[michael_dorfman]

I don't think anybody is "holding it to the same standards as a finished product."

I haven't read the code myself, but the OP is claiming "really, really bad security holes", and calls out the encryption code.

Security is not something that can be bolted on after the fact; it needs to be baked in from the start, in a product like this. And, remember, security/privacy was Diaspora's raison d'etre.

No one expects the first code dump to be polished, or feature-complete. But if there are serious flaws there, of the magnitude described, pointing it out isn't just "trash talk."

[jpeterson]

Security is not something that can be bolted on after the fact

In fact, this is how it happens in the vast majority of cases, including the case of Facebook.

[jerf]

"It can't be bolted on after the fact" doesn't mean it's impossible to take an insecure codebase and make it secure. It means that you can't leave it to the last thing and then just toss a few security things into your product. It means you have to rearchitect major pieces of the product, possibly all the major pieces, possibly switching around what the major pieces are entirely. If you want to show that in the "vast majority of cases" that happens, you need to start by establishing not merely that a particular codebase went from "insecure because nobody hardly thought about security" to "reasonably secure", but that the transition was easy.

Facebook probably isn't the best starting point because anything working at that scale is a challenge no matter what.

(Edit: Though if one measure's Diaspora's eventual size if it reaches its goals and considers what percentage of the man-hours have been put in to date, this is still early in the process and major rearchitecting of every component was inevitable anyhow, so hopefully with one of those they can install some security too.)

[catshirt]

Not sure Facebook was an exemplary choice.

[michael_dorfman]

including the case of Facebook.

...which is Diaspora's claim to existence.