Live data from Hacker News

Show HN: Meteor, a realtime JavaScript framework

meteor.com

41–50 of 350 posts

Re: Show HN: Meteor, a realtime JavaScript framework

#41
post #34

Is GPL really viable for a web framework? The Free Software Foundation has consistently held that linking to GPL code (not LGPL) is derived work.

[[citation needed]]. From what I remember, the FSF is pretty consistent in saying that deriving from GPL code is derived work. If your linking constitutes a derivation (a common example would be a database handler that you adapt to your application after you've loaded it) then it is a derivation. If you just loosely call it, it is not.

Re: Show HN: Meteor, a realtime JavaScript framework

#43

The live demo is here: http://colors.meteor.com/ Seems to have a minor glitch with unicode characters? When you do Colors.remove() everything goes away, but the entries with unicode all come back? Somewhat strange... Interesting tech, but db access from the client scares me to no end, call me a curmudgeon I guess.

Performance on that url also seems to be super slow right now with a lot of people hitting it. Curious to see how Meteor handles loads, it's really exciting stuff.

Re: Show HN: Meteor, a realtime JavaScript framework

#44
post #34

Is GPL really viable for a web framework? The Free Software Foundation has consistently held that linking to GPL code (not LGPL) is derived work.

I think Meteor actually has the opposite problem: Running a web app is not generally considered to be distribution, so as long as you aren't actually giving the source code to anybody else, the requirements of the GPL don't apply to you. (IANAL, but this is my understanding.)

Re: Show HN: Meteor, a realtime JavaScript framework

#45
It was a few years since I was "in" with the new things happening in the web-world.

But how did JavaScript come to be the new "cool" language? It got some horrible problems with object oriented stuff, some really strange bugs/features, and it's slow-ish.

I liked making cool stuff with JavaScript, but compared to something like ruby isn't this a step backwards?

I can see the advantages of this framework, but it still seems wonky.

Re: Show HN: Meteor, a realtime JavaScript framework

#46
post #41
post #34

Is GPL really viable for a web framework? The Free Software Foundation has consistently held that linking to GPL code (not LGPL) is derived work.

[[citation needed]]. From what I remember, the FSF is pretty consistent in saying that deriving from GPL code is derived work. If your linking constitutes a derivation (a common example would be a database handler that you adapt to your application after you've loaded it) then it is a derivation. If you just loosely call it, it is not.

Golden, Bernard (2005), "Chapter 3. Open Source Risks", Succeeding with Open Source, Addison-Wesley, p. 44, ISBN 9780321268532

You appear to be confusing GPL with the "GPL With Linking Exception" https://en.wikipedia.org/wiki/GPL_linking_exception

Re: Show HN: Meteor, a realtime JavaScript framework

#47

The live demo is here: http://colors.meteor.com/ Seems to have a minor glitch with unicode characters? When you do Colors.remove() everything goes away, but the entries with unicode all come back? Somewhat strange... Interesting tech, but db access from the client scares me to no end, call me a curmudgeon I guess.

Performance on that url also seems to be super slow right now with a lot of people hitting it. Curious to see how Meteor handles loads, it's really exciting stuff.

I think that someone might've gotten clever and done something like, while (true) { Colors.insert(...); }

On a related note, they took it down now.

Re: Show HN: Meteor, a realtime JavaScript framework

#48
post #25

This looks extremely interesting, and reminds me a bit of Lunascript ( http://asana.com/luna/ ). I'm very interested in who is paying for the development? I notice that there's no big tech company behind this and from the contact page I can see Meteor Development Group has an office in downtown San Francisco. So do you have any info on what the plan is regarding monetization?

Well, I am one of the Meteor devs, and I used to work at Asana :) Luna is an astonishing codebase, and Meteor is a small fraction of it in sophistication and functionality. But we think there's room for a lighter weight framework for the masses.

Monetization: We're still figuring that out. For now, we just want to see what people do with it. We think a lot about companies like redhat and mysql, and how they have been successful while building open ecosystems.

Re: Show HN: Meteor, a realtime JavaScript framework

#49
post #7

Earlier quoted context omitted.

From the docs ( http://docs.meteor.com/#meteor_collection ): "Currently the client is given full write access to the collection. They can execute arbitrary Mongo update commands. Once we build authentication, you will be able to limit the client's direct access to insert, update, and remove. We are also considering validators and other ORM-like functionality." So just for toys for the moment. Still, very cool...

insert/update/remove are actually just "newbie helper" shortcuts on top of the underlying latency-compensated RPC mechanism (which is documented under 'Meteor.methods'.) Once the auth branch lands, you'll have two choices. One options is, you can turn off the shortcuts entirely, and write a method for each scenario where the client would be allowed to write to the database. This gives you the same security model as a…

The query-validation-only approach seems scary to me. It'd be like, in rails, relying exclusively on before_save callbacks for authorization. My gut says that would be error-prone in catastrophic way. Also, not all data is public.

Re: Show HN: Meteor, a realtime JavaScript framework

#50
post #22

Earlier quoted context omitted.

Right. But as soon as you have this ability, don't you quickly turn off insert/update? then you throttle/contain reads... So in the end, do we benefit from having a client side database connection? I'm struggling to put together a real-world use case for one that isn't irresponsible.

It seems like standard operating procedure for web apps has been to immediately throw out the user account system of whatever data store is being used and use one account with full CRUD access (or worse), with a (mediocre to disastrous) home-grown permissions system shoehorned into the controller layer. That may be because of programmer laziness or because of some sort of inherent impedance mismatch between web-scale…

Show me a 'web-scale' system that has a single data-store to secure in the first place. Something like much-better-Oracle-row-based-auth or whatever isn't gonna cut it.. cause who watches over Redis, or memcache, or the filesystem?
Post reply on HN