http://www.techindemand.com/2007/09/04/web-tech-tuesday-tangler/

Tangler is the first company and product to be featured on Web Tech Tuesday on my website, Tech In Demand.

Enjoy

Great review jmowery!

Nice one JMowery.

I was interested to read your comments on navigation. Any ideas how it could be improved?

You mentioned Pibb taking a "more unique approach" but I checked out their front page and the description makes it sound very Tangler-like. Their feature list:

• Messages are delivered instantly, or can be retrieved later
• New threads are stored and searchable like email or bulletin board
• Start public channels about your favorite subjects
• Use private channels to communicate with groups or your social network
• Send private messages to your friends
• Pibb will notify you when you have new messages

 
I see nothing there that Tangler doesn't have..

As for navigation, I'd love to see the ability to pick a few groups, and make them tabs on the top.  Like, if you look here, you can see the "About" "Discuss" and "Participants" tabs.  I'd prefer to have an area on the top of the page, where you can customize your own tabs and display your favorite forums.  Then, if there is a response in that forum, to have it change a different color or something of that sort.  I think that would be a great way to solve the navigation issue.  I'd prefer to take one click, and jump to my favorite forums, and be able to customize it.  I'd also love more customization on the notifier, which I did not mention in the review because it has been awhile since I have used it.

Currently, I rarely ever use the current interface.  I always go to the home page, and click on the recently discusses list on the left side of the page.  When I finish with this post.  I'm going to click on the tangler logo, and go back to the front page and see if there are any other posts on the other forums.  It's a minor thing to do, but I would much rather prefer to be able to get to all of it right now, with one click, already visible, and able to see if there is new posts there.  I'd also like the option to have the tabs colored in one color if there is a response to the forum, and another color if there is a response to a thread you have participated to in that forum.  That way there is even more information at my fingertips, without having to even click on the forum itself to see.

Something else that Pibb has, is audio alerts.  I think that would be a great feature if you did incorporate a tabbed system of navigating forums.  I know the Notifier does that mainly, but there are ways for this to be done directly in the web interface.
 

As for Pibb, there are many features that it has that Tangler doesn't.  I did not point out those features, because I was featuring Tangler.  There are things like RSS built into forums on Pibb that I really like, because RSS is important to me, and I use it for many things.  Plus they have everything in a tabbed interface which I really do enjoy.  I just prefer how Pibb displays the information all in one screen.  One click to get to all the information you want, friends are already displayed and more.  Just pointing out some of the things I like with Pibb.

I prefer the competition though, because the more competition, the more improvements to come out of it.  So Tangler improves, Pibb improves, Web 2.0 in general improves.

I'd never promote a company on my blog that I didn't like, and I've been extremely critical of some startups here on Tangler.  So, I think that Tangler got me to say so much good about them, is a great achievement

Thanks JM... criticism isn't necessarily a bad thing, and it is great to be able to get honest opinions about Tangler.

I really like the idea about tabbed groups. I myself had always envisioned it as a 'favourites' list, similar to the groups/recent activity menu but where I can choose which groups I put in it.

Different coloured notifications sounds great!

Yep honest opinions are great, it's the only way for Tangler to improve. It's often easier for a third party to spot the flaws because we get so used to using Tangler in our own way so we may not be experiencing the same issues you are feeling.

Yeah, and I will admit, I have a short attention span, and I like to get things done quickly.  Not all members of every site is going to be that way.  That is why I try not to ask anyone to take my review too harshly.  I will be critical on issues that I think all issues will have, but if I just think it might be me that will have an issue, then I won't go on with it.

I do think navigation is something that can always be improved upon here at Tangler.  There is so much information to navigate.  I would just really love to be able to access it with one click, and have visual feedback right there so I know what is going on.

If you wanted to incorporate RSS into Tangler:

I'd love to see an RSS feed specific for groups you favorite with the little star.  An RSS feed that updates you on replies to threads you have posted, and maybe a way to add customization to these feeds.  I'm not sure how difficult it would be to tap the posts and generate some RSS.

If each post is handled by XML or something of that sort, it would be incredibly easy I'd imagine.  So it might be something to think about as RSS really can be a valuable tool and could keep users who might not have the time to check everything, but still want some information from tangler to come to them, that way you could potentially generate more activity here at Tangler.

So, just a few suggestions.

I really would love to see tabs integrated into the interface, and if you want to get all pretty with it as the rest of the site is, you could maybe add in a drag & drop functionality.  Heck, maybe you could create a page where we can customize our tabs and drag and drop groups into your "Visible tabs" thing.  Maybe have a section on top of the interface where a tab will pop up if a new reply is posted

There are many ways to approach it, and many things you can do to make it work and make it as good as you want it.  I just think when I have a lot of information to deal with, tabs is the way to go.  You could look at my Netvibes and Pageflakes pages, and you'd be amazed how much use I make of those tabs.  I also make very good use of the tabs in Firefox (you can see my post about interface enhancements on my site) and stuff.

So, just some stuff to think about.  Where I really think you would score points with this is with regards to when you actually sell self-install versions to other sites.  No forum system that you can install has a tabbed interface to navigate.  I think that would be a very big appeal to many people.  Make it all optional, and you have a done deal in my opinion.

So yeah, I'm going to shush now because I won't stop, and I'm kinda tired.

Hopefully some of that will inspire some ideas for the dev team.



 

Thanks JM!  I'll leave the rest to the devs and those who know more abt what you brought up, but I will say that RSS is definitely on the list of upcoming features.

Awesome

So great to see a good review JMowery. Thanks.

No problemo

Wow!  Major problemo... How on earth am I logged into this account???  This is JMowery, and I just checked Tangler and I'm somehow on this account

Wow, there is a serious security issue with that.  It appears that if I click on a referring link to Tech In Demand, it automatically logs me into Tangler in that person's account.

I was checking out my Clicky web analytics and it shows me whenever someone comes onto my site and provides me the referring link.  So I guess ANYONE who clicks on a link is potentially opening themselves up?

Kinda scary don't ya think?

On second thought, this isn't true.  But that referring link I clicked on, gave me access to SvenDowideit's account :|

Thanks JM, we're checking it out now.

Thanks JMowery, I believe you have come across a URL with ;jsessionid appended to the end. This is used by Tomcat, Tangler's HTTP Server to keep track of a user's session and is sometimes appended to the end of a URL when the browser doesn't support cookies. Obviously this isn't the most desirable behavior as it allows the session to be hijacked if the URL is reused whilst the existing user still has an active session.

I will provide more information soon, once I've had a better chance to research this issue. I don't believe it is a critical security flaw, but it is one that we would like to address ASAP.

If you are allowing sessions via a session ID in the GET string, then there's no way around it.  GET string session IDs are Security by Obscurity; you are relying on the fact that the ID number is hard to guess (usually they are made upwards of 32 characters in length for this reason, as you probably already know).  That obscurity disappears if someone publicizes it.  Probably the only thing you can do in that particular case is expire and invalidate that specific session ID.

Session IDs are expired 5 minutes after a user inactivity or when the user logs out. In this particular case JMowery intercepted the URL before the session had expired or was logged out

The problem is more related to how Apache Tomcat handles session state than a particular defect in our application specific code.

UPDATE: I've found a technique ( http://randomcoder.com/articles/jsessionid-considered-harmful ) to prevent the session Ids appearing in URLs, this will take some test before we can introduce.

Understood.  I didn't mean to imply that your code was anything less than stellar.   Keep up the good work! 

I think I sounded a little defensive thanks for your thoughts.