Hacker News new | past | comments | ask | show | jobs | submit login
Automate any tasks that require multiple entries of data in a browser (cognifirm.com)
65 points by perdamgaard on Dec 12, 2020 | hide | past | favorite | 41 comments



I'm seeing an error on the homepage:

> Warning: file_get_contents(https://vimeo.com/api/v2/video/466939644.php): failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden in /home/customer/www/cognifirm.com/public_html/wp-content/plugins/Ultimate_VC_Addons/modules/ultimate_videos.php on line 208

That the site is trying to fetch the contents of a Vimeo page at runtime is quite the code smell!


Just from that one error message we can infer the following issues:

1. Not using the built-in WP_Http class or related helper methods (wp_remote_get) that provide headers, timeouts, useragent, auth, etc.

2. Unserialising remote, untrusted PHP objects (!) (Why does Vimeo provide/encourage this?)

3. Not handling HTTP error response codes.

4. PHP errors are not hidden from users.


> Unserialising remote, untrusted PHP objects (!) (Why does Vimeo provide/encourage this?)

I see nothing in the error message to show that this is the case, what am I missing?


Take a look at the referenced URL, you'll see the returned content is something like this

    a:1:{i:0;a:23:{s:2:"id";i:466939644;s:5:"title";s:17:"Cognifirm intro 3";s:11:"description";s:0:"";s:3:"url";s:27:"https://vimeo.com/466939644";s:11:"upload_date";s:19:"2020-10-10 16:14:03";s:15:"thumbnail_small";s:49:"https://i.vimeocdn.com/video/972928988_100x75.jpg";s:16:"thumbnail_medium";s:50:"https://i.vimeocdn.com/video/972928988_200x150.jpg";s:15:"thumbnail_large";s:46:"https://i.vimeocdn.com/video/972928988_640.jpg";s:7:"user_id";i:112487323;s:9:"user_name";s:12:"Per Damgaard";s:8:"user_url";s:31:"https://vimeo.com/user112487323";s:19:"user_portrait_small";s:55:"https://i.vimeocdn.com/portrait/defaults-blue_30x30.png";s:20:"user_portrait_medium";s:55:"https://i.vimeocdn.com/portrait/defaults-blue_75x75.png";s:19:"user_portrait_large";s:57:"https://i.vimeocdn.com/portrait/defaults-blue_100x100.png";s:18:"user_portrait_huge";s:57:"https://i.vimeocdn.com/portrait/defaults-blue_300x300.png";s:21:"stats_number_of_likes";i:0;s:21:"stats_number_of_plays";i:111;s:24:"stats_number_of_comments";i:0;s:8:"duration";i:109;s:5:"width";i:1920;s:6:"height";i:1080;s:4:"tags";s:0:"";s:13:"embed_privacy";s:8:"anywhere";}}
It's designed to be directly passed to unserialize($str) which is an incredibly dangerous thing to do with potentially unsafe input.

This is perhaps the strangest API design I've ever seen and these data could have easily been returned and parsed as JSON.


All into memory no less.


Not necessarily all. It’s possible to use PHP to stream a file to the output. It’s how things like `download.php` on some websites work.


But that's not what file_get_contents does.


Yep. I’m an idiot.


How is this not the largest security hole in the world?

> Cognifirm integrates with all the online systems that your employees work with, including 3rd party systems that are made available to you by the government and your business partners.

No emphasis needed.

Where's the details on this AI? You know what acts a lot like ultra high quality AI? Actual humans.


As a browser extension, this is very possible to do securely (we support it for our extension pixiebrix.com):

1. APIs accessed authenticated via OAuth2, or via locally-managed credentials. (Browser extensions support this via https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...)

2. For data extraction and form fill, the data never leaves the user's browser


Yes, I wouldn't touch this. Any willing victims out there who can give us a review? ;)


You may want to review your pricing model it does not make a lot of sense. Here is why: Pricing by business process with the jumps you have in your pricing probably will not work.

Have you validated your assumptions on how business operate and how many process are involved even in small businesses?

You go up from 1 to 25 users in your first small tier of 300/Mo but you only increase your processes from 5 to 10. You don't define a processes on your pricing page and your FAQ is unclear. You don't define the real value to someone using it for a real job would have in advocating why this is important to the COMPANY. Do your offer an SLA that is safe enough for any real business to trust your service? What happens if you go down for a few hours? What happens if you sell it?

-edit removed typo


I agree the pricing model could be improved and personally think simplification would be best change.

Imagine you have a single user subscribe who works inside a big company. They implement whatever process they needed and show a colleague who wants to do that too - either run the same process to build a new one. Your goal in this situation is to rapidly expand adoption inside that company and complex licensing will really slow you down. The second they need to place another order to get more access or sign a bigger cheque you will get dragged into sign offs and approvals and procurement and all kinds of wasted time.

