Live data from Hacker News

What's coming in Meteor 1.2, and beyond

info.meteor.com

1–10 of 98 posts

Re: What's coming in Meteor 1.2, and beyond

#7
post #6

And yet they still tell people to install Meteor by piping to their shell. Incredible. http://curlpipesh.tumblr.com/ https://paragonie.com/files/blog/pipeshell.jpg

That's a pretty common thing. I don't see the problem.

Hack their webserver, replace the contents of https://install.meteor.com/ with malware, instantly pwn anyone who pipes that to their shell.

Worse: the people who are most likely to curl|sh are DevOps folks with the keys to their company's kingdom.

Re: What's coming in Meteor 1.2, and beyond

#8
Official React support - woohoo! I've been using React and Meteor together to build a desktop web app for quantified self, and I have to say, the combination is magnificent for productivity. The app is 90% JS and a little CSS, and reactively updates with no extra code. MongoDB and server logic is separated from the client-side view rendering, so if I wanted to make it a thin client and remotely host the computations on another server it would be a piece of cake.

An example file of code for the records overview (dashboard was a bit tabby-spacey): https://github.com/liamzebedee/metric/blob/master/client/fea...

Re: What's coming in Meteor 1.2, and beyond

#9
post #6

And yet they still tell people to install Meteor by piping to their shell. Incredible. http://curlpipesh.tumblr.com/ https://paragonie.com/files/blog/pipeshell.jpg

That's a pretty common thing. I don't see the problem.

It being a common thing is the problem. It's teaching insecure habits.

Re: What's coming in Meteor 1.2, and beyond

#10
post #6

Earlier quoted context omitted.

That's a pretty common thing. I don't see the problem.

Hack their webserver, replace the contents of https://install.meteor.com/ with malware, instantly pwn anyone who pipes that to their shell. Worse: the people who are most likely to curl|sh are DevOps folks with the keys to their company's kingdom.

Commit a race condition to glibc,musl,uclibc and fuck up almost every software on the planet.

It's convenient and that does not mean it's a good practice but i doubt using an other method would minimize a risk when the meteor.com would actually get owned.

Post reply on HN