12 ms·

Parse launches JavaScript SDK: Parse for Websites

• taylorbuley 14y ago
  Can anyone explain to me how authentication works with JS-based storage client like this? It scares me to think a user might have the ability to store anything via the web on my dime. I feel like I'm missing something.
  • princeverma 14y ago
    I am wondering same thing, can somebody explain this please.
    • jnbiche 14y ago
      It's relatively easy to do basic HTTP authentication using Javascript. If you're on SSL, that's reasonably secure. Once you're authenticated the server can issue a nonce that identifies you and gives you authorization (role-based access) to various pages/objects/apps based on that nonce.
  • lacker 14y ago
    There are two main types of security. Object-level, and app-level. Each object gets access controls that are similar to ACLs in Unix systems. That provides for the sort of security that separates different users' data from each other. On an app-level, you can also control per-class which operations are usable. For more detail, see: https://parse.com/docs/data#security https://parse.com/docs/data#security You should be able use these in combination to secure your app. If you have more specific questions about how to secure a particular use case, drop us an email at feedback@parse.com and we can help figure something out.
    • peripitea 14y ago
      I still don't get how I, as a malicious (or curious) user with some form of write permission, would be prevented from doing the equivalent of opening up Firebug console and typing while(true){var p = new Post(); p.save();}
      • equark 14y ago
        What prevents you from doing this with ajax post on every existing website?
        • jgannonjr 14y ago
          This is true, but at least if you control your own backend you can do some sort of rate limiting on the server side
        • peripitea 14y ago
          Server-side logic. The difference is that traditional data flow is UserControlledCode (i.e. client-side JS) --> MyServer --> DataStore, whereas this is UserControlledCode --> DataStore. In practice you may often choose not to have the code in MyServer do anything beyond act as a pass-through, but not having that option at all seems scary. The only recourse I see is things like database schema constraints (e.g. max posts per user = 10), but that doesn't really solve the problem. Edit: And I should add that the problem isn't just a user creating new many objects. The problem is that without code controlled exclusively by me somewhere in the middle, business logic (i.e. anything not codified in your database schema) becomes unenforceable. E.g. pull up firebug and type player.levelUp(); player.save();. Now there may be some subset of applications where business logic like this is completely unnecessary, but I can't think of many.
          • fooandbarify 14y ago
            I can't see it working well in a game scenario, but the vast majority of CRUD apps out there could be safely implemented using Parse's security model (as described in lacker's link).
            • bonaldi 14y ago
              They use a game in their JS documentation! And as they wrote it it's totally vulnerable to the user incrementing their own score. It's not just games, either. As soon as a client-server solution gets beyond utterly trivial it becomes hard to see how you'd do it without server logic. Take another example described in lacker's link -- a messageboard post: the ACL defines whether or not a user can make a new post, but what controls the content of that post? What forces HTML tags to be dropped, or limits the number of images in a post, or the size of the post, or checks the domains of links, or prevents xss, or rate-limits a user? Some of this you can do by treating your entire database as "dirty" and sanitising things on the way out, too, but that doesn't come close to squaring the circle.
• hmans 14y ago
  Absurdly lame opening paragraph. Made me want to use Parse a little bit less.
• endlessvoid94 14y ago
  Man, this is awesome. You can now basically host a full web app completely through a CDN.
  • garindra 14y ago
    I'm thinking that this would only work for relatively simple apps though. There might be cases where the functionalities in your apps could only be supported by server-side infrastructure, like uploading files, resizing images, emailing, cron jobs, etc. What would be really nice is if Parse had a way to somehow plug in existing backend infrastructure to Parse's data model. Edit : I take it back. Parse has a REST API.
    • mumphster 14y ago
      You can use their REST API. It's really well made and I've done a few smallish projects using it. Annnd you just said that. Didn't see your edit heh.
• samsnelling 14y ago
  After looking through the documents I am thoroughly impressed. Parse can handle user management... Are there lots of services out there that does this?!?! I've never figured out an elegant solution to do it with firebase.
