Earlier quoted context omitted.
I agree with what you're saying, but a lot of people make it look like Meteor allows XSS and SQL Injection by default. You really only need to remove autopublish from the get go right after meteor create foobar and you begin with a secure app.
You should never have to do anything to become secure. The mantra is: secure by design; secure by default; secure by configuration.
Meteor Raises $20M
151–160 of 163 posts
Re: Meteor Raises $20M
#152Earlier quoted context omitted.
What you're saying is only true on a barebones default Meteor app. Please don't comment on a tool if you've never used it for anything other than a hello world, you're doing a very sophisticated tool a huge disservice. You remove the autopublish package and you can no longer query records from the client.
There's no excuse for insecure defaults.
Likewise, no matter what languages, majority are insecure by defaults.
Re: Meteor Raises $20M
#153Earlier quoted context omitted.
> For intance, when is it ever OK to let your client write directly in the database, even for their own data? If you're going to pass their calls through a deny and allow call, why not just expose RPCs to the client that will handle any writing? Good question. A pattern I like to use for this in Meteor is to rely solely on their Method calls which allow you to restrict any database ops to the server side. The trick i…
Yes, thanks, sort of! The pattern you use is basically the one I would naturally do, but it doesn't feel "meteoritic"... the client side manipulation of the db really seems centric to the magic of it. Regarding the concurrent store, forget event about the client. You need to check whether or not the inventory has been depleted and then update the inventory, and create the client's invoice. That means blocking calls,…
In the prototyping sense, yes. I've been working with Meteor for about two years and the pattern I shared above still feels magical when you realize what it's doing in just a few minutes of work. The client-side writes are still okay. The big problem is remembering to specify the correct allow/deny rules.
The pattern above is a sort of brute force approach to saying "I'm an idiot, I'll forget to set rules, let's make this a non-issue." Of note, I recall some chatter about dropping allow/deny rules altogether in the future, so there's likely a better solution on the horizon.
> You need to check whether or not the inventory has been depleted and then update the inventory, and create the client's invoice.
This isn't as big of a problem as it's being made out to be. Really just a few lines of code, e.g.:
```
// Fetch just makes this an array instead of a Mongo cursor.
// The fields part just strips the returned object(s) back
// with only those fields + the _id of the object.
var inventoryAvailable = Inventory.find({product: productName}, {fields: {"available": 1}}).fetch();
if ( inventoryAvailable.available > 1 ) { // Call some purchase function. } else { // Throw an error back to the client. }
```
Re: the concern around race conditions between customers, Meteor could actually have a leg up on this. Because you have reactivity, if say there was only 1 of an item left, if one customer completed the purchase before another, you could throw up an overlay on the slower customers screen saying "uh oh, the last one of these just got snatched up...get on the waiting list?"
A lot of ways to skin this cat :)
Re: Meteor Raises $20M
#154Earlier quoted context omitted.
Maybe you're right and everyone else on this comment thread are suffering from some cognitive dissonance? I'd be willing to bet much of those SO questions and replies are a part of keeping up the Meteor hype with most questions being answered by a core group of devs. The PR machine for Meteor is crazy. It's funny because this 20M will go to generating more hype and PR opportunities, while the actual development will…
I wonder where all of the dislike for Meteor originated. It's a cool product built buy some really smart people. They have the best cli tool I've used in a dev environment, and they're making a ton of progress. They're constantly publishing materials on integrating with third-party components including react, rethinkdb, famo.us. I hear you about the potential implosion by acquisition. It's definitely a risk. It's not…
I was brought into a company where the lead dev was doing everything in Meteor, if I wasn't open to Meteor at the time I would not have taken the job. Over the course of 6 months I watched this dev utilize their ability to sound smart to fool everyone into thinking Meteor was the right tool for the job when they really just wanted to become a Meteor expert since they thought this would be the next .NET that would give them sweet cushy consulting gigs in industries with crazy technology budgets.
I worked with the technology and was unimpressed. Everything needs to go through Meteor and it leaves no room for flexibility. Going with Meteor is an all-in strategy... and anyone who knows strategy ought to know that going all-in is for when you're exceedingly confident or exceedingly desperate.
I recognize Meteor's utility as a rapid prototyping tool. I will openly say anywhere that if you have little development resources and want to build out a proof of concept. Yes, utilize Meteor. But if you don't throw it away after you've shown whoever needs the proof, you are asking for trouble.
The problem with lowering the bar with a new paradigm exposed to a new generation of programmers is that they're being taught bad habits and bad patterns. Tightly coupling the front and back end (what "isomorphic javascript" really means) is Meteor's main selling point. Tight coupling of systems is a universally accepted anti-pattern and anyone who has a product that eventually requires flexibility in their client-server communication is going to find themselves stuck when everyone just stares blankly repeating "but... DDP?"
