4 ms·

From their newsletter which just went out, can't find a link online. "Please make sure it's reasonably secure. Meteor security isn't as hard as people think. A

by analog 14y ago

From their newsletter which just went out, can't find a link online. "Please make sure it's reasonably secure. Meteor security isn't as hard as people think. Admittedly it doesn't yet have the delicious "candy coating" that the database and DOM update stuff has, but we didn't, like, forget to put any in. Here's what Made With does: * Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. * Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1] That would mean hosting your own server though rather than using the simple meteor deploy. [1] http://everyauth.com/ http://everyauth.com/

heretohelp 14y ago
>* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. Scoping isn't enough. >* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." So, I can't make a production-grade app unless I use 0% of the magic.
- foolinator 14y ago
  You're absolutely right. But all frameworks have to go through these humps. Hell, I remember just 2 years ago having MongoDB in production it would regularly crash. We got rid of it in production, but I'd reconsider using it now.
  - StavrosK 14y ago
    Which features, are making you consider MongoDB? I'm asking because I wrote a (really short and small) MongoDB-ish abstraction layer over SQLite the other day (https://github.com/stochastic-technologies/goatfish https://github.com/stochastic-technologies/goatfish), and it seems to me that it's trivial to emulate the MongoDB queries and various other features over SQL without all the hassle of it eating your data or requiring 100 GB of RAM for a few indices.

by analog 14y ago

heretohelp 14y ago

>* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog. Scoping isn't enough. >* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write." So, I can't make a production-grade app unless I use 0% of the magic.

foolinator 14y ago
You're absolutely right. But all frameworks have to go through these humps. Hell, I remember just 2 years ago having MongoDB in production it would regularly crash. We got rid of it in production, but I'd reconsider using it now.
- StavrosK 14y ago
  Which features, are making you consider MongoDB? I'm asking because I wrote a (really short and small) MongoDB-ish abstraction layer over SQLite the other day (https://github.com/stochastic-technologies/goatfish https://github.com/stochastic-technologies/goatfish), and it seems to me that it's trivial to emulate the MongoDB queries and various other features over SQL without all the hassle of it eating your data or requiring 100 GB of RAM for a few indices.