Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trello Tech Stack

blog.fogcreek.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: The Trello Tech Stack

#61

Post by radagaisus »

trotsky wrote: post #48

How vulnerable are all javascript approaches in terms of injection type attacks? Do apps like node and mongo effectively prevent them, or is it still possible to shoot yourself in the foot? I've read some off hand comments along the lines of "as long as you're not a total moron you have nothing to worry about", but that sounds a lot like what was said about sql injections and xss before exploiting them went mainstrea…

You CAN do injections to MongoDB code. An injection is basically 'allow user input to interfere with code' so for mongoDB assuming the query is a string you can do '{name: ' + user_input + '}'. and user_input, without sanitizing it (which is simpler, just converting it to a string) could be: {'$where': ...}

http://www.mongodb.org/display/DOCS/Do+I+Have+to+Worry+About...

Re: The Trello Tech Stack

#63

Post by JoachimSchipper »

trotsky wrote: post #48

How vulnerable are all javascript approaches in terms of injection type attacks? Do apps like node and mongo effectively prevent them, or is it still possible to shoot yourself in the foot? I've read some off hand comments along the lines of "as long as you're not a total moron you have nothing to worry about", but that sounds a lot like what was said about sql injections and xss before exploiting them went mainstrea…

See http://news.ycombinator.com/item?id=3369876. Summary: people seem to be ignoring security.

Also note stuff like https://news.ycombinator.com/item?id=3419693: node.js is not free of issues itself. (To be fair, lots of people got that wrong and it was patched quickly.)

Re: The Trello Tech Stack

#64

Post by nirvdrum »

This part caught my eye:

"The Socket.io server currently has some problems with scaling up to more than 10K simultaneous client connections when using multiple processes and the Redis store, and the client has some issues that can cause it to open multiple connections to the same server, or not know that its connection has been severed."

I wonder if they ran into redis's hard-coded 10k connection upper-limit. As it turns out, their configuration for "unlimited" connections actually has a cap of 10k. I believe in master this is going away, but if you need more than 10k connections on redis <= 2.4, you need to manually patch the daemon, in case anyone else runs into this.

Re: The Trello Tech Stack

#65

Post by davesims »

Not to pick on him, because I think the overall received wisdom on new tech has shifted and morphed a great deal over the last few years, no doubt including Joel's...but I can't resist pointing out that, my how times have changed...

http://www.joelonsoftware.com/items/2006/09/01.html

In other words, it's nice to see Joel greenlight something like this, I'd say it's kind of a sign of the times in terms of the industry's overall comfort level with what would be termed 'hip' technology, or 'new' or whatever moniker you want to attach to it.

Re: The Trello Tech Stack

#66

Post by randito »

jwarzech wrote: post #26
geekfactor wrote: post #10

Does anyone know of any open-source projects out there using a similar stack? I'm particularly interested in learning more about client-side view rendering with Backbone and Mustache... server side can be any of Node, Rails or Django.

I've been using CoffeScript and backbone.js a lot lately, it really has changed my approach to web apps (keep the server light, just transfer json back and forth). The approach that has worked the best for me is to keep pages such as the landing and authentication as traditional rendered pages and save the client side rendering for the user-authenticated 'meaty' parts of the app. If you want to look a couple really-s…

I like the idea of doing authentication and OpenId in a traditional web stack, while doing the "app" portion in a javascript backbonejs stack.

That lets you use existing libraries (Devise, etc.) for the authentication and once that's out of the way, you can go have "fun" with coffeescript and mustache. :)

Re: The Trello Tech Stack

#67

Post by [deleted] »

Rauchg wrote: post #31
dodger wrote: post #28

Earlier quoted context omitted.

Today I'd consider going with a service, but first I'd see how https://github.com/LearnBoost/websocket.io looks. Most of our problems have been with abstractions in the socket.io client and scaling issues with server process chatter. The chatter shouldn't be necessary with websockets-only.

With https://github.com/LearnBoost/engine.io the abstractions are greatly simplified, which is what I'm announcing today. The socket.io codebase has been shrunk dramatically, and it's as a result easier to scale/maintain.

[deleted]

Re: The Trello Tech Stack

#68

Post by josephg »

swah wrote: post #17

It seems Socket.io has not had any contenders yet..

There are a few, but none of them are widely known about. Socket.io's problems only become visible once you've been working with it for awhile.

The three alternatives I know about are SockJS: http://sockjs.org

Faye - which implements the Bayeux pubsub protocol: http://faye.jcoglan.com/

And node-browserchannel (mine) which implements google's browserchannel protocol: https://github.com/josephg/node-browserchannel (BrowserChannel works all the way down to IE5.5!)

Re: The Trello Tech Stack

#69

Post by josephg »

yesbabyyes wrote: post #23
swah wrote: post #17

It seems Socket.io has not had any contenders yet..

Socket.io is a great library. When it comes to a contender, I see Server-side Events [1] as a contender to WebSockets. I feel it's a simpler architecture which fits HTTP/REST better than WebSockets in the general case. I built a couple of small experiments/examples using CoffeeScript and Redis [2]; the middleware.coffee in particular is designed to be used together with REST, where if you send "Accept: text/event-str…

Unfortunately, eventsource isn't supported by any current version of IE. It'll be awhile before ES can replace your AJAX/websocket libraries.

http://caniuse.com/#search=eventsource

Re: The Trello Tech Stack

#70

Post by rjrodger »

radagaisus wrote: post #61
trotsky wrote: post #48

How vulnerable are all javascript approaches in terms of injection type attacks? Do apps like node and mongo effectively prevent them, or is it still possible to shoot yourself in the foot? I've read some off hand comments along the lines of "as long as you're not a total moron you have nothing to worry about", but that sounds a lot like what was said about sql injections and xss before exploiting them went mainstrea…

You CAN do injections to MongoDB code. An injection is basically 'allow user input to interfere with code' so for mongoDB assuming the query is a string you can do '{name: ' + user_input + '}'. and user_input, without sanitizing it (which is simpler, just converting it to a string) could be: {'$where': ...} http://www.mongodb.org/display/DOCS/Do+I+Have+to+Worry+About...

Unlike SQL, which you have to build as a string, the natural approach in JavaScript (even for junior devs) is to use an object literal to build the query. And then you get escaping for free.
Post reply on HN