• tudorw 14y ago
  seriously, if it took you days to set up PHP and MYSQL you might have picked the wrong vocation...
  • jiggy2011 14y ago
    Yes, this may have been true 10 years ago when installing everything meant getting the source , setting compile flags for everything to work together and updates were applied manually. These days I can have Ubuntu , Apache , PHP5 , Mysql and Wordpress all working happily on a VPS in under an hour. On the other hand there are other considerations like maintenance , security and scaling that it might be nice not to have to worry about.
    • mortenjorck 14y ago
      Well, sure, LAMP is easy to set up if you're working in PHP; that's one of the huge advantages PHP has over most other options. You want to set up and deploy to a Rails server, though, that's going to be a bit more effort.
      • phillmv 14y ago
        >You want to set up and deploy to a Rails server, though, that's going to be a bit more effort. I do that regularly enough. For single server setups, I've got it down to about 60-90 minutes - and that's because I've been too lazy to automate it.
      • cantankerous 14y ago
        Days/Months of effort?
      • jiggy2011 14y ago
        Not too much more difficult , reverse proxying with apache is only a few lines in the conf file.
      • ulisesrmzroche 14y ago
        Like Phil said, it doesn't take more than an hour if you're feeling lazy about it. I've automated it with Chef, but I haven't timed it or anything. Less than 10 minutes for sure.
• _pius 14y ago
  Really awesome. I appreciate the fact that the tutorial starts off by addressing authentication. https://parse.com/tutorials/todo-app-with-javascript https://parse.com/tutorials/todo-app-with-javascript
• liamondrop 14y ago
  if I never see another fork-tongued ribbon with the stitching and the little stars, it will be too soon
• JoelMcCracken 14y ago
  Anyone know if it would be possible to implement generic javascript-based "apps" for any websites? I'm wondering if it would be possible to implement a disqus-style service.
  • lacker 14y ago
    Yes, you can implement a Disqus-style service with Parse. The SDK uses cross-origin resource sharing to make requests to Parse, so you can host your app anywhere, including on third-party sites.
    • JoelMcCracken 14y ago
      Really nice. That is an interesting use case.
• clintjhill 14y ago
  I'm of two minds about this. On one side I think it's a very smart service to use. It removes what otherwise might be a ton of work to duplicate. On the other side I think it's a very dumb thing to be bound to. They certainly free you from their service by allowing an export of your data. But what about all the code written to the API? If at some point in the future you decide you don't want or can't afford Parse - it's nearly a re-write. Unless you abstract their API in an intelligent way. Even then there is some work.
  • lclarkmichalek 14y ago
    This argument applies to all APIs however. And I can't see any reason why Parse wouldn't be "vulnerable" to another service/library with an identical API (in the non-web world, this has happened often).
    • reinhardt 14y ago
      All proprietary APIs. Also not all APIs are as critical and large encompassing as the whole backend code of your business.
      • jmathai 14y ago
        And not all APIs are startups with a decent likelihood of not being around in the future.
      • lclarkmichalek 14y ago
        Many are very critical, and many are not proprietary. Databases and web frameworks are two that come to mind immediately, yet people seem to choose those based on the number of blog posts about them. And almost all APIs are vulnerable to reimplementation. With Parse's API, it would theoretically be possible for another project to implement an identical interface to their backend, and allow you to simply change one LoC in your application to change the provider of your BaaS.
        • nupark2 14y ago
• salimmadjd 14y ago
  This is a great move for Parse! There is some long-term issues about using a service like this, such as: the cost, flexibility, performance, customization, etc. But for any front-end (or any person, I guess) who wants to build something and quickly validate their idea and get traction this will be very useful. My only suggestion is to architect your application knowing that you will migrate out of their infrastructure.
• pbreit 14y ago
  I'm still a little confused by what Parse does and when I would use it. It sounds neat for little, proof-of-concept demos but would I consider it for production of something significant? Does this SDK work without the Parse server?
  • tocomment 14y ago
    As am I. I'm hoping someone will chime in and get us low tech folks updated.
