5 ms·

PouchDB and CouchDB are great for prototyping of apps, but access restriction in CouchDB is broken by design: it is hard to make it correct, CouchDB is open by

by lisivka 11y ago

PouchDB and CouchDB are great for prototyping of apps, but access restriction in CouchDB is broken by design: it is hard to make it correct, CouchDB is open by default, user can store anything in DB it has access to, including pr0n. If CouchDB will close DB by default AND it will be easy to specify politics by REST path AND it will be easy to restrict document schema by REST path, then I will use it in production.

gecko 11y ago
Lots of databases are open by default, especially in this space (Mongo, RethinkDB, Redis, Riak, and I believe Cassandra), and Fauxton has huge warnings that you've got access turned on globally if you haven't adjusted the setting, so I'm not sure I agree with you that that's an instant fail, but I get your point. That said, in CouchDB 2, it'll be easy to programmatically restrict document information in a similar method to Firebase. I can't find the CouchDB 2 documentation itself, but https://github.com/rcouch/rcouch/wiki/Validate-documents-on-read https://github.com/rcouch/rcouch/wiki/Validate-documents-on-... , from rcouch, is the current plan. Do note that CouchDB doesn't do Firebase-like OAuth workflows, so you'd still need a thin shim in prod to handle that if you don't want to have all bespoke user accounts, all the time. (There's probably a clever way to make this work using client-side OAuth workflows, but I've never actually thought about it much.)
- lisivka 11y ago
  > Major security alert as 40,000 MongoDB databases left unsecured on the internet http://www.information-age.com/technology/security/123459001/major-security-alert-40000-mongodb-databases-left-unsecured-internet http://www.information-age.com/technology/security/123459001... Yes, it is great for prototyping, but it is bad for production.
  - alyssoncm 11y ago
    Parse it is a good solution for a quick app backend setup but I never realized build big things over there. To me the most important to me is no vendor lock-in I see as very important to have full control over what I'm developing. I started to use a great platform http://www.back4apps.com http://www.back4apps.com and Im happy with the results. I recommend it as a migration option
jchrisa 11y ago
The access control limitations in Apache CouchDB are a big part of what we addressed in Couchbase Sync Gateway. Info about our Sync Function API http://developer.couchbase.com/documentation/mobile/1.1.0/get-started/get-started-mobile/cloud-sync-function/sync-function-example/index.html http://developer.couchbase.com/documentation/mobile/1.1.0/ge...
- gecko 11y ago
  Oh, that's awesome! I'd never actually looked carefully at the sync layer, but that seems like a really direct equivalent.
- enos_feedler 11y ago
  Are there any whitepapers or case studies of large-scale production applications using and maintaining a sync function? After using sync gateway with access control for a while, it became more clear to me that writing my own access control API (via node.js or something like that) on top of MongoDB would give better readability and maintainability over a sync function. (edit) specify mongodb
  - wayneacarter 11y ago
    [Architect from Couchbase] The formatting and modularization of your sync function code will strongly influence both it's readability and maintainability. I've published and example of one that is well formatted and modularized. The example includes Navigation Flow, Wireframes, Data Modeling, and a Sync Function (which is the security layer). https://github.com/waynecarter/couchbase-mobile-examples/wiki/Modeling-&-Security https://github.com/waynecarter/couchbase-mobile-examples/wik... Let me know if you have any other questions around this and I will add it to the example.

by lisivka 11y ago

gecko 11y ago

Lots of databases are open by default, especially in this space (Mongo, RethinkDB, Redis, Riak, and I believe Cassandra), and Fauxton has huge warnings that you've got access turned on globally if you haven't adjusted the setting, so I'm not sure I agree with you that that's an instant fail, but I get your point. That said, in CouchDB 2, it'll be easy to programmatically restrict document information in a similar method to Firebase. I can't find the CouchDB 2 documentation itself, but https://github.com/rcouch/rcouch/wiki/Validate-documents-on-read https://github.com/rcouch/rcouch/wiki/Validate-documents-on-... , from rcouch, is the current plan. Do note that CouchDB doesn't do Firebase-like OAuth workflows, so you'd still need a thin shim in prod to handle that if you don't want to have all bespoke user accounts, all the time. (There's probably a clever way to make this work using client-side OAuth workflows, but I've never actually thought about it much.)

lisivka 11y ago
> Major security alert as 40,000 MongoDB databases left unsecured on the internet http://www.information-age.com/technology/security/123459001/major-security-alert-40000-mongodb-databases-left-unsecured-internet http://www.information-age.com/technology/security/123459001... Yes, it is great for prototyping, but it is bad for production.
- alyssoncm 11y ago
  Parse it is a good solution for a quick app backend setup but I never realized build big things over there. To me the most important to me is no vendor lock-in I see as very important to have full control over what I'm developing. I started to use a great platform http://www.back4apps.com http://www.back4apps.com and Im happy with the results. I recommend it as a migration option

jchrisa 11y ago

The access control limitations in Apache CouchDB are a big part of what we addressed in Couchbase Sync Gateway. Info about our Sync Function API http://developer.couchbase.com/documentation/mobile/1.1.0/get-started/get-started-mobile/cloud-sync-function/sync-function-example/index.html http://developer.couchbase.com/documentation/mobile/1.1.0/ge...

gecko 11y ago
Oh, that's awesome! I'd never actually looked carefully at the sync layer, but that seems like a really direct equivalent.
enos_feedler 11y ago
Are there any whitepapers or case studies of large-scale production applications using and maintaining a sync function? After using sync gateway with access control for a while, it became more clear to me that writing my own access control API (via node.js or something like that) on top of MongoDB would give better readability and maintainability over a sync function. (edit) specify mongodb
- wayneacarter 11y ago
  [Architect from Couchbase] The formatting and modularization of your sync function code will strongly influence both it's readability and maintainability. I've published and example of one that is well formatted and modularized. The example includes Navigation Flow, Wireframes, Data Modeling, and a Sync Function (which is the security layer). https://github.com/waynecarter/couchbase-mobile-examples/wiki/Modeling-&-Security https://github.com/waynecarter/couchbase-mobile-examples/wik... Let me know if you have any other questions around this and I will add it to the example.