Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CouchDB 3.0

blog.couchdb.org

Post reply on HN
Print view View original

61–70 of 161 posts

Re: CouchDB 3.0

#61

Post by dumbfounder »

Quarrelsome wrote: post #50
dumbfounder wrote: post #46

Earlier quoted context omitted.

MongoDB is a an actual for-profit company, so of course it has marketing. CouchDB is an open source apache project. You are comparing apples to oranges.

Its not just CouchDB, I did a lot of searching a little while back and I generally just don't like how tightly they've wrapped up almost all of the results. If you go by searching alone its overwhelmingly MongoDB positive to such an extent that its hard to believe its organic. It's definitely impressive marketing but when I'm deciding on which tool to use that arguably works against them as opposed to for them.

How tightly they wrapped up the results? Perhaps you could give examples?

Re: CouchDB 3.0

#62

Post by daleharvey »

yatsyk wrote: post #53
newfeatureok wrote: post #49

Earlier quoted context omitted.

You resolve that issue the same way you would resolve the same issue if you were using Postgres - you introduce some back-end. For your example specifically I'd use a proxy.

Custom backend means no synchronisation and no advantages over postgres. Do you propose to create proxy that parses query and estimates complexity? I think this task at least as hard as implementing couchdb myself (actually harder) Is there any secure open source code with pouchdb/couchdb integrations?

Your backend can be a reverse proxy that authenticates requests then passes them off to CouchDB (or PouchDB, since that also runs on the server). I have an example up @ https://github.com/daleharvey/noted. The server is 200 lines and does signup / email authentication etc.

Re: CouchDB 3.0

#63

Post by newfeatureok »

yatsyk wrote: post #53
newfeatureok wrote: post #49

Earlier quoted context omitted.

You resolve that issue the same way you would resolve the same issue if you were using Postgres - you introduce some back-end. For your example specifically I'd use a proxy.

Custom backend means no synchronisation and no advantages over postgres. Do you propose to create proxy that parses query and estimates complexity? I think this task at least as hard as implementing couchdb myself (actually harder) Is there any secure open source code with pouchdb/couchdb integrations?

There are plenty of proxies that do that with some config like nginx. Even if you were using a relational database with a backend you’d still have to solve the same problem.

Re: CouchDB 3.0

#64

Post by ng7j5d9 »

Quarrelsome wrote: post #34
tbrock wrote: post #12

At this point why would you use CouchDB over something like MongoDB? Seriously asking... Over the past 5 years MongoDB has gotten a great storage engine, transactions, distributed transactions, multi master replication, first class change streams and is very very solid as a foundational piece of infrastructure you can rely on while CouchDB has languished. I can’t imagine reaching for it in my tool belt when I need a…

MongoDB has _suspiciously_ amazing SEO and marketing. CouchDB's by contrast is awful. As silly as that sounds as a reason to choose CouchDB it demonstrates where the respective company's priorities lie.

Mongo reminds me of Tesla - early products were shoddy but had incredible hype.

"It's incredibly fast!" "It's web scale!" "It'll be able to drive itself cross country in a couple of months!"

And I think the unfounded/exaggerated hype bothered a lot of us, but like Tesla, the actual product seems to have improved quite a lot as they've had time and resources to throw at it. So sure, some of us remember Teslas and MongoDB from 2013 and scoff, but the current reality is much different.

Re: CouchDB 3.0

#66

Post by yatsyk »

daleharvey wrote: post #62
yatsyk wrote: post #53

Earlier quoted context omitted.

Custom backend means no synchronisation and no advantages over postgres. Do you propose to create proxy that parses query and estimates complexity? I think this task at least as hard as implementing couchdb myself (actually harder) Is there any secure open source code with pouchdb/couchdb integrations?

Your backend can be a reverse proxy that authenticates requests then passes them off to CouchDB (or PouchDB, since that also runs on the server). I have an example up @ https://github.com/daleharvey/noted . The server is 200 lines and does signup / email authentication etc.

This server can't prevent authenticated user from uploading huge document of running expensive query.

Re: CouchDB 3.0

#67

Post by Volundr »

yatsyk wrote: post #48

CouchDB/PouchDB looks very promising for offline first apps, but I can’t understand how to restrict bad clients. Client potentially could insert document of huge size or execute expensive query and degrade experience of other clients on the same server. Is it any way to prevent this?

A couple ways:

One you implement validation functions [1] on user databases to control what kind of data can be inserted into couch. These functions can only be changed by database admins, not users, so can act as a security mechanism controlling what goes in.

As mentioned by others you can also implement a proxy. This doesn't have to interfere with sync functionality, you just have to make sure you proxy all the endpoints in the replication protocol [2]. Envoy [3] is one such proxy that essentially applies document level permissions to a CouchDB database without interfering with sync.

If the goal is just to limit document size, or throttle clients trying to hammer the API, this doesn't even have to be a custom proxy, and reverse proxy with the needed control knobs (such as NGINX) will do. You can of course combine this with validation functions, using validations to ensure the everything that comes in is the right "shape" and using NGINX and it's ilk to apply throttling and sane request limits.

At scale there's a decent chance you want a proxy in front of your Couch instance anyway, since Couch is truly multi-master, meaning you probably want to balance your clients across all your nodes anyway.

[1] https://docs.couchdb.org/en/stable/ddocs/ddocs.html#validate... [2] https://docs.couchdb.org/en/stable/replication/protocol.html... [3] https://github.com/cloudant-labs/envoy

Re: CouchDB 3.0

#68

Post by yatsyk »

newfeatureok wrote: post #63
yatsyk wrote: post #53

Earlier quoted context omitted.

Custom backend means no synchronisation and no advantages over postgres. Do you propose to create proxy that parses query and estimates complexity? I think this task at least as hard as implementing couchdb myself (actually harder) Is there any secure open source code with pouchdb/couchdb integrations?

There are plenty of proxies that do that with some config like nginx. Even if you were using a relational database with a backend you’d still have to solve the same problem.

If I use backend I can create all validation logic in application server. But in this case no automatic synchronisation.

One of the major selling point of couchdb is replication protocol for client-server data syncing. When you design product with posgress you don't allow to execute raw sql queries from clients without any application server. But looks like it is recommended way to update data in couchdb world if you want to have synchronisation. I can't understand how can this architecture be secure?

Re: CouchDB 3.0

#69

Post by cgh »

devhead wrote: post #59
xwowsersx wrote: post #38

Earlier quoted context omitted.

it's = "it is" its = possessive form of "it" So should be "it wins for its unique..".

there's always one...as in there is always one who has to poke people for grammer. sighs.

"Grammar". Sorry!

Re: CouchDB 3.0

#70

Post by daleharvey »

yatsyk wrote: post #66
daleharvey wrote: post #62

Earlier quoted context omitted.

Your backend can be a reverse proxy that authenticates requests then passes them off to CouchDB (or PouchDB, since that also runs on the server). I have an example up @ https://github.com/daleharvey/noted . The server is 200 lines and does signup / email authentication etc.

This server can't prevent authenticated user from uploading huge document of running expensive query.

I wasnt worried about that since it is a basic proof of concept, adding that would make it ~210 lines of code.
Post reply on HN