Ruby, Let's Take a Break. I Want To Date Node For a While.

Post by sespindola » Sat, Mar 31, 2012, 4:30 PM UTC

gphil wrote: post #6

judofyr wrote: post #4

Earlier quoted context omitted.

I keep hearing about this, but has anyone actually done this?

And furthermore, what are the security ramifications of doing this? At first glance, it seems attackers would be able to forge JSON objects resulting in "mass-assignment" style vulnerabilities (unless there is lots of protection logic) when sending JSON objects back to the server side. However, going in the other direction (sending JSON from server to client) is a very common pattern.

Post by StavrosK » Sat, Mar 31, 2012, 4:32 PM UTC

sespindola wrote: post #11

gphil wrote: post #6

Earlier quoted context omitted.

And furthermore, what are the security ramifications of doing this? At first glance, it seems attackers would be able to forge JSON objects resulting in "mass-assignment" style vulnerabilities (unless there is lots of protection logic) when sending JSON objects back to the server side. However, going in the other direction (sending JSON from server to client) is a very common pattern.

This. Most tutorials of Backbone/Ember js apps I've seen have thin backends that commit any json objects the clients send them. Data sanitization and validation on the backend should be as thourough as that of the client, if not more.

Post by ootachi » Sat, Mar 31, 2012, 4:41 PM UTC

andrewvc wrote: post #8

davemo wrote: post #2

A friend who is wrapping up the last year of his computer science education asked me last night "so what's this node.js stuff all about?". I thought about it for a few seconds and then told him the value of writing a web-app in node was the ability to use 1 language from top to bottom. In my experience, most of the detractors of node seem to miss the value that a homogenous programming environment can bring. I'm inte…

I've used node, and I just don't see it. You can share fragments of code, but for reasons of both security and logic not much more. In my view, the evented nature of node negates most of the pluses of one language. Additionally, javascript is a shitty language if what you want is a large amount of business logic. Python and ruby are much more concise and expressive. This is a huge win that a lot of people overlook. N…

Post by nato1138 » Sat, Mar 31, 2012, 4:44 PM UTC

Post by [deleted] » Sat, Mar 31, 2012, 4:59 PM UTC

StavrosK wrote: post #14

I don't know, I want to make an HTTP spider and I don't want to have one process per request, so the obvious thing was to use something asynchronous. Still, Python+gevent sounds better than node, so I don't see the advantages of using Javascript for that. What does it get me over Python+gevent, which has a more natural asynchronous programming syntax?