Live data from Hacker News

Create a web app from scratch in under 5 minutes with Meteor and Mailgun

blog.mailgun.net

81–90 of 112 posts

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#81
post #79

Earlier quoted context omitted.

Uh, actually, no. And I put together a screencast to prove it. http://screencast.com/t/RkImuQ9i

[deleted]

[meteor dev] This is on us. The docs don't make this point clearly enough. It's also the single most voted for thing on the Meteor 1.0 roadmap: https://trello.com/card/patterns-for-writing-larger-modular-...

JS files in the 'server' directory (or any path with a 'server' component') are not sent to the client.

Everything else is.

Putting code inside an `if (Meteor.isServer)` block doesn't keep it from the client. Now someday we might statically analyze the code for clauses like this and keep them out of the client bundle -- the first step is greenspan's jsparse package -- but not likely in the short term.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#82
post #50

Earlier quoted context omitted.

Mailgun sounds like a really good fit for me. I'm running a couchdb server, and I want to set it up to POST to my DB. Dump straight into my document store, life is good. I did a quick try at it and ran into a 415 from couchdb, which means mailgun didn't send json. Is there a way to configure a route to do that? If not, I'll have to write a custom _update handler.

Hey pfraze, we do not have a json option for Routes.

Ok, cool. Custom _update handler it is.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#83
post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

Best response I've seen yet to this particular brand of concern trolling.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#84
post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

This. If you give me a shell script, I can curl it without piping it to a shell first so I can see what it's going to do. Unlike an installer on Windows where I have no clue what's going on.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#85
post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

It would be great if shasum would let you check against a sha on the command line so you could do something like: curl https://install.meteor.com | shasum -c 6fa3128600e9bd73a161a625f8503e6614b44b2b | sh Could be built into curl possibly.

But if the DNS is compromised or if this a MITM attack (in spite of being https) there is no guarantee that the checksum is any more trustworthy.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#86
post #79

Earlier quoted context omitted.

[deleted]

[meteor dev] This is on us. The docs don't make this point clearly enough. It's also the single most voted for thing on the Meteor 1.0 roadmap: https://trello.com/card/patterns-for-writing-larger-modular-... JS files in the 'server' directory (or any path with a 'server' component') are not sent to the client. Everything else is. Putting code inside an `if (Meteor.isServer)` block doesn't keep it from the client. Now…

This kind of static analysis is really easy to do with falafel:

https://gist.github.com/substack/4735826

Program:

    var falafel = require('falafel');
    var fs = require('fs');
    var src = fs.readFileSync(__dirname + '/src.js', 'utf8');
     
    var output = falafel(src, function (node) {
        if (node.type === 'IfStatement'
        && node.test.type === 'MemberExpression'
        && node.test.object.name === 'Meteor'
        && node.test.property.name === 'isServer') {
            node.update('');
        }
    });
    console.log(output);
Input:

    if (Meteor.isClient) {
        console.log("I'm the client!");
    }
    
    if (Meteor.isServer) {
        console.log("I'm the server!");
    }
Output:

    if (Meteor.isClient) {
        console.log("I'm the client!");
    }
This won't catch fancy things like Meteor['isServer'] or compound expressions but should be a good place to start.

edit: I had them backwards. Fixed now.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#87
post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

I think the safest way would be for you to buy a new 13" Macbook Air, install Meteor, and deliver it to me in person. That way I know its legit.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#88

Earlier quoted context omitted.

[meteor dev] This is on us. The docs don't make this point clearly enough. It's also the single most voted for thing on the Meteor 1.0 roadmap: https://trello.com/card/patterns-for-writing-larger-modular-... JS files in the 'server' directory (or any path with a 'server' component') are not sent to the client. Everything else is. Putting code inside an `if (Meteor.isServer)` block doesn't keep it from the client. Now…

This kind of static analysis is really easy to do with falafel: https://gist.github.com/substack/4735826 Program: var falafel = require('falafel'); var fs = require('fs'); var src = fs.readFileSync(__dirname + '/src.js', 'utf8'); var output = falafel(src, function (node) { if (node.type === 'IfStatement' && node.test.type === 'MemberExpression' && node.test.object.name === 'Meteor' && node.test.property.name === 'isS…

That's really, really cool and is definitely a good start.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#89

Earlier quoted context omitted.

@powershell -NoProfile -ExecutionPolicy unrestricted -Command "iex ((new-object net.webclient).DownloadString('http://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%systemdrive%\chocolatey\bin Goodness, that looks awful.

Heh the least they could do is put that into a batch file to be downloaded and clicked on to run. Chocolatey is sort of like an alternative apt-get for Windows, except that it doesn't need s sudo command and your password to install software. It uses cinst to install stuff: cinst firefox Installs Firefox. The UAC asks the current user to allow the setup program to run and that is about it. No password needed to insta…

Right, because UAC assumes someone who is logged in as an admin is supposed to be. I configure sudo like this on some of my dev machines, easier and I don't care about them (usually just VMs).

Why not just restrict the execution policy? I don't really know PS thta well, but doesn't that stop arbitrary (or any) scripts?

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#90

Earlier quoted context omitted.

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

I think the safest way would be for you to buy a new 13" Macbook Air, install Meteor, and deliver it to me in person. That way I know its legit.

If you send me enough good pull requests then I might do that!
Post reply on HN