"Land and Expand" is the right strategy for this type of solution and you should do everything you can to not slow down adoption. Your current pricing model is definitely limiting this and the initial plan of 350/mo is quite a jump up - that WILL require levels of sign off and approvals and slow you down.

Try this exercise - create personas for users of your service (power user who wants to automate EVERYTHING, administrators who will use it because its their job, end users, managers) and work what is important to them and what variables will increase or decrease the speed and volume of adoption.

I think pricing based on number of users alone would be easier to understand and not restrict growth. If one person gets really into your product and wants to automate 100 processes DO NOT GET IN THEIR WAY! Let that champion sing your praises and tell everyone that will listen how incredible your product is, because in a few months time when they roll those processes out they will come back for more user licenses. And if you select the right features into the higher plans they may well opt for a more expensive plan to meet the needs of security, billing, management, reporting etc


Hi This is Per, then founder of Cognifirm. Thanks for your reflections; they are extremely valuable to me (us), and I can now tell you that the pricing will be changed because of your input. Our pricing problem is this: We are moving from direct sales to online sales, so our model has to cater to both target groups. Direct obvious is the more expensive version. But it is clear to me that: The model has to be more simple The entry price will have to be much lower

This will be implemented shortly when we have had more time to finetune the model and its business consequences. Cheers, Per


I understand the pricing model of getting in the door that's not where you are going wrong. TRY THIS EXERCISE ACTUALLY LISTEN WHEN PEOPLE ARE TRYING TO HELP YOU.

I don't think you understand, I AM your target market for this product and I'm trying to tell you the model makes no sense, you seem to be focussing on the dollar issue. I did NOT say you are priced too high, I said the pricing/usage model does not make SENSE for THIS product. You think I have the time to keep going back for some non defined "process" every time I want to automate something? Especially when the limits are this low?

I am not going to start using your product when you could vanish after I have advocated for this automation to be installed. The reason? Because I would be the one that got blamed when things suddenly break.

For data entry solutions, I could have it scripted or use any number of solutions that run in software installed on my side of the network that never will get shut off by you, your buyer, your ISP, whatever.

I hope you prove me wrong and you make a lot of money. You never did answer the other important question is what happens if your service goes down or is sold? All those people that integrated with you are going to be royally screwed unless you can offer an in house replacement platform or a guarantee in the notice that is more than reasonable. In the places I've worked this is a no go from the start if this touches anything critical in the flow of business.

I don't want to argue anymore, it never makes progress after this so take the advice or not up to you.


I'm not the OP and have absolutely nothing to do with the company. I replied to agree with your thoughts the pricing model was wrong and shared some more thoughts of my own; apologies if this was confusing, perhaps I should have made a new reply of my own.

Hope you are doing okay and find a way to vent your frustrations better than all caps on HN comments.


Yea I agree, this pricing model isn't very alluring. The tool could be useful, but the time you promise to save won't offset that monthly fee in real-world time. There's a sunk cost of time setting up the automation that subtracts from the time savings. Try to get rich a little slower and you might have better success.


Where do you find the pricing? I'm on mobile and can't see it anywhere.


On mobile as well - pricing and plan tiers don’t seem to exist yet. Small SaaS companies need to cast a wide net when it comes to onboarding users - every new account should be free and easy. When people sign up, there should be five simple boilerplate examples of your AI tool so they can immediately test as a proof of concept. (Hook them at the moment when their interest has peaked and before they hop to competition.) New user can then develop their own task and run it 99 times at no charge. The path to profitability comes once they have tasks, find them useful/ depend on them, see the value of paying and then subscribing (aka your residual income machine).


Was chatting to someone yesterday who ran a RPA startup for last few years to automate repeatable desktop activities.

Essentially automation anywhere, UI path got to big for them to compete with, they also did not raise enough at the right time, but - more interesting to me - was that the founder said larger corporates were moving away from RPA to more structured api integrations to support automation.

They had an OK offering (I tried it) and managed to build up a client base of 20 or so corporates but now they are winding down and founder is looking for a job.

The quick ROI bang for buck through RPA has probably been exploited enough I feel and limitations are being exposed... My view but curious to hear others on state of automation software.


RPA has three types of users.

1. Web-first consumers too dumb to use more modern, structured interfaces, or migrate away from platforms that don't offer them.

2. Business units in large enterprise companies with dysfunctional IT that can't develop.

3. 40+ year old industries with a heritage of legacy computing systems, complex enough that migrations are measured in decades.

#1 doesn't have much money. #2 is eventually going to get their act together. And #3 is services-heavy, because they want you to support their kooky tech stack.

But essentially... if you can't fully support legacy Windows (mainframe + Java + Powerbuilder et al.), don't get in the game.

Which is a long way of saying it's winner-take-all, due to the volume of business required to amortize that custom Windows work over. UiPath realized this, which is why they pushed the pedal to the floor to goose growth.

(Also, Automation Anywhere's architecture and core tech is a kludged-together joke)


Nice website, but I wonder how this competes with on-premise RPA tools like the iMacros or UI.Vision browser extensions?