Creating a new generation of programmers who call themselves rockstars because they know how to run a couple Meteor CLI commands and make a Todo list app in 20 minutes is not going to make the Internet a better place.
Re: Meteor Raises $20M
#155Is anyone here running Meteor in production? I've seen so many intro's and demo's and prototypes but have yet to see any actual products / companies built around it yet.
A couple months ago we launched edgee, a platform for sharing high-quality content in carefully curated collections, called edgees. The app runs on Meteor and we're very happy with it. http://www.edgee.com
Re: Meteor Raises $20M
#156Earlier quoted context omitted.
There's no excuse for insecure defaults.
I disagreed, in OWASP: It is important to understand that by no means does “Secure Defaults” mean turning off all possible network applications or sockets and services. And neither do Secure Defaults mean a 100% secure environment. But, they should ensure the least number of possible loopholes and fewer drawbacks. Likewise, no matter what languages, majority are insecure by defaults.
Re: Meteor Raises $20M
#157Earlier quoted context omitted.
I guess, but that's some monumental hackery to overcome something that works perfectly fine in an RDBMS :-)
Until the time comes when you need to scale out your RDBMS and need to shard it. IMO that's a bigger pain ;). Plus if you have multiple servers, they will most likely need to pass messages for other things too.
Further, I tend to think that if your application is heavy enough to outgrow a reasonably fat db server with (say) 500+GB of RAM, strategies like reimplementing consistent-db-esque locking in an app server + zookeeper setup are also likely to hit some pretty weird performance issues.
Re: Meteor Raises $20M
#158Earlier quoted context omitted.
I wonder where all of the dislike for Meteor originated. It's a cool product built buy some really smart people. They have the best cli tool I've used in a dev environment, and they're making a ton of progress. They're constantly publishing materials on integrating with third-party components including react, rethinkdb, famo.us. I hear you about the potential implosion by acquisition. It's definitely a risk. It's not…
Seems to me I'm one of the few people who are willing to openly express their dislike while also having a real life use case where it caused harm to a startup actively seeking funding. I was brought into a company where the lead dev was doing everything in Meteor, if I wasn't open to Meteor at the time I would not have taken the job. Over the course of 6 months I watched this dev utilize their ability to sound smart…
It sounds like you were in an organization where there was some fundamental disagreement that caused the contention.
I don't have any skin in the game, but I find this account to be an unfair characterization of Meteor, so I'd like to refute some of your claims.
First, I really don't know where you got the idea that Meteor is an all-or-nothing stack. Sure, it provides everything you need, but you're not compelled to use what it provides. Meteor works very well with all sorts tech.
* The website has a whole subdomain devoted to using it with Angular: http://angular-meteor.com/.
* Here's talk given about using React: https://youtu.be/-QtrkXKvQFc. I'm currently doing this with great results.
* Here's one of a few projects providing support for PostgreSQL: https://github.com/meteor-stream/meteor-postgres/wiki/Gettin...
Basically, if there is javascript support for it, you can use it with Meteor.
Secondly, it's disingenuous to say that Isomorphic Javascript is just bad tight coupling by invoking "universally accepted anti-pattern" because someone can come along and spout equally broad and obnoxious engineering-speak, calling it DRY and touting its core principle of code reuse as best practice.
Now, I am genuinely interested in specific shortcomings and outright failures of the technology. If you had a bad experience with DDP, I'd like to hear about it so I don't make the same mistake.
Re: Meteor Raises $20M
#159Earlier quoted context omitted.
Until the time comes when you need to scale out your RDBMS and need to shard it. IMO that's a bigger pain ;). Plus if you have multiple servers, they will most likely need to pass messages for other things too.
I dunno - you've presumably got to implement code to make sure that other servers get unlocked when your locking app server goes down, for example. Personally I try to avoid implementing ad-hoc distributed systems if I can avoid it. Having to shard is pretty damn crappy, but under the circumstances I'd favour it. Further, I tend to think that if your application is heavy enough to outgrow a reasonably fat db server w…
Don't see why you'd need locking. Node A receives a request to buy an item, A asks nodes B, C, and D to confirm that the item is in stock in each node's internal state. If all give the OK, A lets the purchase go through. If node B goes down, then A just asks C and D. I don't see the need for locking or a master/slave.
> a reasonably fat db server with (say) 500+GB of RAM
You have a single point of failure with a single, monolithic server. If its hd dies, you will be in serious trouble restoring terabytes of db.
Re: Meteor Raises $20M
#160I just wish it wasn't so tightly integrated into everything. I'd love to use Meteor as a library, but I'm always afraid of choosing something that I can't replace later. Either way, best of luck to them!
There's also a list of libraries for other languages that communicate with Meteor via DDP. [2]
[1] https://www.meteor.com/ddp [2] http://meteorpedia.com/read/DDP_Clients