  • deleted 14y ago
    [deleted]
  • lacker 14y ago
    Parse lets you develop apps without writing any server code. For mobile apps and now also web apps, you can just write frontend code. We have a number of large apps in production using Parse - check out the testimonials at http://parse.com http://parse.com - so you could definitely consider it for significant use.
  • deleted 14y ago
    [deleted]
  • pbreit 14y ago
    OK, I looked at it in more depth than I usually do and I can see that there would be a decent number of use cases. But as another posted said, on one hand it looks like a great platform to build against, on the other it seems really dumb to do so (locked in, etc). Perhaps someone could reverse engineer the APIs and provide a Python/Rails + DB back-end.
• guelo 14y ago
  The pricing seems reasonable, free and then goes up to $200/month once you've gained decent traction. Though it's more than double the cost of a VPS that could support 1 million requests and a 1GB database, and that could make all the difference for an ad-supported app with razor thin margins. https://www.parse.com/plans https://www.parse.com/plans
  • alttab 14y ago
    It could also make all the difference in margins because it might prevent you from hiring backend developers at all. that said, I see multiple problems that need to be overcome. 1) security. what is preventing an end user from opening a js console and going crazy on the db? How can you ensure consistency when the user has access to the code? 2) Growth. if you choose parse as a platform, the lock in seems like it could cause significant pain down the road. seems great for toys and demos. I would not run a functioning business on it.
    • agotterer 14y ago
      Curious, what would they need to offer for you to consider it for a functioning business? An easier way to get the data out, an SLA, what?
      • alttab 14y ago
        The problem is a growing business won't initially understand where the real technical requirements are. At first, Parse seems like a strategic investment because you don't need IT maintenance on the server, application deployment could be as simple as FTPing static files to a shared host, and all technical aspects of maintaining a database, backups, restores, reboots, DNS and maintenance is attractive to the weekend hacker - or a small scrappy start-up. The problem is as traction sets in, feature usage and load comes as a total surprise. This is why iteration is fundamental to design. Overnight a Parse user will need to run backend jobs on the data. Then what? Because the application execution exists within the context of the browser, separate tooling would be necessary. Or what if we needed to access this data from backend infrastructure in real-time? My point is business demands are demands because the situation calls for it - not because it is planned. While for most client-centric CRUD type management apps this works great. Its Paas-Rails for scrappy users coming from PHP. Most web applications worth the web-space they are printed on does something special, or does something simple at great scale. Access to the data, an IT-based SLA or other guarantees only further positions the business as an IT service provider. My impression of the product was it was targeted for developers and small shops as an application platform with crazy-easy deployment and management. Ultimately the aim is cost reduction in infrastructure IT. I get it. But any long-lasting business with the momentum built into the plays of most internet companies will outgrow the current version of Parse faster than I believe the growth could be practically followed. That said - proving me wrong would be worth a lot of money. Anyway - that was the thought process behind that comment. I wasn't trying to be harsh, but if you ask me this oversight is too fatal to ignore.
• arturadib 14y ago
  Hats off. Parse is the first of all these backend-as-a-service startups to face and solve the biggest problem in the web context: user authentication and data security. By offering a full signup service with email verification and user-level control over the database they have eliminated perhaps the most redundant piece of work that just about every web app has had to implement. Lock-in is of course a concern, but that hasn't prevent some AWS services from taking off big time. Perhaps in the near future one will see an open source project that offers an off-the-shelf backend with a Parse-compatible API, much like what happened to S3 and etc. Pricing on the other hand is a concern, particularly if your service requires background workers that constantly update the database -- every update is an API request hit, and one can only wonder what they charge beyond their Pro account. Overall, I think this is a huge step in the right direction. Because it's the 21st century and one shouldn't have to reinvent the wheel every time one writes a new web app.
  • timjahn 14y ago
    "Lock-in is of course a concern, but that hasn't prevent some AWS services from taking off big time. Perhaps in the near future one will see an open source project that offers an off-the-shelf backend with a Parse-compatible API, much like what happened to S3 and etc." I hope so. I agree that user authentication is a redundant piece of any app that needs to be implemented each time. But I don't like the third party lockin. What if Parse goes out of business next week? Do I have to rewrite all my code that talks to them? I guess I could abstract it enough at the get go to prepare for this. I think an open source project that isn't tied to a third party would be great.