Does it offer anything beyond what these tools offer for free? If so, what is it? I am missing this info on the website.


Is this a product that helps create say the same user in multiple accounts and helps onboard an employee?

It's difficult to grasp the value prop since the solution seems to be pitching itself as a once-size-fits-all automation for any task. You're better off creating marketing pages for each niche problem space that this solution can help with.


I tend to use Keyboard Maestro to automate stuff like this, or Puppet if I can be bothered. I’m not seeing how this has much benefit over those approaches (although I’m aware this may sound like a “why use DropBox when you can just use rsync and and a Linux server” type of comment.)


I reached out to learn more about the patent mentioned on this site. Per Damgaard Husted responded by linking to https://www.dkpto.dk/media/7607/patent-aarsregister-2017.pdf

Patent title: "A method for automatically presenting to a user online content based on the user's preferences as derived from the user's online activity"

Reading into the patent it seems to be a user tracking algorithm for content suggestion. The description seems overly-broad and generic.

He also added: "Also because we have not started in implement out AI yet So the focus should not be on that part now,"

So this is a patent that is not being used yet although it is included prominently on Cognifirm marketing material.

More info: https://patentscope.wipo.int/search/en/detail.jsf?docId=WO20...


Per Damgaard Husted her with a clarification to this remark. First of all, I would like to thank you all for the valuable feedback that we have got from you for the last 24 hours. It means everything to us. This being said, I feel like this Patent comment is making us look dishonest. So here is the deal. I hold an AI patient that we are currently not using in the product as it is now because it is not AI-based. We mention that we hold an AI patient on the last part of the About us page, in a part where we outline general information on the founders' backgrounds. That's it; it is not a dominant part of our marketing material. Our plan is still to include AI in the application when it makes sense to do so.

I like discussions and critique, and almost all of what you have said in this forum is true, and your reflections are valuable learnings for us. Please don't take this remark as a signal that I am not open to feedback because that is what we are seeking, and I prefer the negative because that is where you learn the most.


I'm sure that you have great intentions and this app will soon get AI-enhanced functionality. I just feel like any of your marketing material that mentions AI should be accompanied with a clear note that it is coming soon and not yet in the product.

I'm interested in your product so I'll definitely check it out again in future once the feature set has been improved.


Thanks, that is good to know. We are finishing the development of a feature where you can paste Excel or CSV files directly into (any) online system. So if you have data in Excel that need to be imported or processes in a business system, you can automate such tasks. Would that be of interest to you?


Could someone help me understand why someone would use this over just automating the tasks using a webdriver? I've done this in python for automating entries into another database (no API) and it was really simple, just used a headless web driver, mySQL, and an ugly tkinter interface so the workers could use it.(I'm a pretty mediocre CS student not a professional but found it very easy and flexible).

Coincidentally there is another post on the front page talking about you should "buy not build." Bit of a misleading site name.

Side note: are there any places on the web where people just post and comment on personal engineering and CS projects they're working on and not necessarily trying to sell? I'm having a hard time finding any active ones :-(


The cookie prompt is misleading, you make it sound like it's only innocent cookies, but when you open it it's got personal data harvesting/advertising turned on by default. I do care about personal data harvesting cookies.

It also doesn't go away if you opt out of the evil cookies.


Hi My name is Per, and I am the creator of Cognifirm. First of all, you should know that I appreciate your reflections and on our product. Also, some of you were expecting a PHP error on our website. We have switched to a different version without the video link that created that error. I am sorry that you have to experience this.

Anyway, feel free to ask me any questions you might have.

I will also get back to you in the threads where it makes sense to do so. Cheers. Per


Signed up, Google flagged the email as dangerous and the "Click here" validation email link wasn't there. :(

Downloaded the eml file from Google and opened it in Mail and I can see the link there. So, gmail really doesn't like you.


Each one of those blue icons is a PNG > 1MB. The page is loading for slowly for me. For example.

https://cognifirm.com/wp-content/uploads/2020/10/Cognifirm_w...


Eeek, vector icons (which would work perfectly fine as SVGs) rasterized into 1500px+ width PNG files!


I get a forbidden PHP error message with leaked server details in the place where the video should load.


I am on a mobile phone, so I can’t try this out. Can it easily automate tasks against Google Drive webpages. Those sites tend to use randomly generated CSS element names that change on each page load. For that reason, I wasn’t able to do it with selenium.


A good idea and I expect to see a lot more automations like this in the future. Haven't tried it but judging by the website alone it seems a bit rushed. Also I expect a model like this to eventually be open sourced


scrape-based processes feels like 'tech debt as a service' and yet

we're building more technology and supporting less of it. the future will include a lot of obsolescence (planned + unplanned), and 'approximate compatibility' services like this one may have a bigger role than we want


The website failed to load. After retrying 3 times there was an animated widgit that also failed to load anything.


.


Clippy is reborn!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: