Hacker News new | ask | show | jobs
Show HN: Koi.io (koi.io)
31 points by koi 4724 days ago
Koi is an open market for sketches and illustration by request.
12 comments

The website is currently broken from hosting unsafe JavaScript directing back to this story. That's not a very friendly greeting from HackerNews. :-\

[1]view-source:http://koi.io/briefs/view/or-1-1

[2]http://koi.io/briefs/view/or-1-1

its good its hacked now so I know to fix it
0) I might use this, but not as is.

1) Do you see this as a direct competitor to Crowdflower and and 99Designs, sort of an MVP? How can you contrast your approach?

2) I'd say your terms of use are very problematic: http://koi.io/terms. It seems like you claim the right to use any of the generated content. So if I get someone to draw something for a project for a client, my client might see his unique art show up somewhere else?

3) Who is the intended user? Is it reasonable to use these illustrations for anything commercial?

4) The javascript links in your Terms don't work in my Chrome browser. The Privacy Policy link doesn't work (shudder to think what the privacy policy says).

5) I think I would have seeded this with more jobs.

http://koi.io/p/-1

Nice. Stored XSS everywhere as well - this is 2013, why are sites still effected by BASIC security issues like this? I would never trust any of my details with a site as poorly coded as this, sorry.

On my second pageview I was greeted with a big alert saying "this website is not very secure."

Kind of ridiculous.

Looks like someone went with a SQL injection [0] (right after I read this!)

[0]: https://cloudup.com/cttFEZd2cL6

Aaaand it's off the front page. It's actually inaccessible now, someone used XSS to redirect here whenever I open the home page. lol
not sure how that happened, its a cakephp site and I assumed the framework provided some protection against sql injection. its good its hacked now so I know to fix it
I assumed the framework provided some protection against sql injection.

Some frameworks consider security out of the box to be beneath them. You should never assume you're secure even with a framework until you've gone combing through the docs and found where the security is, if it's anywhere, and if it's not anywhere because they spent all their effort on making it look and act like Ruby on Rails, how to get it.

Stop making websites and start reading about web app security, the OWASP top 10 is a good place to start.
I'd really like to see the briefest synopsis of what your project does in the post title. Especially on mobile it's a bit of a pain to click through just to see what the site is.

That is, unless you just prefer being coy.

Or do you mean.. koi?
I really like this idea and I appreciate that the terms of service should be written in lawyerese but I would like a more plainspoken explanation about how the licensing works. It would give me a lot more confidence if I were a person who wanted to use one of these pictures for commercial purposes. I would also like the option of requesting a liberal creative commons license. I would love to be able to commission drawings that everyone could use.
>Request an sketch

>Post a sketch

Shouldn't it be "a sketch" on the first sentence too? To be honest, it hurts when I read it, but that might be just my OCD.

Also, is there anything preventing people from getting the sketch without paying its author? Perhaps you could give people only a thumbnail of the image and only if they pay the author, can they see the full original size image.

On another note, I really like how you explain the purpose of the website on the top header without many words.

On a positive note, the front-end design is pretty good. I like the sketch on the header; it explains the concept pretty succinctly. Most of the page is responsive, but the menu isn't visible on small windows. Other than that, just fix your security issues (sanitize all inputs server-side) and you should be good to go.

Good luck!

My two cents: You should add cursor: pointer; (and potentially a hover color or underline) to the large-7 class so that it's evident those are clickable links.
I'm not a lawyer - can the sketches on the site be taken and used in commercial projects if you commission them? If someone else has?
its an RF license so they can, a RM license is exclusive
If you had an iPhone/Andriod app where you can take a picture of your sketch and upload it automatically, that would be awesome.
I am going to get down votes for this, but what's the problem with a classic mobile-friendly upload page?
we are working on that too
I gave up finding the part of your ToU where I can see what rights I have on commisioned work (if I request an image).
holy shit, i've been waiting for this for years. couldn't believe it never existed before.