the center of everything. In order for this to go from a product to a company will require you to delegate some of your responsibilities. Your strength clearly lies in the technical side of things but you are currently forced to make all the business decisions as well. This leaves you with little time for either. I hope you think about this.
You need to add google login so when we invite our friends they can join, most of them they don't have GitHub account they don't know hat is GitHub anyway
never browsing hackernews again
hgjk
gaming
bababooey
"Hello, the night king."
let us all DDOS hackernews, what do you guys say? :P
“This isn’t going to change anything but my self esteem.” 😂
spoilers; he shuts down the entire project next week
I gotta say, these logs are probably the best content I’ve seen on RUclips. It’s so interesting to see you discuss issues and how you’re resolving them.
hkgj
YES
agreed 100%
I always love the cut to the orange tie 🤣
ghjk
yeah haha 😂
My comment got featured in a Ben Awad video. My life is now complete!
1:24
Just change the name of your startup to CatHouse bro. Now you have a better chance of success:))
gjk
@@PlanetComputer use set of meaningfull words instead of randomly generating words with no meaning
Or poosyhouse
The IP ban and IP sharing thing is even worse. There are providers that save up IP adresses by using carrier grade NAT. So a IP ban could not only affect a whole building but even a whole street or more.
i love the subtle nod to the techlead
YC reject a lot of people don't get discouraged. I'm going to apply to YC soon and if I get rejected, I will reapply... reapply... reapply.
hgjk
Best of luck 💪
"I hope next week we get hacked in a more elegant manner" LOL
Could you please put all the dogelogs in a single playlist so that we can track it easily in future?
ruclips.net/p/PLN3n1USn4xlkZgqq9SdgUXPmgpoxUM9QK
@@bawad Nice
@@bawad I wish I found this before I got to the second-last video lol
I'm convinced that orange tie is your only tie
ghjk
When is he gonna wear it in CS??? Jk
You could allow people to set different "authentication levels" for their rooms, like Discord does with servers
Action 52 font
"...and also therapy." Gold!
Why don't you make whispers off for everyone by default and when a person whispers you, you get a request saying that x user is requesting. It could last a day until you have to request the user again. If they say no, disable the ability to whisper to that user (and in case the person receiving puts "no" by mistake, they can just whisper back to let them both talk).
do Follower Only as default, then make the room admins allow more loose actions if they want to.
For starting a startup the best place to go, has been YCombinator, or therapy. XD
I just realized this now... is the "to the moon" thing coming from Dogecoin? If so, there's another reason for your rejection lol
it got coined in the first cryptocurrency boom, because each day u had another coin go "to the moon". (coined pun is intended)
@Katie Ellen Tu . . . ?
@@znull3356 but he is right tho
@Katie Ellen Tu Dogecoin was just created for the meme. The dev found it funny so he created it.
@@kukosek It's technical word salad that in no way contributes to the conversation. Yes, Doge used the Litecoin protocol. It was/is a meme, everyone knows this.
i like the way you hold that mic ben!
yo it took a double take but I love how you were tieless at first, and then after to the moon slapped on a tie.
The subscriber count is literly exaclly 300 000 :D Just how... Congratz tho Ben!
If you want to go real-secure on the hashing, use an algorithm that allows salting. A small string of random characters that is different for each user, so that even if a secret salt is leaked, it will only affect that one IP. Also makes bruteforcing basically unfeasible.
Make a option to put custom colors to the background so we can make our own color themes
gjkh
He seriously starting to look like a software engineer.
Gz on 300k Ben
It's interesting to hear your thoughts on securing your platform. It all makes sense - phone numbers, social logins, tracking - from the platform perspective, but these are all things that I'd absolutely try to avoid like the plague as a user. Not for nefarious reasons, just for privacy protection/anonymity. Regardless, I love the dogelogs, keep up the good work!
The tech is really coming along nicely. I hope you figure out a way to get good casters(?) on your platform. Maybe if you do your own casts to set an example, or release some "How do make a popular/interesting room" with some documentation/materials? I dunno the answer... Right now it's just lofi and people going "uhhhh". :|
hkj
We live, we live, we doge.
gjhk
Ben, you are the funniest dev on YT (maybe the planet)!! Keep making my day!
the idea about using only Google/GitHub auth temporarily is so good. Thx Ben
Ive watched your content for a long time and I have to say, the doge logs have been the best content you’ve ever made ❤️
yes!!
Simp.
@@31redorange08 not sure you get what that means
As an Angular Dev I'm missing the Angular jokes recently
Post notification gang
ghjk
Fingerprinting is way to easy to bypass and the only way you can get Hardware ID info is if you break out of the browsers sandbox (which is considered a vulnerability in most case)
It's time to make DogeCombinator
You could categorize each room like educational , music etc. You can have a searchbar to let users search rooms by category. Also in educational rooms have a screenshare option.
your speaking speed syncs with the caption smoothly.
Congrats on 300K!
What is this Y Combinator. Why do they decide whether your business idea is great or not? Why do they decide who will have a yacht?
Hi. Nice update and you've seen the review made by Scott Daly on RUclips about Dougehouse and Clubhouse right?
Also on Android, Mac addresses are randomly generated by default. So they are not the device's ip
Re shadow features, you can notify the sender that the receiver has turned shadow messaging off if you're worried about senders feeling ignored.
Even we just got rejected by Ycombinator and this video came up in my feed...
You may look into the img-src CSP if you only want to allow images /avatars from certain domains / urls. Quite a simple implementation but super effective.
Idea for DogHouse: Add tags for rooms. Like each room can have a tag to generally describe what its about like (tech), (political), (general), etc.
Sorry to hear that man
hjgk
I'm glad you didn't get accepted, YC is not worth it anymore. Especially for social apps.
