Review my app for making server stacks social

http://stackfu.com

by fcoury • 16 years ago

36 23 16 years ago

stackfu.com

collint2• 16 years ago

The flow in the video looks great.

Easier to get into than Chef :) Hope it works as well (or better)

Signed up for the beta

fcoury6• 16 years ago

Thanks for the words.

StackFu, however, is not a replacement for Chef.

With Chef you provision and manage your server's configuration, while StackFu is a social place for people to share "recipes" or stacks to be installed on your server.

Ideally, this will be the place for linux savvy folks to share their scripts. And for people who just wants to get something installed (like WordPress) to go, search and easily get it up and running.

timmorgan2• 16 years ago

Do you have plans for how scripts will be reviewed/flagged? I see from the video that one can see who else has deployed the script (with the assumption that a script deployed many times is most likely "safe"), but I would still feel a bit nervous about running a script blindly -- can one see the script code prior to hitting deploy?

Edit to add: I'm certain you don't want to be liable for people hosing their server with a malicious script -- I hope you have plastered all over the place that these scripts are not reviewed for quality nor mal intent (unless of course, they are?).

Another edit to add: I think this is a great idea! I could see myself using this -- I didn't mean to be such a negative nancy.

collint2• 16 years ago

I suppose my point is that, even with the new hosted suff, chef doesn't have the a polished "wow, I feel like I didn't do anything" feel yet.

If you can capture that you win in my book. If I run chef, or apt-get, or you-name-it through StackFu, then yes. StackFu is my replacement X.

For me the best part is the github-esque "username" / "scriptname", and what I imagine will be the social components behind it.

I think the real show-stopper would be a way to dump in my amazon/rackspace/etc. keys and get a real full stack in one click.

cartab3• 16 years ago

If anyone wants to find out more, Join us at #stackfu on Freenode IRC and follow @stackfu on twitter.

brown9-2• 16 years ago

I can't comment on the technical parts of what you're offering as I don't know Rails, but it might be a good idea to use full sentences in your introductory text:

"For example, deploying full rails environment to your server for your new app. Or as simple as installing and configuring iptables on your existing live server. "

brosephius• 16 years ago

what is the "social" part? I'm not entirely sure I get what the product is. is it the sort of thing where if you don't get what it is, you probably don't need it?

timmorgan2• 16 years ago

I believe it's social because it's a community where people can share their own scripts and improve on existing scripts. As well as deploy them easily, of course.

It's a great idea I think.

ryanhuff• 16 years ago

If that's the case, maybe he should position it as an Appstore (or marketplace) for scripts?

cartab3• 16 years ago

The social part is, imagine like a github, where people put up code and you can see it? Same thing with stackfu. People can put up stacks and you can deploy them to your server.

Example: A user made a stack for Rails, you need rails, you go and deploy the guy's Rails stack. You'll be able to make a copy of it, edit it, review it, and make it yours if you want, fix it update and push your own version so other people can deploy it.

city41• 16 years ago

It reminds me of the community configs in EC2.

Are there any measures in place to deal with people who upload malicious stacks? Would they just receive negative reviews? Do you think you need to warn users to not blindly trust a stack?

lubos• 16 years ago

it's pretty neat, I'm windows developer. this kind of makes me switch to linux.

thegyppo• 16 years ago

Did the idea for this come from Linode's Stackscripts?

cartab3• 16 years ago

thegyppo, no. this idea came from Webbynode's Readystack system which we developed about 2 years before linode decided to launch their version (they launched it February 9, 2010, we did 2008). (Yes, we're the guys behind Webbynode)

This is our original concept, back from 2008, they launched theirs in 2009.

Check this out http://www.linode.com/forums/viewtopic.php?t=4459&highli... and also our original 'readystack' idea post http://blog.webbynode.com/2008/10/29/webbystacks/

This is our original concept, back from 2008.

istvanp2• 16 years ago

This looks like a great idea but I have a few concerns/questions about it:

1) As others have mentioned, there needs to be transparency on what each script does to make sure that it is not malicious. Is there a way to inspect the code without running it?

2) How do you protect the communication between stackfu and the user's servers? I saw in the video that you provide some keys, but is the connection thoroughly secured to prevent any potential spoofing? What about a potential attack that would come through the site itself and potentially access all users' activated servers? I would be very cautious to have stackfu installed as a daemon on a production server without knowing it's secure inside out -- even if I only enable it when I need it.

3) Did you consider developing a stackfu shell client? Using the command line client, you could provide some basic features like searching and running scripts. Since the scripts are started from the server itself this might be more secure. Although, you still need to make sure that the scripts are actually coming from stackfu (in case it was somehow spoofed), similar to package distribution systems (yum, apt, etc.). Another utility for the client could be to allow/disallow queued scripts sent from stackfu and maybe even a monitoring tool (see the output, previous logs, etc.).

4) How do you handle different *nix configurations? Do script authors need to make different scripts for each distribution? Do you provide a facility to only search for scripts that are compatible with your server(s)?

5) Aside from the number of deployments, do you have a rating system? Script failure and success rates? The number of deployments is hardly enough for me to choose from say 20 different Wordpress installation scripts.

fcoury6• 16 years ago

1) Yes, there will be many ways to do it. One is online, clicking the scripts. We'll provide a lightbox with the code. Another way is "cloning" the script to your account (no git clone in this case, just a hard copy). You can then make changes and publish it back to your account.

2) The connections between your server and StackFu's will be done using HTTPS. We also offer the option to run the service as a daemon or as a standalone, where you have to manually confirm each installation request;

3) I am not sure I understand your concept of shell. We already have a REST API and a Ruby Gem that enables you to do things like publishing a new script, listing servers and scripts, deploy scripts, all from the command line.

4) This won't be available in beta, but we have planned as one of the possible requirements of the script to be the operating system, and that would involve doing some server side checking to make sure the proper OS is installed. Once we have that, I agree that we need to make that searchable;

5) We don't, currently, have a rating system nor rates, however they are interesting concepts. We may do a upvoting/downvoting system similar to what Reddit or StackOverflow does.

Thanks for your feedback. Keep them coming, please!

pjscott• 16 years ago

I notice that the web site doesn't tell me what StackFu is. I don't want to have to watch a video just to find out if the concept is interesting enough to warrant the time it takes to watch a video.

Anyway, it looks like a cool idea and I wish you the best of luck. And I've signed up for the beta. I still haven't watched the video.

fcoury6• 16 years ago

Agreed. We'll be addressing that and improving the text communication on the website. Thank you!

pilif• 16 years ago

I would never in my life allow an external machine to run arbitrary commands on my server. This is like giving root to some person I don't know.

Even if I could read all these scripts the service is going to execute, nobody tells me that the script I'm seeing on the web service is the script that actually gets executed.

Now. I don't insinuate that the OP is trying to take over servers, but we all know about bugs and/or the famous disgruntled employee.

If I could install this service in my own network, having full control over the scripts and the service itself, this could be useful, but giving root to some server not under my control?

This actually begins at the very first start of your video.

You want me to execute a script that I download using wget from a non-https-site. As root.

shudder

fcoury6• 16 years ago

It will be an HTTPS site, and maybe even if you wouldn't run the scripts, would you consider contributing on the other end, writing them and sharing with less experienced users?

Review my app for making server stacks social

Related Stories