What's coming in Meteor 1.2, and beyond • Hacker News Board

Re: What's coming in Meteor 1.2, and beyond

#21

Post by sarciszewski2 » Wed, Jul 01, 2015, 2:36 PM UTC

logicallee wrote: post #18

sarciszewski wrote: post #7

Earlier quoted context omitted.

Hack their webserver, replace the contents of https://install.meteor.com/ with malware, instantly pwn anyone who pipes that to their shell. Worse: the people who are most likely to curl|sh are DevOps folks with the keys to their company's kingdom.

What do you want them to do? The obvious solution is to change it from "curl|sh" to "curl|{something about whetehr PGP says this is properly signed by the private key belonging to public key blahblahblahblahbalhMETEOR.COMkey. If yes:}|sh" But the problem is anyone compromising the site can just change the line from "blahblahblahblahbalhMETEOR.COMkey" to "attackerchangedblahblahblahblahbalhMETEOR.COMkey" right on the…

> What do you want them to do?

I want them to not use a one-liner. Step-by-step:

1. Download the files

2. Download the public key

2a. verify the public key if you've never seen it before (publish in the blockchain, have lots of high profile technologists sign it, etc)

3. If the verification matches, then proceed.

Teaching developers to value "clever one-liner hack" over "secure, dependable solution" will lead to bad habits.

Re: What's coming in Meteor 1.2, and beyond

#22

Post by kidsil » Wed, Jul 01, 2015, 2:37 PM UTC

Yeah! I knew it wasn't just my gut feeling when I went ALL THE WAY with Meteor :)

Re: What's coming in Meteor 1.2, and beyond

#23

Post by mark_l_watson » Wed, Jul 01, 2015, 2:39 PM UTC

Great news that ES6 support is shipping this summer. You can already use Babel, but having everything set up by default, with examples using ES6 will be great.

BTW, I wish there would also be built in support for Typescript. I have done some simple experiments with Meteor and Typescript but it has a do-it-yourself feel abut it. As much as I like Typescript, I will probably just use ES6.

Re: What's coming in Meteor 1.2, and beyond

#24

Post by vdaniuk » Wed, Jul 01, 2015, 2:40 PM UTC

sarciszewski wrote: post #17

joepie91_ wrote: post #9

Earlier quoted context omitted.

It being a common thing is the problem. It's teaching insecure habits.

People are downvoting this and being too much of a coward to state why they are.

I am downvoting them because shell piping is not relevant to Meteor 1.2 announcement, this topic was discussed on multiple occasions and they offer no alternative.

Re: What's coming in Meteor 1.2, and beyond

#25

Post by sarciszewski2 » Wed, Jul 01, 2015, 2:41 PM UTC

vdaniuk wrote: post #24

sarciszewski wrote: post #17

Earlier quoted context omitted.

People are downvoting this and being too much of a coward to state why they are.

I am downvoting them because shell piping is not relevant to Meteor 1.2 announcement, this topic was discussed on multiple occasions and they offer no alternative.

Sure it's relevant.

They're announcing "hey we have these new features" and I'm saying "hey look, they still haven't fixed this big glaring problem that is very much relevant to how their software is used".

Re: What's coming in Meteor 1.2, and beyond

#26

Post by rimantas » Wed, Jul 01, 2015, 2:42 PM UTC

joepie91_ wrote: post #9

ruswick wrote: post #6

Earlier quoted context omitted.

That's a pretty common thing. I don't see the problem.

It being a common thing is the problem. It's teaching insecure habits.

Ok, I wonder how many do bother to check checksums after downloading binaries?

Re: What's coming in Meteor 1.2, and beyond

#27

Post by logicallee » Wed, Jul 01, 2015, 2:48 PM UTC

sarciszewski2 wrote: post #21

logicallee wrote: post #18

Earlier quoted context omitted.

What do you want them to do? The obvious solution is to change it from "curl|sh" to "curl|{something about whetehr PGP says this is properly signed by the private key belonging to public key blahblahblahblahbalhMETEOR.COMkey. If yes:}|sh" But the problem is anyone compromising the site can just change the line from "blahblahblahblahbalhMETEOR.COMkey" to "attackerchangedblahblahblahblahbalhMETEOR.COMkey" right on the…

> What do you want them to do? I want them to not use a one-liner. Step-by-step: 1. Download the files 2. Download the public key 2a. verify the public key if you've never seen it before (publish in the blockchain, have lots of high profile technologists sign it, etc) 3. If the verification matches, then proceed. Teaching developers to value "clever one-liner hack" over "secure, dependable solution" will lead to bad…

if you're going to include "2a" you can refactor all of your steps into:

1. Google "meteor.com compromised" and decide whether it's currently compromised. If it isn't:

2. Run curl https://install.meteor.com|sh

It saves a few steps and is equally secure - you know, since you're just going to go based on what other people think and include no programmatic check whatsoever. (your 2a).

Re: What's coming in Meteor 1.2, and beyond

#28

Post by sarciszewski2 » Wed, Jul 01, 2015, 2:50 PM UTC

logicallee wrote: post #27

sarciszewski2 wrote: post #21

Earlier quoted context omitted.

> What do you want them to do? I want them to not use a one-liner. Step-by-step: 1. Download the files 2. Download the public key 2a. verify the public key if you've never seen it before (publish in the blockchain, have lots of high profile technologists sign it, etc) 3. If the verification matches, then proceed. Teaching developers to value "clever one-liner hack" over "secure, dependable solution" will lead to bad…

if you're going to include "2a" you can refactor all of your steps into: 1. Google "meteor.com compromised" and decide whether it's currently compromised. If it isn't: 2. Run curl https://install.meteor.com|sh It saves a few steps and is equally secure - you know, since you're just going to go based on what other people think and include no programmatic check whatsoever. (your 2a).

2a can be swapped out for a better PKI system at any time. Relying on whether it's public knowledge that Meteor is compromised or not is not nearly as resilient.

Re: What's coming in Meteor 1.2, and beyond

#29

Post by Siyfion » Wed, Jul 01, 2015, 2:56 PM UTC

matthewbauer wrote: post #4

When ES6 and web components come out, are we even going to need frameworks like Meteor? It seems like all of the advantages of MVC frameworks go away once you can create controllers and models in native Javascript and views in native HTML.

It's completely different from ES6, it's a full-stack framework, so it does SO much more than just a front-end framework.

Meteor's main selling point is the reactivity; you can call `Books.insert({ name: "test" });` on the client, in-browser and it then updates the UI optimistically, updates the DB on the server AND propagates the change to all other clients, which in turn updates their UIs. All with one line of code.

Take a look at DDP, one of the core building-blocks of Meteor: https://www.meteor.com/ddp

Re: What's coming in Meteor 1.2, and beyond

#30

Post by joshribakoff » Wed, Jul 01, 2015, 2:56 PM UTC

matthewbauer wrote: post #4

When ES6 and web components come out, are we even going to need frameworks like Meteor? It seems like all of the advantages of MVC frameworks go away once you can create controllers and models in native Javascript and views in native HTML.

Sure. Meteor can be used to implement your backend, frontend, or both frontend & backend. Web components are a frontend concept only [from what I understand]. Meteor's frontend code can "bind" to your backend, and render real time data updates.... while web components have no concept of "backend" at all.

There could also be a desire to wrap multiple web components into an Angular directive, or wrap multiple Angular directives into a meteor module, etc.