About turning off whispers, it should tell you that the person whispered you but not tell the contents of it, unless you turn whispers on.
5:24 That is hopefully not possible, unless your browser is doing some very invasive stuff.
For the IP hashing you can't calculate the hash every request, otherwise you'll spend most of your compute on hashes. You'll need to use a table.
In that case, you might as well generate random IDs for each IP and give those out. In either case if the DB is compromised you're done anyway, but with random IDs at least you'll have forward secrecy (bc they are random)
Network engineer here, do not use mac addresses for bans. Mac addresses are only locally significant. (what does this mean?)
It means that duplicate mac addresses do exist out in the world. Additionally source mac address changes depending on the last device that touched the packet, so you would actually be banning the closest layer 2 device (usually a switch) to your server effectively breaking all communication to the server if you decided to try and use the mac address of a given packet to the server as a potential banning mechanism.
Y Combinator for my next VR startup.. 3 years solo development ahead though just for the demo. See how that pans out.
A popular site decided to IP ban few IPs when I was in college. You wouldn't realise how messy it gets from there on where randomly people were seeing IP bans after rotation.
Maybe someone there loves Angular, so he rejected,
you are awesome bro.....
so much you learn about tech.
What about having the whisper a shadow feature at first and asking the person if they want to enable whispers as they receive a whisper (something like a notification: someone send you a ... do you want to enable whispers)
I feel like you're giving room creators to much power.
just notify the user that the recipient turned off whisper. no big deal
use azure b2c, or okta as an idp. at least you dont have to worry about building a system from scratch.
or cognito
Ben's just out here roasting the whole industry
Awesome video! like it
ghjk
Would an Image proxy like caravaggio prevent malicious Images?
What I think about the spammer feature is that the time should increase gradually if a user is trying to spam. For instance, the follower will wait for 30 minutes and then he/she will be allowed to send messages even after those 30 minutes if that person is still spamming then we should check the number of messages he or she is sending per second / minute and based on that dynamically increase the time for another 30 minutes or 60 minutes or 60 days or 60 years. IDK maybe this feature is hard to implement or useless
I hope you were at least checking if they were `javascript:` URLs, because that could be an easy XSS vector
"when starting a startup the best place to go has been y combinator and also therapy" 🤣🤣🤣🤣🤣🤣🤣
2:19 But I saw a D as an avatar of one user's profile.
hjgk
the way he pronounces url’s
If you can't join them, beat them. Announcing DOGE-COMBINATOR !!!!!
This is quite informative and funny at the same time. 😂😂😂😂
Wow, they rejected a future billionaire.
Hi there! We love your idea. We are using this RUclips account to reach out to entrepreneurs with technical skills who we would love to work with or at the bear minimum get to know. Respond to this comment so we can chat!. Oh yeah and one important fact: Our team of like-minded individuals is based in Miami and India. 100% of great ideas stay in the idea phase without a team. Talk to you soon.
5:39 trying to fingerprint Brave Browser when one of its main features is to prevent fingerprinting lol
On when IP banning is likely to hit other users:
I live in an apartment complex that ONLY allows tenants to purchase service from their own ISP.* Their ISP purchases bandwidth from a different provider, then splits it out over a CG NAT to the entire complex. Because they have a monopoly, there is no incentive to offer the ability to purchase a dedicated IP. If one of the other devs in my complex got the CG NAT's dedicated IP banned, I imagine that IP ban would apply to everyone else in my complex as well.
*: Yes, I know this is illegal. For brevity, I didn't say "they don't allow other ISPs to install infrastructure on their premises" which is effectively the same.
You should probably do a video called, directing the Y Combinator function with Javascript
If they get into the database they can get banned on purpose, and can brute force the secret from the known IP address (so make sure the secret is large)
You could’ve put AngularJs as that garbled string :)) 6:15
So is this episode 8 or 9 of this I'm in confusion
This YC thinghy sounds like a Rust multithreading entity
Can't wait for the next one
You can just let the person disable whispers so they can't get DMs from anyone except people who they choose to get DMs from
To avoid banning multiple users / devices all behind the same IP you can make the ban on a hashed user-agent string / IP combo. This is a poor man's fingerprint and gets you very far with identifying unique users, without adding loads of complexity.
Idea Suggestion: Can you make like a last seen online thing for friends?
I don’t know why I watch this but I still like it
Do you have any ideas on how your test functions got deleted?
🥇
ghjk
Add a Access-Control-Allow-Origin header
Thoughts on a room-wide volume bar?
if you click on your profile then voice settings you can adjust, will probably put this in a better place at some point
what is a the next milion dollar idea that don't use chat...
I'd invest. Consider crowdfunding dogehouse
you can spoof fingerprints and/or just use another browser
I feel like there are much more malicious things one can do with a lack of input validation, such as XSS.
why does this remind me of dark souls let's plays
Could make it better this way. Have two options , someone can be in doghouse or cathouse
127.0.0.1, Hey that's my IP
hgjk
no, that's our IP
@@piyushsahu6045 *communist Tom image*
I think they didn't have anything against the project itself but the fact that the development is done so differently. Right now you are at the center of everything. In order for this to go from a product to a company will require you to delegate some of your responsibilities. Your strength clearly lies in the technical side of things but you are currently forced to make all the business decisions as well. This leaves you with little time for either. I hope you think about this.
you can get the unique device id with MediaDeviceInfo.deviceId
One and only honestly speaking programmer .....
Are you going to add wait time between messages? that way maybe spammers won't be able to fill the chat win only one account.
You need to add google login so when we invite our friends they can join, most of them they don't have GitHub account they don't know hat is GitHub anyway
I just bought allbirds because I need new shoes and they look comfy, and now I feel attacked
" and also therapy " hahaha omg comedy gold