Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Create a web app from scratch in under 5 minutes with Meteor and Mailgun

blog.mailgun.net

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#91

Post by kisielk »

geoffschmidt wrote: post #61
kisielk wrote: post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

All good points, but there's a big difference in trusting my distro's package manager to install packages from their secure repos, verified by certificates I installed with their OS in the first place, and running a shell script from a blog post linked from a news site.

I've never heard of meteor before, and it's likely that many of the people who are reading the article haven't either.

Yes the site is HTTPS, but anyone can buy an SSL certificate for any purpose. It's not even a case of being MITM'd.

Basically we're telling people "read this blog post, run this curl command that runs some random shell script from this server you've never heard of before".

That's a very different from installing packages from your development community's package server, your OS's package repository, or an app store.

I know it's not possible to fully inspect all the code we run, but I'd rather we didn't encourage the habit of entirely disregarding it.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#92

Post by MrBra »

1qaz2wsx3edc wrote: post #26
javajosh wrote: post #16

Earlier quoted context omitted.

meteor create --list Personally, I think the `parties` example is a good one, so you can do: meteor create --example parties Enjoy.

The parties examples only uses a static map (lame), they make no use of google maps or leaflets. Try using an infoWindow. You can't, it's not easy. You're productive will be stone walled with the simplest of integration. (This is a limit of constant regions and how meteor handles controlling a piece of the dom). Working with maps or third party libraries is a common task. So, given that common tasks become stone wall…

It is also possible that while Meteor gets to 1.0 other frameworks will incorporate some of its features/patterns.. I'd check it from time to time just to know what it is doing...

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#93

Post by timdorr »

sergiosgc wrote: post #40
bretthoerner wrote: post #35

Earlier quoted context omitted.

I don't understand this argument, unless you include things like gem, pip, npm, etc. `pip install foobar-py` runs a Python setup script, which can do anything bash can. Do you inspect all of those, and comment about their insecurities on HN?

This method makes you vulnerable to attacks that change the script being run. DNS spoofing, HTTP proxy hacking or hacking of the source server itself. Good package management systems use digital signatures to ensure that the original package wasn't tampered with. Not that hacking of the central repositories never happened, but it's a major (and thus infrequent) event.

But I know for at least gem and npm, while they support signing, they are not used in practice. And those two repositories are used by a large number of people browsing this site.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#94

Post by MrBra »

Aren't we all scared that some time in the future from now, new kids will have new tools that will make programming a totally customizable and super-performing web application as trivial as for example dragging some component here and there, like for us has been working with new generation programming environments, compared to i.e. coding asm? This is a part of the hidden feeling I guess..

Also that then, our present efforts and knowledge will be culturally relevant but totally unnecessary for developing great new generation apps ?

But...... we have what we have now, and we still code because we like it NOW, so we should accept the passing of time (and all evolutions it will bring) and think that we are still doing what we enjoy doing and that we have the luck of making a life out of it, possibly :)

Only moment to be concerned about the future is when they'll invent a time machine..

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#95

Post by timdorr »

kisielk wrote: post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

While I agree that there should be some more transparency with the install process, my problem with this is more practical: because I've installed via a non-standard means, how do I uninstall? How do other packages of software know I have meteor installed as a prerequisite? How do I easily ensure I have the latest version? How do I lock my install to a particular version to avoid breaking changes in new versions?

Whilst the security aspect is a background concern, these functional concerns are far more important to me. Because npm or some other system wasn't used, meteor is now an outlier and doesn't easily fit into most of my development flow. I've now been burdened with an external maintenance process that requires separate tools and workflow to accommodate.

Honestly, that's the biggest turn-off I have about meteor right now. Hopefully that will change before the big 1.0.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#97

Post by sergeyo »

orionblastar wrote: post #70

I tried it, sent email to myself. Never received it. I typed everything correct except I replaced the email with my own email orionblastar@gmail.com there was no error messages as well. Do I have to install things like sendmail to make it work? If so that needs to be in the documentation. Yes I did the meteor add email part, I followed every step.

Hello,

It looks like you haven't actually deployed the code. Once deployed a free Mailgun account is created for you behind the scenes and assigned to your app. To test locally you need to create a Mailgun account and follow instructions from the "Extra optional step" section.

BR, Sergey

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#98

Post by patio11 »

kisielk wrote: post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

This is a security red herring that as far as I can see is justified entirely by an aesthetic preference to think of oneself as "able to quickly audit code just by skimming it."

Compare it to alternatives like "gem install NAME_ANY_GEM_HERE", which also executes arbitrary code and which, for the typical Ruby/Rails developer, is totally impenetrable. (If you think otherwise, tell me, when's the last time you did a line-by-line audit of every single dependency prior to installing a gem?)

Even the embedded assumptions like e.g. the Rubygems server is, as of this instance, being operated by Rubygems and not being operated by The Adversary are really, really tenuous.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#99

Post by webreac »

kisielk wrote: post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

I really like instructions like this because I understand easily what needs to be done. Probably the content of the script will also be easy to read. Of course, I will never do a copy paste of these instructions. I will redirect to a file and read it before executing. And if I have doubts, I launch a VM.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#100

Post by acemtp »

bjourne wrote: post #74

Great tutorial! If only there was an easy way to store the entered addresses in a database? Maybe that could be done in the next 5 minutes? :) I've had a few projects which where basically nothing more than just what was in the article. Meteor's builtin deploy and free Mailgun will fit perfect for cases like that.

On the server, add something like:

RegUsers = new Meteor.Collection("regUsers");

RegUsers.insert({email:email});

Post reply on HN