Pandora App Store Suggestion

[craigix]

Quick question Craig, have you installed Google Analytics to track the site? Am pretty good with it if you need any help.

Edit:
Just checked and looks like you are not tracking it, again if you need any help in that am here.

I just wrote my own little counter. I have a GA account and might use it, but I'm wary of it slowing the site if google takes a second or two to answer.

It's something we might add in to 2.0 which we are working on now (2.0 adds almost all requested features and I'm excited about it).

Oh and you could make a Pandora based software 'store' I've planned for that in the code, but I'm a fan of the 'run anywhere' of html.

 

[dflemstr]

Yawn. Stop pretending the appstrore is broken just because I didn't do it how you would do it.

I've not said that it's broken, only that its current implementation makes it impossible to make a GUI front end, that it doesn't follow any well-established design principles, and that it has severe rendering issues in different browsers.

It's working fine and being used and browsed by a huge number of people daily.

Yes, because it's the officially sanctioned web site and users don't have a choice to use anything else currently.

And I don't know, how many errors have you seen? I don't see you reporting them anywhere? And where are these security holes you also seem to be keeping secret (why?).

I've reported them all, multiple times even, and they still persist.
I know that you're a busy guy and aren't able to fix them all because of a lack of time, and I would respect that, if you said:
"Yeah, I'm aware of these bugs, and I'd like someone in the community to fix them for me", or "I'm gonna fix them before the 25th of June"
But you instead say:
"What bugs? AFAIK, my implementation is bug-free! But since you claim to have found bugs, tell me what they are and I'll fix them, maybe, if I can remember to do it."
Why do you insist on going on with this? There are ready-to-use solutions out there that you can use, you don't have to do this... You don't have to be pushing this implementation. Everyone's been telling you: "You shouldn't use Perl", "You should use a database", "You should use PHP", "You should make it possible to make a GUI tool". And you haven't reacted...

Some examples of unfixed bugs:

• When you're logged out, you can still see the "delete" icons besides comments, and you get an internal server error if you click on them.
• There are comment listings like this:
  

  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :

  ...which not only looks broken but doesn't make any sense.
• Images are not resized on the server, so I have to download sometimes 1 MiB big screenshots for certain apps.
• Download pages, the search page, etc, don't validate as valid HTML, and display rendering errors in Chrome, Firefox, IE 6-8 and Konqueror.
• You use some kind of 3 second timeout hack for downloads, instead of using a direct link, which seems to work properly in Firefox for some reason, but not in other browsers.
• The downloaded files don't use the correct MIME types, don't use any Attachment headers, etc.
• The site in general doesn't send any cache headers so the whole page is reloaded on every request.

 

[milkshake]

There is nothing wrong with the app store per say I mean it does the job all I only ment is that a native solution may have/still work/ed better.
I agree with pleng on php/mysql becuase as well as having a php website u can write a very small php script to output db information to json or XML or just simple a simple array which can then be read by native code even simpler still bypass php all together and talk direct to the database which I'm sure could be done on the pandora.
That way it's faster as it doesn't need to Download any HTML code or images other than maybe a screencap or movie URL but that would just be string informion (the actual image would not come from the db but the Server the image is stored, so the overall request on the db is smaller.

Also you could cach the the db Info locally(for offline viewing) and only renew the cach when ur cached version is out of date thus saving on more db requests.

Let me know what u guys think could/should this be done?

@craigx I like ur store im not trying to be disrepectfull cos u have done a brilliant job on it was just suggesting ideas/improvments for our new gadget for the future.

 

[sehs33]

@Craigix: You can always add the tracking code in the end of the page (so the delay will not affect the page's content) or even better you can use the latest Analytics asynchronous tracking code which should have even a more minimal effect on page load.

Getting deeper you can even track voting, reviews, comments and 'share via' trends to see what features are actually most used to try optimize them.

All this can be very helpful when paid apps are added (I remember you saying that the app store was designed with the intention to allow paid apps one day).

 

[craigix]

Some examples of unfixed bugs:

• When you're logged out, you can still see the "delete" icons besides comments, and you get an internal server error if you click on them.

• 
  
  Great I'll fix that today.
  

  [*]There are comment listings like this:
  

  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :

  ...which not only looks broken but doesn't make any sense.

  
  Where?
  

  [*]Images are not resized on the server, so I have to download sometimes 1 MiB big screenshots for certain apps.

  No. They are max 50kb. And it's only because Ed had not installed the image resize perl module.
  
  Which browser does not download the files?
  
  The rest of the list isn't anything I'm worried about now.

 

[Bosbeetle]

The thing I dislike the most is that the apps store and the archive are not synchronized. I didnt see numpty physics and now 2 more games

 

[dflemstr]

Some examples of unfixed bugs:

• When you're logged out, you can still see the "delete" icons besides comments, and you get an internal server error if you click on them.

