41–50 of 70 posts
"Meteor 0.5.0, available today, allows you to write secure realtime client-server applications in pure JavaScript. It's the only system of its kind in the world." That's an outright lie. cf. http://opalang.org
Earlier quoted context omitted.
it's still blank unless you execute the javascript
I have allowed most connections on NoScript and RequestPolicy in Firefox, but this website shows only the background image. How do they use many APIs or stupid JavaScript snipets to show something about SECURITY?
"Meteor 0.5.0, available today, allows you to write secure realtime client-server applications in pure JavaScript. It's the only system of its kind in the world." That's an outright lie. cf. http://opalang.org
While I agree with you wrt to there being other examples, and the original claim was wrong/false, it could be considered presumptuous to label this as 'an outright lie'.
Most people I know, and the internets, seem to agree that lying requires: intent to deceive.
Having chatted with Matt DeBergalis online and in person on occasion, he comes across rather honest in my admittedly subjective opinion (although welcome to hear contrary info). So if we accept that, then it seems unlikely he would intentionally allow the team to spread falsehood knowingly (especially if it's so easily refuted).
FWIW, I think Meteor is cool for certain camps and projects, but I also really like the 'pick and choose' NPM-friendly style of node development (in fact my personal preference at the moment is for an open modular ecosystem vs a monolithic framework with plenty of magic), so it's not like I have any particular emotional investment in saying this, other than to correct the record.
So in conclusion, this does not seem like a totally fair assessment of the author.
(And yes I realized you mentioned no-one by name, but a project website cannot 'lie'. At the end of the day, a person was still responsible for writing those words).
To the meteor team: high five, keep it coming, and thank you!
@paulg: "Did anyone else see a fireball heading east over Silicon Valley at 7:44? (Meteor?)"
I saw the following tweet from PG within the last hour and wondered if it was a reference to some tech company launch. Then I came here and saw this story. Still not sure... @paulg: "Did anyone else see a fireball heading east over Silicon Valley at 7:44? (Meteor?)"
I know these guys have good intentions, but they seem confused about the guarantees that SRP provides. It does allow the server to verify the user's password without receiving it, but it doesn't help in any was against offline attacks. If the "password" (in this case verifier) database is compromised, the attackers will still be able to brute force the passwords. If they implemented it correctly, they will be salted,…
I have an exercise: is it possible to create a javascript file (served over https) that, when included in a non-https HTML page, is able to determine whether any other scripts were included on the page or will be included on the page by a man-in-the-middle? If this were possible (I suspect it is not), then it might be possible to have secure javascript code running over a non-HTTPS url. (the motivation for this is to…
In general: If the site the user visits is plain HTTP then there's no way to trust the site.