Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meteor releases authentication, accounts system, and new screencast

meteor.com

Post reply on HN
Print view View original

1–10 of 70 posts

Re: Meteor releases authentication, accounts system, and new screencast

#2

Post by ehutch79 »

I'm really glad auth finally got in this. With the biggest obvious stumbling block knocked off the list, I have some questions;

Is this production ready? Should I be using this for a greenfield project?

What is database access like? Postres, Mysql? SSL connections to mysql?

what's a typical setup/deployment look like?

Re: Meteor releases authentication, accounts system, and new screencast

#3

Post by norviller »

ehutch79 wrote: post #2

I'm really glad auth finally got in this. With the biggest obvious stumbling block knocked off the list, I have some questions; Is this production ready? Should I be using this for a greenfield project? What is database access like? Postres, Mysql? SSL connections to mysql? what's a typical setup/deployment look like?

I agree auth is a huge success, but no alternate DB support is a not starter for most I imagine. Any other non relational DB support would be a huge win, most people that I have talked to are blocked by Mongo's license.

Re: Meteor releases authentication, accounts system, and new screencast

#4

Post by speg »

ehutch79 wrote: post #2

I'm really glad auth finally got in this. With the biggest obvious stumbling block knocked off the list, I have some questions; Is this production ready? Should I be using this for a greenfield project? What is database access like? Postres, Mysql? SSL connections to mysql? what's a typical setup/deployment look like?

It's an early preview for a reason. That's why auth wasn't in til now. Not because it wasn't planned, but because the product isn't done yet. Wait for 1.0 before you start greenfielding.

Re: Meteor releases authentication, accounts system, and new screencast

#5

Post by Skywing »

norviller wrote: post #3
ehutch79 wrote: post #2

I'm really glad auth finally got in this. With the biggest obvious stumbling block knocked off the list, I have some questions; Is this production ready? Should I be using this for a greenfield project? What is database access like? Postres, Mysql? SSL connections to mysql? what's a typical setup/deployment look like?

I agree auth is a huge success, but no alternate DB support is a not starter for most I imagine. Any other non relational DB support would be a huge win, most people that I have talked to are blocked by Mongo's license.

Now I need to ask, what's blocking about Mongo's license?

Re: Meteor releases authentication, accounts system, and new screencast

#6

Post by densh »

norviller wrote: post #3
ehutch79 wrote: post #2

I'm really glad auth finally got in this. With the biggest obvious stumbling block knocked off the list, I have some questions; Is this production ready? Should I be using this for a greenfield project? What is database access like? Postres, Mysql? SSL connections to mysql? what's a typical setup/deployment look like?

I agree auth is a huge success, but no alternate DB support is a not starter for most I imagine. Any other non relational DB support would be a huge win, most people that I have talked to are blocked by Mongo's license.

How in particular are they blocked by Mongo license? It's AGPL but it only applies to changes made to the database source code itself. It doesn't impose any requirements on your application if you are just talking to Mongo over the wire.

Re: Meteor releases authentication, accounts system, and new screencast

#8

Post by norviller »

densh wrote: post #6
norviller wrote: post #3

Earlier quoted context omitted.

I agree auth is a huge success, but no alternate DB support is a not starter for most I imagine. Any other non relational DB support would be a huge win, most people that I have talked to are blocked by Mongo's license.

How in particular are they blocked by Mongo license? It's AGPL but it only applies to changes made to the database source code itself. It doesn't impose any requirements on your application if you are just talking to Mongo over the wire.

It is not unheard of for businesses in both the public and private sector to not allow AGPL code or use of applications released under this license.

For example, I worked at a public library for years, and the policy was no AGPL, even if we had no intention of touching the source. Same for a local university.

[Edit to add anecdote]

Re: Meteor releases authentication, accounts system, and new screencast

#9

Post by vikstrous4 »

I know these guys have good intentions, but they seem confused about the guarantees that SRP provides. It does allow the server to verify the user's password without receiving it, but it doesn't help in any was against offline attacks. If the "password" (in this case verifier) database is compromised, the attackers will still be able to brute force the passwords. If they implemented it correctly, they will be salted, but this only makes the attack slower. Furthermore, nothing can protect you if your password is password.

Also, I hope that they don't think this removes the need for SSL. It does not. In a web application the server sends the client the javascript to run. A man in the middle can modify it and defeat the whole point of SRP.

Post reply on HN