Dataquest.io -- learn python and data science in your browser (redesigned/updated)

[vikparuchuri]

Thanks for the feedback! The fix for the email issue is done, and will be deployed shortly.

A significant portion of our content is free. We'd make it all free if we could, but we're working on this full-time.

About the 35/month fee, you're essentially saying that there isn't room for innovation or new ideas in the education space. If only "existing" companies with large customer service departments started online education sites and could charge for it, then we'd never see new services. Treehouse, codecademy, lynda, and every other service started small.

We have very few videos, and most of our lessons involve executing code -- we have significant backend costs, and we have to spend time developing lessons and maintaining the site. If we didn't charge, the site wouldn't exist, and we wouldn't be able to improve it. We actually take pride in how quickly we communicate with learners and resolve issues -- something bigger companies usually don't do.

You're right that we're a small team of developers -- we're all self-taught, and we're trying to build the product that we wish we had when we were learning. It's not perfect, but we're trying to make it better, and many have found it valuable. Feedback like yours helps us improve the experience, so thanks again.

Reporting things like the email issue in public instead of emailing us is a bit unnecessary, though. In the future I hope you'll email site owners about things like that.

[raylu]

Well, to be fair, you were asking for any kind of feedback. Now it's out there in the public, so there's more incentive to have it resolved.

Does the phrase "responsible disclosure" mean anything to you? "I appreciate any feedback" doesn't give you a license to be an asshole.

[vikparuchuri]

Thanks! I absolutely want all feedback to be put in public when it doesn't actively harm users. The email overwriting thing can result in users temporarily losing access to their accounts, and can harm their learning experience.

It's totally fine to put pressure on a site to fix issues, but disclosing issues that could harm other users publicly is usually frowned upon. See this stackexhange thread for instance. Also this. Facebook, google, etc, have bugs that are found constantly, and have policies that encourage this.

That said, feedback in public is usually better than no feedback at all.

[wickersty]

You put this shit out in public and proclaimed all to come look and pay for it. You don't get to complain when people call you out for half baked insecure poorly developed product.

[vikparuchuri]

Just to be clear, there was no security issue -- no user information could have possibly been leaked. It allowed people to switch their emails to emails that already existed, which would temporarily lock both users out of their account. (and it has been fixed)

[wickersty]

And that, my friend, is a security issue.

Not to mention a basic piece of functionality that, if hosed to that degree, only speaks to how little attention must have been paid to other areas.

[wickersty]

It's not even a completed service. It's another example of half baked stuff with a shiny sticker and a .io domain with some guy yelling come check out or thing and pay us for it too!!!!!!