Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Create a web app from scratch in under 5 minutes with Meteor and Mailgun

blog.mailgun.net

Post reply on HN
Print view View original

101–110 of 112 posts

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#101

Post by vidarh »

julian37 wrote: post #78
javajosh wrote: post #72

Earlier quoted context omitted.

Good response. This is not directly related, but wouldn't it be nice to have some sort of convention where install scripts declare the access that they need and people could allow it (or not)? Something like the Unix permissions systems, but more fine-grained. E.g. perhaps a chroot jail with symlinks to the places that you want to give the script access. Indeed, the first run of the script could be to generate the sy…

The UNIX permission system is ludicrously primitive for this day and age. Check out OLPC's Bitfrost for a more fresh take on the matter: http://wiki.laptop.org/go/OLPC_Bitfrost#Foreword Unfortunately, it doesn't look like it went anywhere even in the OLPC world... I'm not very familiar with OLPC, but the fact it carries a 2007 timestamp isn't very encouraging. I wonder if it fell victim to the "sugar" watering down o…

Which is why Linux, BSD's and most Unix versions have a wide range of more restrictive access control methods,such as various forms of containers, jails and VM's...

Personally I run pretty much everything in containers. Not always segregated from each others, but certainly segregated from most of the data I care about. All larger projects get their own containers or VMs, and I have several "scratch" VM's and containers of various types that I don't care if I lose.

Spawning a Virtualbox VM or LXC container (or equivalent) is so quick and painless today that there are few excuses to running all kinds of stuff unrestricted.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#102

Post by shredfvz »

grinich wrote: post #80
geoffschmidt wrote: post #61

Earlier quoted context omitted.

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

But then how will he really know it's you, Geoff? ;) In all seriousness, you should consider posting a response like this in your FAQ/Help and linking at the install tutorial. I'm really sick of this knee-jerk security reaction happening every time someone builds an installer like this.

While it's ok for Meteor to keep doing what they're doing, it's hardly a "knee jerk security reaction" to criticize their installation instructions.

Story time. I'm at a hotel, connecting to the Web over Tor and using my distro's package manager (Pacman) to install software. I'm also routing Pacman over Tor because I trusted the hotel wifi even less than I trusted Tor. Anyway, Pacman has this wonderful feature of verifying md5sums - fingerprints of the original source code, as posted by the source code author - from source packages before installing any of the code onto your system. If the md5sums on the software you download don't match the author's posted true md5sums, something is probably wrong. You can tell where this story is going. As I'm installing a few packages, which I've done numerous times in the past, Pacman throws a warning: the md5sums don't match. Slightly annoyed, I then download the software directly from PyPi over the hotel's wifi connection, md5sum it and lo and behold, it's the correct md5. It's the exact same software version and everything.

Importantly, the source code must've somehow been modified between the time it was sent from the AUR/PyPi and when it ended up on my machine. Luckily, the md5sum check failed and the software didn't install, but it did scare me quite a bit.

If I had instead been installing Meteor, as per Meteor's current insecure directions, without checking md5sums or signatures, who knows what could've happened. The Meteor team should really consider releasing an md5sum, sha256sum, or better yet sign their packages, because otherwise there's no way to verify the contents of a download.

The Meteor team clearly has the resources to provide this to the inquisitive. It is SOP for all major FOSS. I get that there's something to be said about the ease of releasing packages from GitHub, but imagine if the Linux kernel did this? What Meteor has right now is ok for alpha software. They certainly have room to grow.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#103

Post by shubber »

geoffschmidt wrote: post #61
kisielk wrote: post #28

$ curl https://install.meteor.com | sh I really wish people would stop giving instructions like this. Despite all the focus on web security and sandboxing, we continue to instruct people to run arbitrary code on their user account. People should at least give any shell script they download from the internet a cursory look to see if it's doing what it should be doing instead of blindly executing the response from an H…

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

Which is all interesting, except the shell script is a wrapper on "download this tarball and unpack it" or "download this rpm/deb and install it." So whatever security concerns existed on those approaches, you only concealed them. Why exactly?

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#104

Post by spullara »

mayanksinghal wrote: post #85
spullara wrote: post #60

Earlier quoted context omitted.

It would be great if shasum would let you check against a sha on the command line so you could do something like: curl https://install.meteor.com | shasum -c 6fa3128600e9bd73a161a625f8503e6614b44b2b | sh Could be built into curl possibly.

But if the DNS is compromised or if this a MITM attack (in spite of being https) there is no guarantee that the checksum is any more trustworthy.

How is this any less safe than any other checksum scheme that people typically use when delivering software over the internet?

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#105

Post by javajosh »

vidarh wrote: post #101
julian37 wrote: post #78

Earlier quoted context omitted.

The UNIX permission system is ludicrously primitive for this day and age. Check out OLPC's Bitfrost for a more fresh take on the matter: http://wiki.laptop.org/go/OLPC_Bitfrost#Foreword Unfortunately, it doesn't look like it went anywhere even in the OLPC world... I'm not very familiar with OLPC, but the fact it carries a 2007 timestamp isn't very encouraging. I wonder if it fell victim to the "sugar" watering down o…

Which is why Linux, BSD's and most Unix versions have a wide range of more restrictive access control methods,such as various forms of containers, jails and VM's... Personally I run pretty much everything in containers. Not always segregated from each others, but certainly segregated from most of the data I care about. All larger projects get their own containers or VMs, and I have several "scratch" VM's and containe…

I don't really understand how that could possibly work. If you install tools on private machines then they never talk to each other.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#106

Post by gcr »

shubber wrote: post #103
geoffschmidt wrote: post #61

Earlier quoted context omitted.

