7 ms·

Meteor is now MIT licensed

389 points by nim 14y ago

blhack 14y ago
I think we all sortof knew this was what it was going to be.
- bmelton 14y ago
  Honestly, I'm surprised. You've got a team of cracker jack developers who introduce a product that, frankly, isn't ready for prime time by any sane person's definition with the goal of targeting the majority of developers (e.g., not the most experienced, and not the ones operating at the top end of scale), with no real mention of license? I expected it to be a commercially licensed language, and honestly, was perfectly happy with that. This is of course better, but leaves me wondering just a little more what the business model is. Not that it's going to stop me toying with it -- I think Meteor is the best JS framework I've seen for ease of use.
  - deleted 14y ago
    [deleted]
  - andrelewis 14y ago
    I would suspect the business model will be support and feature development. In a widely used framework, there will always be people who need it customized, or need to integrate it in new and interesting ways, or require some sort of commercial support contract in order to use it. If they make these options available early on, they will make money.
  - cmelbye 14y ago
    I was surprised as well. I got a little scared when I read their email announcement earlier this week where they talked about this license announcement. I fully expected it to be some sort of commercial license due to the lack of information given previously and the polish that even their prototype unfinished product had. As for the business model, I could possibly see them doing hosting. Although there's no shortage of node.js hosts, they could fine tune their service to work well with the Meteor framework and integrate it in a way that a generic node.js host wouldn't be.
chrisrogers 14y ago
This is great to hear. This issue was one of my great qualms with the platform, and the biggest argument for creating a copycat platform. Now to address the auth/permissions!
- debergalis 14y ago
  Thanks! auth is next. But check out the madewith.meteor.com source for a good example of how you can lock down an app today.
  - andrelewis 14y ago
    Just a random thought but perhaps you should put up a honeypot version on it's own server to see where the weak spots in security are. Then invite the community to find the holes, or actually ask the hacking communities to help identify gaps in security? Honeypot in this instance meaning a machine dedicated to pulling in attacks (Like flies to honey) to help you identify weak areas of your framework.
architgupta 14y ago
I think this is a great move. Longer term it'll be better for Meteor, the team and the community. Ruby on Rails would be fine as an analogy here. The monetization model might be different from directly licensing and selling the framework, but these guys are smart, they'll figure it out. I am quite impressed by this. The team listened to the feedback from the community. They weren't obligated to do so :-)
- debergalis 14y ago
  We got some amazingly specific and valuable feedback -- check some of the Meteor HN threads. MIT is going to be a big part of making Meteor available everywhere.
  - architgupta 14y ago
    Doing that now. That gets me thinking. I'll deploy a weekend app with meteor.
Lazare 14y ago
When Meteor first launched, I was one of the very very many people who said that Meteor looked amazing, but was afraid that their license would hamper adoption. With the change in license, I think the only major hurdle has been removed. The fundamental idea is good, their current execution is extremely slick, and their immediate plans[1] look achievable. I have very high hopes for the project. If you haven't checked out Meteor yet, at least watch the screencast: http://meteor.com/screencast http://meteor.com/screencast [1]: I originally said roadmap; as mcrider rightly points out Meteor does not have one. There is some info floating around about current development goals (notably related to adding authentication), which is what I was thinking of.
- mcrider 14y ago
  What roadmap? The FAQ says there isn't one. Edit: I figured that's what you meant, I was just curious if you had seen an official roadmap. I guess they are too fresh to have one and are waiting for more community input before formalizing their goals -- Which is fine by me.
- muyuu 14y ago
  GPL was perfectly fine for a product like Meteor. Unless you plan to modify Meteor, ship your version and not share your changes, there are very few things you can do to violate the GPL by using Meteor. Meteor is neither a library nor boilerplate code to add upon. Lots of folks seem to be "hating" on GPL for no good reason, except maybe not knowing it (which is a good reason but it's hardly justifiable at this point).
  - ig1 14y ago
    No. If you use a GPL library all of your code has to be released under a GPL compatible licence. The Meteor framework counts as a library due to the way it interacts with your code. You might be confusing it with the Lesser GPL which allows library code to be incorporated into propriety software (or websites in this case). To understand the difference between the two you should read: http://www.gnu.org/licenses/why-not-lgpl.html http://www.gnu.org/licenses/why-not-lgpl.html
mwill 14y ago
Maybe I'm just not the audience for Meteor, because while it looks like a great project but as a nodejs guy, the fact that it hides itself away from the platform and turned away from the fantastic npm makes me sort of weary about it as a whole. But I imagine people coming from rails or whatever don't find this a problem at all.
- andrelewis 14y ago
  Agreed, why keep reinventing the wheel?
- tbergeron 14y ago
  I thought exactly the same, I really like the reactive programming principles they've brought. But without npm it's useless.
  - bricestacey 14y ago
    Agreed. For this very reason, after watching the Meteor screencast, I immediately looked into alternatives such as derby.
- simplify 14y ago
  SocketStream is a nice framework (also in early stages) that embraces npm and other node conventions. It doesn't support reactive programming out of the box, but I wouldn't be surprised if someone decides to build a module for it.
  - owenb 14y ago
    Hi simplify. I'll be releasing an new version of SocketStream this Sunday which allows developers to do just that. The new Request Responder API will allow developers to experiment with many different approaches to models, model synching (e.g. with Backbone.js and Ember.js) and reactive templating. Rather than put opinionated choices about models and clients-side frameworks into the core, we'll ensure the best third-party modules are fully documented and supported before featuring them on our website.
zobzu 14y ago
Cool I can now use this in my closed source project without ever giving any change back! Hate this GPL that requires you to give back anything if you let others get your product.
- techiferous 14y ago
  GPL requires you to give back; MIT gives you the choice. Developers are by nature creative people. And humans are not incapable of altruism. Even with an MIT license, I expect a lot of community contributions to pour in. In fact, I expect more community contributions to come in. MIT means (perhaps) a lower percentage of users will give back, but there will be a higher absolute number of users since the license is more permissive.
- getsat 14y ago
  http://www.itworld.com/it-managementstrategy/233753/gpl-copyleft-use-declining-faster-ever http://www.itworld.com/it-managementstrategy/233753/gpl-copy... Permissive licenses are just fine (arguably, better).
- Sanddancer 14y ago
  Until you want to use some CDDL-licensed code. Or some APSL code, or one of the many other mutually incompatible viral licenses out there. Especially in something like a web framework, where most of the clauses of the GPL wouldn't apply anyway. License dickwaving makes the community a worse place. Stop doing it, sit down, and code something.
- callumjones 14y ago
  Maybe you should check out other MIT licensed frameworks and assess whether they have fostered a closed or open community. Rails is MIT licensed and as a result we have seen a lot of companies build their web applications on Rails and build very successful businesses, but we have also seen a range of opens source plugins/gems and applications themselves built around Rails which have resulted in a better web community. This is 2012, developers who care about something like Meteor also care enough about open source to give back. We don't want developers to be forced to make their products open source, they should feel compelled by the enjoy of helping others.
wavephorm 14y ago
I think they should've tried to commercialize it. There is a real lack of good, new development systems these days. If you completely open source a new system, developers will just rip it off, contribute nothing, and it will go nowhere. So where's the incentive to continue making it better? Developers need to wake up, and realize that new, and substantially better systems can be built if they are willing to pay for them. Unfortunately the FOSS community has burned into developers' consciousness to never pay for anything, ever, which produces and environment of extreme lack of innovation. Our development tools completely fucking suck precisely because developers are no longer willing to buy quality development tools.
- tikhonj 14y ago
  I think that's demonstrably false given how good development tools actually are, particularly open source ones. If anything, too much work goes into open source development tools--certainly much more than in any other category! Just look at how much is accomplished--and how is easily--by various start-ups using open source technology. There are great web servers, web frameworks, libraries, programming languages, text editors and all sorts of other stuff (that I don't use much so can't comment on). Also, plenty of people contribute to (popular) open source libraries and frameworks. Even less popular projects get a good amount of contribution--I'm following a couple of emacs modes (a fork of JS-2 and Haskell-mode) as well as some tools (like DoctorJS) on GitHub and all of these get pull requests surprisingly often. I suspect the ratio of contributors to users is pretty high. In short, open source as a model works if your only goal is quality software. Making a framework open source is a good course of action and we should encourage it.
  - wavephorm 14y ago
    I think that's demonstrably false given how good development tools actually are No. Development tools seriously suck. Show me an IDE that can debug multi-client websocket code. Good luck. Every open source IDE's like Eclipse are useless these days because they can no longer keep up with the new problems being introduced. Light Table is maybe the first genuinely new, commercial, development environment to be introduced. People are gushing over the possibilities. All of a sudden people might, for the first time in 15 years, be willing to pay real money to make their lives easier. The open source model is a socialist model that has failed to keep up with the pace of technological change, and encourages developers to not purchase development tools which slows innovation in development technologies. FOSS ultimately holds back innovation.
clavalle 14y ago
Fantastic! I think the sky is the limit with this framework. If these guys can stick to the spirit of the project, add what can truly help push the system forward while ignoring the multitudes of one offs that will try to chip away the utility, this really has a shot of not only being a game changer but helping define the game for years to come. Great work!
zmmmmm 14y ago
Awesome - I was one of those highly critical of the original license, so let me be among the first in congratulating them on making this (quite major) change so quickly.
- koko775 14y ago
  I was also critical, and agreed, this is a fantastic change!
jamesmanning 14y ago
What's up with all the trolls on this thread?
richcollins 14y ago
While reactivity is an interesting idea and possible incremental improvement, the huge win is in saving us from building UI. Why aren't there more frameworks like Cappuccino but with built in bindings to the DB?
pixie_ 14y ago
is there an open source license that says says free to use for people etc.. but if you have a company larger than x then you must support the project with $$$ ?
- mmahemoff 14y ago
  Anything's possible, but caution advised to anyone who tries this. It's not always apparent to open-source developers how much pain custom or obscure licenses cause in big organisations (ie the kind of paying customers in your proposal). Even if it's just a normal license with a single clause variation, it becomes a different license from a tracking perspective. A lot of companies have standard policies on open-source and anything not following one of several popular licenses might be forbidden or require a drawn-out review process at best. This gets even more complicated when you consider packages might not be directly used, but be part of a dependency chain where you have to map out the whole graph in order to demonstrate compliance.
- tikhonj 14y ago
  I don't know of any projects that do exactly this, but there are projects that are dual-licensed. You can either use the code under the GPL or buy a commercial license and use it in your proprietary code. ExtJS is a great example of this sort of dual-licensing, and I've seen it on other projects as well.
SeanLuke 14y ago
Let's hope there's nothing patentable in that project.
heretohelp 14y ago
More importantly, how do I keep clients from fucking up my database? How is security being done? Seriously, if I'm not capable of baking limitations into data persistence/logic at the server level then this entire framework is worthless except for building up a portfolio of cute demos that can't be used for any real work.
- dmix 14y ago
  As this question comes up every single time Meteor or Firebase is brought up, I think its fair to say that "we're working on it" wasn't and isn't a good enough answer.
  - hbbio 14y ago
    You should also have a quick look there: http://news.ycombinator.com/item?id=3858838 http://news.ycombinator.com/item?id=3858838
- analog 14y ago
  From their newsletter which just went out, can't find a link online. "Please make sure it's reasonably secure. Meteor security isn't as hard as people think. Admittedly it doesn't yet have the delicious "candy coating" that the database and DOM update stuff has, but we didn't, like, forget to put any in. Here's what Made With does: * Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. * Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1] That would mean hosting your own server though rather than using the simple meteor deploy. [1] http://everyauth.com/ http://everyauth.com/
  - heretohelp 14y ago
    >* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. Scoping isn't enough. >* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." So, I can't make a production-grade app unless I use 0% of the magic.
guelo 14y ago
I feel it is sad that so few HN hackers seem to appreciate the vision of the GPL. GPL needs more indispensable software like this for it to thrive and protect us all from a future of completely locked down computers.
- coderdude 14y ago
  I'm open to a compelling argument for why the GPL is better than a license that basically says "you can do whatever you want with this." (From the perspective of deterring the locking down of computers by corporations.)
  - guelo 14y ago
    If it isn't obvious, GPL is an attack against proprietary computers and against the corporations that have been trying repeatedly over decades to bottle-up and monopolize the computer revolution.
    - buu700 14y ago
      Is it surprising that the GPL represents the antithesis of the startup community? No matter how idealistic any large group of young hackers will want to be, fiduciary duty will always trump everything when you play with business. You can love the GPL as much as Stallman himself, but when you're grasping for any edge you can find over your competition, you'll think twice before shipping her a tarball of your source.
      - StavrosK 14y ago
        That's entirely off topic. We're discussing GPL versus a more free license. If anything, this is an argument for the GPL.
        buu700 14y ago
        Off topic? The topic, if I've read correctly, is: I feel it is sad that so few HN hackers seem to appreciate the vision of the GPL Reusing GPL'd code forces developers to in turn release their code; more free licenses don't have this effect.
sharjeel 14y ago
[Checked] Fix License [TODO] DB Security/Authorization
- geoffschmidt 14y ago
  Yep, that's what's on the whiteboard :)
meta8609 14y ago
Why is this framework better than things like ember.js, especially if ember has something like this https://github.com/tchak/colors-demo https://github.com/tchak/colors-demo
- htilford 14y ago
  I don't think 'better' is the right question. Their's room for multiple frameworks. To answer the question I think Meteor's strong suit is live coding for rapid prototyping.
olov 14y ago
That is very generous. I hope that this is a win-win situation for the ecosystem and their business.
- Estragon 14y ago
  I'm curious about what the new business model is going to be.
js4all 14y ago
This is awesome news. There are currently 3 competing frameworks: Meteor, Firebase and Derby, all discussed on HN last week. I guess the new license gives Meteor a big plus. I am glad they changed their minds.
ashleyw 14y ago
Oh, wow! I'd been working on what appears to be a Meteor-like framework with the very premise of "All the same APIs are available on the client and the server — including database APIs!" for the past few days. It came from my frustration of having to duplicate JS code on both the server and client which just seems stupid when you can provide the same API but with different end-points for each side (i.e. client -> API, server -> DB.)
haraball 14y ago
It would be interesting to see some statistics before and after this announcement, even if it's still a young framework.
NanoWar 14y ago
(whoa the background needs a <fixed> attribute...)
soapdog 14y ago
Isn't it a security risk to allow arbitrary mongodb (or minimongodb) commands in the client side? In their demo, they show a client deleting data from a js console. If that is possible, what prevents an evil user from doing the same to my deployed meteor app?

389 points by nim 14y ago

blhack 14y ago

I think we all sortof knew this was what it was going to be.

bmelton 14y ago
Honestly, I'm surprised. You've got a team of cracker jack developers who introduce a product that, frankly, isn't ready for prime time by any sane person's definition with the goal of targeting the majority of developers (e.g., not the most experienced, and not the ones operating at the top end of scale), with no real mention of license? I expected it to be a commercially licensed language, and honestly, was perfectly happy with that. This is of course better, but leaves me wondering just a little more what the business model is. Not that it's going to stop me toying with it -- I think Meteor is the best JS framework I've seen for ease of use.
- deleted 14y ago
  [deleted]
- andrelewis 14y ago
  I would suspect the business model will be support and feature development. In a widely used framework, there will always be people who need it customized, or need to integrate it in new and interesting ways, or require some sort of commercial support contract in order to use it. If they make these options available early on, they will make money.
- cmelbye 14y ago
  I was surprised as well. I got a little scared when I read their email announcement earlier this week where they talked about this license announcement. I fully expected it to be some sort of commercial license due to the lack of information given previously and the polish that even their prototype unfinished product had. As for the business model, I could possibly see them doing hosting. Although there's no shortage of node.js hosts, they could fine tune their service to work well with the Meteor framework and integrate it in a way that a generic node.js host wouldn't be.

chrisrogers 14y ago

This is great to hear. This issue was one of my great qualms with the platform, and the biggest argument for creating a copycat platform. Now to address the auth/permissions!

debergalis 14y ago
Thanks! auth is next. But check out the madewith.meteor.com source for a good example of how you can lock down an app today.
- andrelewis 14y ago
  Just a random thought but perhaps you should put up a honeypot version on it's own server to see where the weak spots in security are. Then invite the community to find the holes, or actually ask the hacking communities to help identify gaps in security? Honeypot in this instance meaning a machine dedicated to pulling in attacks (Like flies to honey) to help you identify weak areas of your framework.

architgupta 14y ago

I think this is a great move. Longer term it'll be better for Meteor, the team and the community. Ruby on Rails would be fine as an analogy here. The monetization model might be different from directly licensing and selling the framework, but these guys are smart, they'll figure it out. I am quite impressed by this. The team listened to the feedback from the community. They weren't obligated to do so :-)

debergalis 14y ago
We got some amazingly specific and valuable feedback -- check some of the Meteor HN threads. MIT is going to be a big part of making Meteor available everywhere.
- architgupta 14y ago
  Doing that now. That gets me thinking. I'll deploy a weekend app with meteor.

Lazare 14y ago

When Meteor first launched, I was one of the very very many people who said that Meteor looked amazing, but was afraid that their license would hamper adoption. With the change in license, I think the only major hurdle has been removed. The fundamental idea is good, their current execution is extremely slick, and their immediate plans[1] look achievable. I have very high hopes for the project. If you haven't checked out Meteor yet, at least watch the screencast: http://meteor.com/screencast http://meteor.com/screencast [1]: I originally said roadmap; as mcrider rightly points out Meteor does not have one. There is some info floating around about current development goals (notably related to adding authentication), which is what I was thinking of.

mcrider 14y ago
What roadmap? The FAQ says there isn't one. Edit: I figured that's what you meant, I was just curious if you had seen an official roadmap. I guess they are too fresh to have one and are waiting for more community input before formalizing their goals -- Which is fine by me.
muyuu 14y ago
GPL was perfectly fine for a product like Meteor. Unless you plan to modify Meteor, ship your version and not share your changes, there are very few things you can do to violate the GPL by using Meteor. Meteor is neither a library nor boilerplate code to add upon. Lots of folks seem to be "hating" on GPL for no good reason, except maybe not knowing it (which is a good reason but it's hardly justifiable at this point).
- ig1 14y ago
  No. If you use a GPL library all of your code has to be released under a GPL compatible licence. The Meteor framework counts as a library due to the way it interacts with your code. You might be confusing it with the Lesser GPL which allows library code to be incorporated into propriety software (or websites in this case). To understand the difference between the two you should read: http://www.gnu.org/licenses/why-not-lgpl.html http://www.gnu.org/licenses/why-not-lgpl.html

mwill 14y ago

Maybe I'm just not the audience for Meteor, because while it looks like a great project but as a nodejs guy, the fact that it hides itself away from the platform and turned away from the fantastic npm makes me sort of weary about it as a whole. But I imagine people coming from rails or whatever don't find this a problem at all.

andrelewis 14y ago
Agreed, why keep reinventing the wheel?
tbergeron 14y ago
I thought exactly the same, I really like the reactive programming principles they've brought. But without npm it's useless.
- bricestacey 14y ago
  Agreed. For this very reason, after watching the Meteor screencast, I immediately looked into alternatives such as derby.
simplify 14y ago
SocketStream is a nice framework (also in early stages) that embraces npm and other node conventions. It doesn't support reactive programming out of the box, but I wouldn't be surprised if someone decides to build a module for it.
- owenb 14y ago
  Hi simplify. I'll be releasing an new version of SocketStream this Sunday which allows developers to do just that. The new Request Responder API will allow developers to experiment with many different approaches to models, model synching (e.g. with Backbone.js and Ember.js) and reactive templating. Rather than put opinionated choices about models and clients-side frameworks into the core, we'll ensure the best third-party modules are fully documented and supported before featuring them on our website.

zobzu 14y ago

Cool I can now use this in my closed source project without ever giving any change back! Hate this GPL that requires you to give back anything if you let others get your product.

techiferous 14y ago
GPL requires you to give back; MIT gives you the choice. Developers are by nature creative people. And humans are not incapable of altruism. Even with an MIT license, I expect a lot of community contributions to pour in. In fact, I expect more community contributions to come in. MIT means (perhaps) a lower percentage of users will give back, but there will be a higher absolute number of users since the license is more permissive.
getsat 14y ago
http://www.itworld.com/it-managementstrategy/233753/gpl-copyleft-use-declining-faster-ever http://www.itworld.com/it-managementstrategy/233753/gpl-copy... Permissive licenses are just fine (arguably, better).
Sanddancer 14y ago
Until you want to use some CDDL-licensed code. Or some APSL code, or one of the many other mutually incompatible viral licenses out there. Especially in something like a web framework, where most of the clauses of the GPL wouldn't apply anyway. License dickwaving makes the community a worse place. Stop doing it, sit down, and code something.
callumjones 14y ago
Maybe you should check out other MIT licensed frameworks and assess whether they have fostered a closed or open community. Rails is MIT licensed and as a result we have seen a lot of companies build their web applications on Rails and build very successful businesses, but we have also seen a range of opens source plugins/gems and applications themselves built around Rails which have resulted in a better web community. This is 2012, developers who care about something like Meteor also care enough about open source to give back. We don't want developers to be forced to make their products open source, they should feel compelled by the enjoy of helping others.

wavephorm 14y ago

I think they should've tried to commercialize it. There is a real lack of good, new development systems these days. If you completely open source a new system, developers will just rip it off, contribute nothing, and it will go nowhere. So where's the incentive to continue making it better? Developers need to wake up, and realize that new, and substantially better systems can be built if they are willing to pay for them. Unfortunately the FOSS community has burned into developers' consciousness to never pay for anything, ever, which produces and environment of extreme lack of innovation. Our development tools completely fucking suck precisely because developers are no longer willing to buy quality development tools.

tikhonj 14y ago
I think that's demonstrably false given how good development tools actually are, particularly open source ones. If anything, too much work goes into open source development tools--certainly much more than in any other category! Just look at how much is accomplished--and how is easily--by various start-ups using open source technology. There are great web servers, web frameworks, libraries, programming languages, text editors and all sorts of other stuff (that I don't use much so can't comment on). Also, plenty of people contribute to (popular) open source libraries and frameworks. Even less popular projects get a good amount of contribution--I'm following a couple of emacs modes (a fork of JS-2 and Haskell-mode) as well as some tools (like DoctorJS) on GitHub and all of these get pull requests surprisingly often. I suspect the ratio of contributors to users is pretty high. In short, open source as a model works if your only goal is quality software. Making a framework open source is a good course of action and we should encourage it.
- wavephorm 14y ago
  I think that's demonstrably false given how good development tools actually are No. Development tools seriously suck. Show me an IDE that can debug multi-client websocket code. Good luck. Every open source IDE's like Eclipse are useless these days because they can no longer keep up with the new problems being introduced. Light Table is maybe the first genuinely new, commercial, development environment to be introduced. People are gushing over the possibilities. All of a sudden people might, for the first time in 15 years, be willing to pay real money to make their lives easier. The open source model is a socialist model that has failed to keep up with the pace of technological change, and encourages developers to not purchase development tools which slows innovation in development technologies. FOSS ultimately holds back innovation.

clavalle 14y ago

Fantastic! I think the sky is the limit with this framework. If these guys can stick to the spirit of the project, add what can truly help push the system forward while ignoring the multitudes of one offs that will try to chip away the utility, this really has a shot of not only being a game changer but helping define the game for years to come. Great work!

zmmmmm 14y ago

Awesome - I was one of those highly critical of the original license, so let me be among the first in congratulating them on making this (quite major) change so quickly.

koko775 14y ago
I was also critical, and agreed, this is a fantastic change!

jamesmanning 14y ago

What's up with all the trolls on this thread?

richcollins 14y ago

While reactivity is an interesting idea and possible incremental improvement, the huge win is in saving us from building UI. Why aren't there more frameworks like Cappuccino but with built in bindings to the DB?

pixie_ 14y ago

is there an open source license that says says free to use for people etc.. but if you have a company larger than x then you must support the project with $$$ ?

mmahemoff 14y ago
Anything's possible, but caution advised to anyone who tries this. It's not always apparent to open-source developers how much pain custom or obscure licenses cause in big organisations (ie the kind of paying customers in your proposal). Even if it's just a normal license with a single clause variation, it becomes a different license from a tracking perspective. A lot of companies have standard policies on open-source and anything not following one of several popular licenses might be forbidden or require a drawn-out review process at best. This gets even more complicated when you consider packages might not be directly used, but be part of a dependency chain where you have to map out the whole graph in order to demonstrate compliance.
tikhonj 14y ago
I don't know of any projects that do exactly this, but there are projects that are dual-licensed. You can either use the code under the GPL or buy a commercial license and use it in your proprietary code. ExtJS is a great example of this sort of dual-licensing, and I've seen it on other projects as well.

SeanLuke 14y ago

Let's hope there's nothing patentable in that project.

heretohelp 14y ago

More importantly, how do I keep clients from fucking up my database? How is security being done? Seriously, if I'm not capable of baking limitations into data persistence/logic at the server level then this entire framework is worthless except for building up a portfolio of cute demos that can't be used for any real work.

dmix 14y ago
As this question comes up every single time Meteor or Firebase is brought up, I think its fair to say that "we're working on it" wasn't and isn't a good enough answer.
- hbbio 14y ago
  You should also have a quick look there: http://news.ycombinator.com/item?id=3858838 http://news.ycombinator.com/item?id=3858838
analog 14y ago
From their newsletter which just went out, can't find a link online. "Please make sure it's reasonably secure. Meteor security isn't as hard as people think. Admittedly it doesn't yet have the delicious "candy coating" that the database and DOM update stuff has, but we didn't, like, forget to put any in. Here's what Made With does: * Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. * Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1] That would mean hosting your own server though rather than using the simple meteor deploy. [1] http://everyauth.com/ http://everyauth.com/
- heretohelp 14y ago
  >* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. Scoping isn't enough. >* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." So, I can't make a production-grade app unless I use 0% of the magic.

guelo 14y ago

I feel it is sad that so few HN hackers seem to appreciate the vision of the GPL. GPL needs more indispensable software like this for it to thrive and protect us all from a future of completely locked down computers.

coderdude 14y ago
I'm open to a compelling argument for why the GPL is better than a license that basically says "you can do whatever you want with this." (From the perspective of deterring the locking down of computers by corporations.)
- guelo 14y ago
  If it isn't obvious, GPL is an attack against proprietary computers and against the corporations that have been trying repeatedly over decades to bottle-up and monopolize the computer revolution.
  - buu700 14y ago
    Is it surprising that the GPL represents the antithesis of the startup community? No matter how idealistic any large group of young hackers will want to be, fiduciary duty will always trump everything when you play with business. You can love the GPL as much as Stallman himself, but when you're grasping for any edge you can find over your competition, you'll think twice before shipping her a tarball of your source.
    - StavrosK 14y ago
      That's entirely off topic. We're discussing GPL versus a more free license. If anything, this is an argument for the GPL.
      - buu700 14y ago
        Off topic? The topic, if I've read correctly, is: I feel it is sad that so few HN hackers seem to appreciate the vision of the GPL Reusing GPL'd code forces developers to in turn release their code; more free licenses don't have this effect.

sharjeel 14y ago

[Checked] Fix License [TODO] DB Security/Authorization

geoffschmidt 14y ago
Yep, that's what's on the whiteboard :)

meta8609 14y ago

Why is this framework better than things like ember.js, especially if ember has something like this https://github.com/tchak/colors-demo https://github.com/tchak/colors-demo

htilford 14y ago
I don't think 'better' is the right question. Their's room for multiple frameworks. To answer the question I think Meteor's strong suit is live coding for rapid prototyping.

olov 14y ago

That is very generous. I hope that this is a win-win situation for the ecosystem and their business.

Estragon 14y ago
I'm curious about what the new business model is going to be.

js4all 14y ago

This is awesome news. There are currently 3 competing frameworks: Meteor, Firebase and Derby, all discussed on HN last week. I guess the new license gives Meteor a big plus. I am glad they changed their minds.

ashleyw 14y ago

Oh, wow! I'd been working on what appears to be a Meteor-like framework with the very premise of "All the same APIs are available on the client and the server — including database APIs!" for the past few days. It came from my frustration of having to duplicate JS code on both the server and client which just seems stupid when you can provide the same API but with different end-points for each side (i.e. client -> API, server -> DB.)

haraball 14y ago

It would be interesting to see some statistics before and after this announcement, even if it's still a young framework.

NanoWar 14y ago

(whoa the background needs a <fixed> attribute...)

soapdog 14y ago

Isn't it a security risk to allow arbitrary mongodb (or minimongodb) commands in the client side? In their demo, they show a client deleting data from a js console. If that is possible, what prevents an evil user from doing the same to my deployed meteor app?