Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Meteor, a realtime JavaScript framework

meteor.com

Post reply on HN
Print view View original

11–20 of 350 posts

Re: Show HN: Meteor, a realtime JavaScript framework

#11

Post by famousactress »

dbuxton wrote: post #7
rabidsnail wrote: post #4

"You can use the database api on the client!" Does that freak anyone else out? Where are they doing permissions checking? Who can run what database commands under what circumstances?

From the docs ( http://docs.meteor.com/#meteor_collection ): "Currently the client is given full write access to the collection. They can execute arbitrary Mongo update commands. Once we build authentication, you will be able to limit the client's direct access to insert, update, and remove. We are also considering validators and other ORM-like functionality." So just for toys for the moment. Still, very cool...

Right. But as soon as you have this ability, don't you quickly turn off insert/update? then you throttle/contain reads... So in the end, do we benefit from having a client side database connection? I'm struggling to put together a real-world use case for one that isn't irresponsible.

Re: Show HN: Meteor, a realtime JavaScript framework

#12

Post by geoffschmidt »

ernestipark wrote: post #6
geoffschmidt wrote: post #2

Hey everyone! The four of us have been working very hard on this for the last six months, and we're excited to finally take the wraps off. Can't wait to hear what you think! We've got a lot more stuff coming over the next few months, and if there are particular things you'd like us to do/prioritize, I'd love to hear about them!

Are you guys in Boston?

We visit a lot, but we all live in the Bay area these days.

Re: Show HN: Meteor, a realtime JavaScript framework

#13

Post by saurik »

rabidsnail wrote: post #4

"You can use the database api on the client!" Does that freak anyone else out? Where are they doing permissions checking? Who can run what database commands under what circumstances?

Shared scratch databases with no thought to security seem to be the hot new thing these days ;P. CloudMine, Firebase, Parse, StackMob... people seriously seem to think it is perfectly normal to throw their public /and/ private API keys into their projects... I mean, check out this tutorial from StackMob:

https://stackmob.com/platform/help/tutorials/ios_sdk

Re: Show HN: Meteor, a realtime JavaScript framework

#14

Post by EdisonW »

chime wrote: post #8

Just watched the entire demo. First time I heard two people present a product together - definitely makes it a lot more interesting and much less monotonous. After the first 30seconds, I went "pfft, live reload isn't new." But I'm glad I stayed till the very end because it is indeed so much more. It looks very promising, especially if you offer app hosting of some kind (or make it easy on Heroku etc.) I am curious ab…

Yea, that was my first concern as well. Going around the typical models and straight to DB sounds dirty. :) Can't wait til I get home and try it out. Love the synchronous calls and how it synchronizes between screens, wonder how it scales up though.

Re: Show HN: Meteor, a realtime JavaScript framework

#16

Post by geoffschmidt »

dbuxton wrote: post #7
rabidsnail wrote: post #4

"You can use the database api on the client!" Does that freak anyone else out? Where are they doing permissions checking? Who can run what database commands under what circumstances?

From the docs ( http://docs.meteor.com/#meteor_collection ): "Currently the client is given full write access to the collection. They can execute arbitrary Mongo update commands. Once we build authentication, you will be able to limit the client's direct access to insert, update, and remove. We are also considering validators and other ORM-like functionality." So just for toys for the moment. Still, very cool...

insert/update/remove are actually just "newbie helper" shortcuts on top of the underlying latency-compensated RPC mechanism (which is documented under 'Meteor.methods'.)

Once the auth branch lands, you'll have two choices.

One options is, you can turn off the shortcuts entirely, and write a method for each scenario where the client would be allowed to write to the database. This gives you the same security model as a REST API.

Or, you can register an authorization-check hook with insert/update/remove, so you can vet each write and decide whether to allow it or reject it. This might work well with an ORM where you've marked some fields as writable, and some as protected.

Re: Show HN: Meteor, a realtime JavaScript framework

#17

Post by geoffschmidt »

davidcann wrote: post #15

Is there a built-in way to execute different code on the server, such as proprietary business logic, custom authentication, non-cross-domain APIs, etc?

Certainly! Take a look at Meteor.methods. That lets you define a method that the client can call without necessarily having the source. (If you give the client the source it will be able to do predictive latency compensation. But you don't have to. Or you can give the client a "stub" implementation that just inserts some placeholder records, while the server goes off and moves the forklifts around your warehouse over CORBA, or whatever.)
Post reply on HN