Meteor dev here.. We actually think this is more secure, or at least does more to raise awareness about security! We want people to BE AWARE that they're running arbitrary code, secured only by the certificate authorities in their local curl install. Just about every other way of installing software ends up letting the remote run arbitrary code on your machine. The disadvantage of the other approaches is that you don…

Which is all interesting, except the shell script is a wrapper on "download this tarball and unpack it" or "download this rpm/deb and install it." So whatever security concerns existed on those approaches, you only concealed them. Why exactly?

I wish we had shell script installers that are 1. easily proofreadable, and 2. served over SSL, like this:

    #!/bin/bash
    #
    # Installs a product from the Internet.
    # PLEASE READ CAREFULLY!
    #
    mkdir /tmp/foo-installer
    cd /tmp/foo-installer
    
    cat > file_2.sh  file2.png

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#107

Post by derringer »

MrBra wrote: post #94

Aren't we all scared that some time in the future from now, new kids will have new tools that will make programming a totally customizable and super-performing web application as trivial as for example dragging some component here and there, like for us has been working with new generation programming environments, compared to i.e. coding asm? This is a part of the hidden feeling I guess.. Also that then, our present…

You're likely being down voted because since the invention of programming the field has been continuously becoming "easier" often by leaps and bounds. However, programmers always remain at the edge of the boundary so there is continuously more work for programmers, not less. Every component of what made things "easy" can be improved by making it more flexible, performant etc. and doing this most believe will always require a skilled programmer.

But to play devils advocate, if we were to create true artificial intelligence (I guess it would just be intelligence at that point) then not only would programmers be obsolete, but all of humanity would be obsolete. We'd all just be WALL-E style mouths to feed. This seems difficult to imagine, but we already see it happening in some ways. Unemployment is high almost everywhere and there's no fundamental economic law that every human on the planet can contribute sufficiently to match said human's consumption.

Essentially what this means is we have two pretty rough options. First, all of these people fall under the welfare state. The homeless and hungry all get what they need through governments, NGOs and charities. The other is the Darwinian approach, nature's great equalizer. Both of these options suck pretty hard, but that may be the world we're looking at until our robot overlords turn us into batteries (although it's more likely we'd become pets if anything at all).

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#108

Post by scottmagdalein »

nedludd wrote: post #66
scottmagdalein wrote: post #54

Earlier quoted context omitted.

This isn't a "learn how to be a programmer" tutorial. This is a "look how easy Meteor makes getting something simple built and deployed". So instead of the theory of relativity, how about using a calculator to do your taxes.

Fair enough. But this is still not teaching me much about actually writing an app in Meteor. It tells me to type the code in, not how it works or what it all means. To use the calculator metaphor it would like saying: "enter 75345 + 3455 / 4, there's your taxes!"

I see. For me, a beginner programmer, this type of thing is really helpful in explaining what you can do with the language/framework and what the structure of build/deploy looks like.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#109

Post by lobster_johnson »

jaequery wrote: post #14

whats the difference between mailgun and sendgrid?

Our SendGrid experience has been middling. We have fought a half dozen of bugs -- the week I was implementing it our first app I had seven tickets open in their support system -- with admin screens that time out or don't work, APIs that time out, etc. Everything from the APIs to the admin just feels a bit unfinished and amateurish.

Support has been very lacking. At one point I had waited a long time (a week?) for a ticket response while they said they would investigate, and suddenly they just closed the ticket with no explanation. I felt like I had to fight to get any attention.

That said, its delivery seems reliable.

We have since switched to Mailgun for a lot of stuff, and will be migrating the rest soon. Mailgun has been rock solid from the start, the admin screens are fast, the APIs just make sense, and they were really responsive when we asked about a missing feature. Unlike SendGrid where the delivery log took ages to show results, Mailgun's equivalent page is really snappy. A big time saver when someone complains about not receiving a password or something.

Mailgun is also quite a bit cheaper.

Re: Create a web app from scratch in under 5 minutes with Meteor and Mailgun

#110

Post by vidarh »

javajosh wrote: post #105
vidarh wrote: post #101

Earlier quoted context omitted.

Which is why Linux, BSD's and most Unix versions have a wide range of more restrictive access control methods,such as various forms of containers, jails and VM's... Personally I run pretty much everything in containers. Not always segregated from each others, but certainly segregated from most of the data I care about. All larger projects get their own containers or VMs, and I have several "scratch" VM's and containe…

I don't really understand how that could possibly work. If you install tools on private machines then they never talk to each other.

Of course they can: Via network interfaces (which can be firewalled). Via shared directories on shared filesystems. Etc. With e.g. LXC the extent of isolation is can be controlled at a very detailed level. In practice, though, very little stuff needs more than a network connection to interact with each others, and very few applications actually have any business interacting with the other applications I run other than in very specific circumstances.

This is not to say that I run everything isolated from everything else. I have a "unsafe" VM for example where I compile and mess around with a lot of public code I don't want to evaluate the security of. To get further into my network from that one still takes a little bit of work. I also group together various things based on tasks.

But random code I don't have a reason to trust won't go straight into my normal user account on my laptop.

Note that a "reason to trust" can be as simple as "has been signed by the Debian packagers" for some systems. It's a trade off.

Post reply on HN