• 
  Great I'll fix that today.

• 
  The problem is that the issue cropped up in the first place. If I was working for a company that needed an app store (not many do...) and if I had made such a mistake, I would have been fired on the spot as a project manager.
  Yes, this is an open source community that pays you even if you don't make an app store, but some kind of QC should still be expected.
  
  

  [*]There are comment listings like this:
  

  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :
  The Following comments are from an older version of this app :

  ...which not only looks broken but doesn't make any sense.

  Where?

  http://apps.open-pandora.org/cgi-bin/viewapp.pl?/Emulator/handy-0.5.inf
  
  

  [*]Images are not resized on the server, so I have to download sometimes 1 MiB big screenshots for certain apps.

  No. They are max 50kb. And it's only because Ed had not installed the image resize perl module.
  
  Which browser does not download the files?

  Let me first make a point: It shouldn't matter which browsers don't download the file. You're using a non-spec implementation which should be avoided for reasons of principle alone.
  It's like saying: "Yeah, I'm using a coal engine in my car, which roads can't it drive on?" instead of just using an ordinary engine thereby solving all problems.
  
  Anyways, it is impossible for me to download the files in Chrome 6.x unless I explicitly enable the non-strict mode (the strict mode is on by default).
  Konqueror also fails at downloading the file, but not because of the timeout hack, but instead because the file has a mime type of "application/x-download" which is an invalid file type.
  Then we have all of the lightweight browsers - Arora doesn't see the file as a file download, but as a resource download, so I can't do a "Save as..." on it but instead have to let it download to "~/Downloads" and copy it from there; not such a good thing if you e.g. have your home dir on a NAND disk. I've seen similar issues in similar browsers.
  Finally we have lynx, elinks, links, etc, who all fail to download the file completely since they don't support dynamic pages.
  And let's not start talking about wget, the tool that would be used if a GUI front end was to be developed...
  
  
  About the image sizes: I meant the accumulated download, not individual images... Also, 50kiB on *every page request* is still too much (It's normal that a page request weighs 2kiB).
  
  About "not caring about the other issues": Why not? You have to bear responsibility for not overloading users' internet connections, and adding cache headers is something that can be done with 2-3 lines of code. There's no reason for you *not* to do it, and yet you don't.

 

[craigix]

Where?

http://apps.open-pandora.org/cgi-bin/viewapp.pl?/Emulator/handy-0.5.inf

Ah, only when not logged in, I see. Tiny fix.

 

[Pleng]

You don't want to expose your database, ever. Or that's at least what I've learned.

I would have thought a restricted user to the database should be fine, especially if it was only accessible via a binary blob.

But yea, milkshake has proposed a much better solution - php scripts on the server that could return an xml document to the non-browser app would make much more sense!

 

[dflemstr]

Ah, only when not logged in, I see. Tiny fix.

Why would it make a difference whether you're logged in? If you had followed a standard MVC pattern, it shouldn't had made a difference! What is the issue? Do you have massive code duplication and diverging branches? (please don't answer yes to that question...) The more you reveal about your implementation, the more I start wondering whether this house of cards will hold if the slightest breeze comes along. Please realize that you've only experienced break-in attempts from normal forum users so far, and even they managed to break in; imagine what'll happen if a "real hacker" comes along.

And again, it doesn't matter whether it's a tiny fix; it's a bug that hadn't cropped up if the thing had been designed correctly to begin with!

I'm sorry for reacting like this, it's just... I know people who literally were thrown out of communities, and people who lost their jobs, for promising stuff and delivering worse than suboptimal implementations.

You must realize that the reason why your implementation is accepted is that this community has come to accept less than ideal solutions from the OP team, and because you are who you are. If anyone else had done something like this in a different context, it'd have been rejected instantly. I'm just uttering my honest opinion here, and am trying to help, but all my attempts have been futile so far.

 

[craigix]

Ah, only when not logged in, I see. Tiny fix.

Why would it make a difference whether you're logged in? If you had followed a standard MVC pattern, it shouldn't had made a difference! What is the issue? Do you have massive code duplication and diverging branches? (please don't answer yes to that question...) The more you reveal about your implementation, the more I start wondering whether this house of cards will hold if the slightest breeze comes along. Please realize that you've only experienced break-in attempts from normal forum users so far, and even they managed to break in; imagine what'll happen if a "real hacker" comes along.

And again, it doesn't matter whether it's a tiny fix; it's a bug that hadn't cropped up if the thing had been designed correctly to begin with!

I'm sorry for reacting like this, it's just... I know people who literally were thrown out of communities, and people who lost their jobs, for promising stuff and delivering worse than suboptimal implementations.

