Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful when going client-only (Firebase)

robinverton.de

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Be careful when going client-only (Firebase)

#12

Post by patio11 »

jamest wrote: post #10

[Firebase Founder] Hi Robin, You’re right, some folks don’t fully setup their security rules. We remind our developers to do this, but can -- and clearly need -- to do more. Your suggestion about requiring security rules is a good one. We’ll be going through our customers and providing more personalized feedback on their security rules in the coming days. Also, we are working on additional tutorials and examples to t…

So good news and bad news, bad news first: There doesn't appear to be a Firebase security contact page where you spell out how to get in touch with you if a researcher discovers something like this. Industry standard practice is, for better or worse, if you do not have that page then any available textarea is an acceptable method for communication with you about security vulnerabilities in your software.

The good news: you can trivially address this by adding one page in your CMS, calling it "Security", writing a few sentences of copy, and adding a) an email address which is monitored, b) a promise to write back, and c) (optional) a PGP key.

Some good examples:

http://www.twilio.com/docs/security/disclosure

http://37signals.com/security-response

http://technet.microsoft.com/en-us/security/ff852094.aspx

P.S. This advice is broadly applicable to everyone here who owns or helps to manage a software company.

Re: Be careful when going client-only (Firebase)

#13

Post by jamest »

patio11 wrote: post #12
jamest wrote: post #10

[Firebase Founder] Hi Robin, You’re right, some folks don’t fully setup their security rules. We remind our developers to do this, but can -- and clearly need -- to do more. Your suggestion about requiring security rules is a good one. We’ll be going through our customers and providing more personalized feedback on their security rules in the coming days. Also, we are working on additional tutorials and examples to t…

So good news and bad news, bad news first: There doesn't appear to be a Firebase security contact page where you spell out how to get in touch with you if a researcher discovers something like this. Industry standard practice is, for better or worse, if you do not have that page then any available textarea is an acceptable method for communication with you about security vulnerabilities in your software. The good new…

Thanks Patrick. Point well taken.

I'll add one now.

Re: Be careful when going client-only (Firebase)

#14

Post by icebraining »

Kiro wrote: post #9

Requiring Security Rules is a bad idea and would really stall the work flow in projects where you don't need them. I have one of those where I don't care if people manipulate the data via the console. Anyway, the Firebase team should really address these security issues that keep coming up all the time.

They could just have an "ALLOW ALL" rule; at least, it would be an explicit decision.

Re: Be careful when going client-only (Firebase)

#15

Post by greenido »

jamest wrote: post #10

[Firebase Founder] Hi Robin, You’re right, some folks don’t fully setup their security rules. We remind our developers to do this, but can -- and clearly need -- to do more. Your suggestion about requiring security rules is a good one. We’ll be going through our customers and providing more personalized feedback on their security rules in the coming days. Also, we are working on additional tutorials and examples to t…

Hey Jamest,

I hear you about "...Firebase-powered apps are only as secure as the developers make them..." but I guess, you should try to do your best in order to 'tunnel' developers into the best practices of validating input/output and not relying on the client to send 'safe' data. I know it's easy to say and hard to do :) Nevertheless, it's a great goal to have.

Good luck! Ido

Re: Be careful when going client-only (Firebase)

#16

Post by groundCode »

Given that the use case for Firebase is taking the place of your traditional server side architecture and storage, it seems kind of obvious that you would have to take heed of the security implications and set them up properly. The security concerns don't magically vanish just because you don't write the server side code.

Re: Be careful when going client-only (Firebase)

#17

Post by jamest »

greenido wrote: post #15
jamest wrote: post #10

[Firebase Founder] Hi Robin, You’re right, some folks don’t fully setup their security rules. We remind our developers to do this, but can -- and clearly need -- to do more. Your suggestion about requiring security rules is a good one. We’ll be going through our customers and providing more personalized feedback on their security rules in the coming days. Also, we are working on additional tutorials and examples to t…

Hey Jamest, I hear you about "...Firebase-powered apps are only as secure as the developers make them..." but I guess, you should try to do your best in order to 'tunnel' developers into the best practices of validating input/output and not relying on the client to send 'safe' data. I know it's easy to say and hard to do :) Nevertheless, it's a great goal to have. Good luck! Ido

Thanks Ido, I absolutely agree we should guide developers towards best practices.

We'll be aiming to do this with future tutorials on security.

Re: Be careful when going client-only (Firebase)

#18

Post by manojlds »

groundCode wrote: post #16

Given that the use case for Firebase is taking the place of your traditional server side architecture and storage, it seems kind of obvious that you would have to take heed of the security implications and set them up properly. The security concerns don't magically vanish just because you don't write the server side code.

Actually, people might be of the wrong notion that doing things like

    if(!user) { alert('you are not logged in!');}
are enough even when coding on the client side.

Re: Be careful when going client-only (Firebase)

#20

Post by film42 »

film42 wrote: post #6

This was something that really prevented me from pursuing Firebase as a real asset, despite its easy real time socket magic. If there's a diagram to "roll your own" after, though, it's probably moot (forums/ chat). Their json-rpc server has a really slick api and they've spent a lot of time on problems such as authentication and data security. You could argue that moot is just a very well designed Firebase app as far…

UPDATE: I seem to have been voted down. Yet, I have no idea why. Thanks, HN.
Post reply on HN