You must realize that the reason why your implementation is accepted is that this community has come to accept less than ideal solutions from the OP team, and because you are who you are. If anyone else had done something like this in a different context, it'd have been rejected instantly. I'm just uttering my honest opinion here, and am trying to help, but all my attempts have been futile so far.

Right. OK. You have your box site. We have our apps.open-pandora site. Just because someone does not create code/a website the way you think it should be done does not mean it's wrong. Just because I decided not to pull out the PND date does not make it wrong.

If we find bugs we fix them. Slowly the site will evolve in to something better each time. It's how I like to do things and I find it works.

If you find any of these security holes do please PM me about them, as I'd like to fix any.

Thanks.

 

[dflemstr]

I haven't found any security holes at the moment, because

1. The site doesn't have anything which is supposed to be secure, except maybe user passwords. So even if I manage to break in, there's nothing I can lay my dirty hands on. It's like saying that a scrap heap is secure; yes it is, because there's nothing of value in it. (I'm not trying to devalue any of the uploaded apps by saying this - they have a value, but not a monetary one that can be used to generate profit)
2. I'm not skilled enough and don't have the time to search for security exploits. Full-time crackers, or someone slightly more technically inclined than I, do have the skill and time.

Once you *do* add anything which requires security, however, like for example payments, I'd never ever want to upload my products to your site, knowing that there probably are security holes left and right. And this is the general approach you'll have to expect from people if you continue like this.

 

[SomeGuy99]

Sounds like you guys should team and up and produce a full-on alternative appstore.

If it was genuinely better, more updated and soforth I would no doubt use it.

 

[craigix]

Once you *do* add anything which requires security, however, like for example payments, I'd never ever want to upload my products to your site, knowing that there probably are security holes left and right. And this is the general approach you'll have to expect from people if you continue like this.

In your opinion.

 

[dflemstr]

Sounds like you guys should team and up and produce a full-on alternative appstore.

If it was genuinely better, more updated and soforth I would no doubt use it.

I've asked craigix already, but he claimed back then that he'd be able to produce a sufficient implementation by himself.

And the thing is: I produced my "appstore" implementation 13 months ago (see this). 13! More than a year! Craigix started working on his version far later, and he still hasn't caught up to the features I had 13 months ago. And he could just have taken my version, and he'd have had a fully working piece of software. Can you understand that I'm more than slightly annoyed?

This is at least part of the reason why I react the way I do.

 

[jonlad1]

Sounds like you guys should team and up and produce a full-on alternative appstore.

If it was genuinely better, more updated and soforth I would no doubt use it.

+1

Enough with the pissing contest. If you guys got together, all Pandora users would win....

 

[Trevsweb]

prove charles darwin right then, if your appstore is better develop it and promote it. if people use and trust it it will conquer over this appstore. but atm we just want to make the features better and simple to use and just get on with having publically available apps to the pandora population

 

[mali]

It's not really my field of interest and certain people take what I say as insult per se, but teaming up sounds good to me. The community spirit is what counts in the end. I won't even talk about efficiency.

 

[dflemstr]

prove charles darwin right then, if your appstore is better develop it and promote it. if people use and trust it it will conquer over this appstore. but atm we just want to make the features better and simple to use and just get on with having publically available apps to the pandora population

I've developed it, and I've promoted it. 11 months ago, I got it 'approved' (by skeezix, cpasjuste, maybe ED and vimacs too don't remember) and it was said that it'd become the 'official app store'.

Since then, I've rewritten it from scratch 3 times, redone the core to be as extensible as possible (I don't like adding small features, but want to focus on a stable base before adding e.g. YouTube links (whose idea was it to add YouTube videos for a non-Flash device ) ) and it *works* and *is ready to be hosted* and ED has told me that he wants to host it.

So yeah.

By the way, you can try it out here; it contains all of the apps that the official app store has.

And there's no point in me trying to fix the AppStore now. I mean, it's written in HTML3 for Pete's sake. If that's the way you've chosen to go, you have to backtrack back to the beginning to be able to go anywhere else.

 

[craigix]

Sounds like you guys should team and up and produce a full-on alternative appstore.

If it was genuinely better, more updated and soforth I would no doubt use it.

+1

Enough with the pissing contest. If you guys got together, all Pandora users would win....

There is no pissing contest. Me and Trev are just getting on with our version which we think works pretty damned well, and 2.0 shows even more requested features without adding any bloat to the minimal look.

There is no way I'd take a risk and go in to some sort of unknown 'deal' with someone who could just vanish off the face of the internet at any moment leaving us with a broken appstore. I've seen that happen far too many times before. As long as I'm around the appstore remains updated and as long as the Pandora is around I'm around. That's just how I feel comfortable.