  • nanijoe 14y ago
    I really wish they charged by something other than API requests..as it stands now, I would not even know a reasonable way to pass on the cost to my users.
    • lopatin 14y ago
      Whats wrong with estimating the number of API requests the average user makes and figuring out a price based on that?
• doc4t 14y ago
  "There was a time when building a cutting edge web app meant wasting hours setting up a Linux server, days installing MySQL and Ruby or PHP, and months slaving away writing backend server code. Web development was nasty, brutish, and long. It sucked. But that was the past. Parse is the future. And it’s here today." Never ever present your product from talking nagative about something or someone else. The only thing this kind of presentation makes me think is "Gee - didn't they have anything good to say about their product?"
• dmvaldman 14y ago
  how does this compare/contrast with Firebase?
• deleted 14y ago
  [deleted]
• lux 14y ago
  Was just thinking this was the next logical move for Parse to really blow up. Nicely done too! I don't see examples of file handling through the JavaScript API though, did I just miss it?
  • lacker 14y ago
    Right now, we don't have binary data support (which includes file handling) in Javascript. It's a bit different than Objective-C and Java because Javascript doesn't have great native support for a binary data type. So we can't just expose the same API for binary data that we use for native SDKs. We're working on figuring out a really clean way to support binary data, though.
    • lux 14y ago
      Good to know it's in the works! Definitely a messy problem with current browser limitations.
• nbclark 14y ago
  My take on Parse is that they do the grunt work that is necessary with every new project. I am currently building an iPad game on top of parse, and while the pricing is a bit concerning, I figure one of two things will happen: 1) The game takes off and the $200/mo is affordable 2) The game doesn't take off and the 5mil requests is adequate. The lock-in concerns are valid, but right now their API isn't so mature that it would take eons to build out the pieces I am using in a week or two. As for the concern with them going out of business, they've raised a good bit of funding, and offer data dumps so you can migrate elsewhere if need be. For me, right now the ease of development outweighs the risk (we'll see in time though...)
  • tocomment 14y ago
    How does parse save you time building your ipad game? Sorry if that's a dumb question. I'm still trying to wrap my head around what it is.
    • natesm 14y ago
      It would probably work pretty well for a game based around creating and sharing levels.
    • nbclark 14y ago
      A few things: 1) It makes user management stupid-simple. I can authenticate with Facebook/Twitter/signup easily (not that it's really that hard, but still), and the user info is automatically saved to the cloud. 2) I then use it to store game state, retrieve a list of active games/previous games. 3) Push notifications are really easy. Each client opens a "channel", and the other client sends a push to their opponent's channel after their turn is complete. I suppose I should clarify that I am building a turn-based iPad game, where the game state needs to be stored between turns.
      • fictorial 14y ago
        (I was going to write you offline but you do not have an email associated with your HN account.) I too am developing a turn-based iOS game using Parse. I've found the entire process to be painless. It's a shame Game Center's turn-based API has so many issues [1] Perhaps if iOS 6 is announced at WWDC some of these Game Center issues will be included? For now it's easy enough on Parse to do the equivalent work "by hand". [1]: http://ishamrock.com/post/20122762136/words-play-reflections-on-game-cente http://ishamrock.com/post/20122762136/words-play-reflections... rs-turn-based
• falava 14y ago
  Comparing the JS guide with the iOS and Android guides I see two absences: 1) Files 2) Facebook and Twitter users May be that it's not possible to upload files or authenticate using OAuth using only the JS SDK, and without having and external server that secures the private keys?
  • lacker 14y ago
    We want to add both of these features. It will just require a slightly different design than the native mobile versions - files because there is no "binary" type in Javascript, and Facebook/Twitter users are different because integrating with other Javascript libraries is slightly less straightforward than integrating with other native libraries. They should both be possible, though, so stay tuned!
• zomgbbq 14y ago
  I sent the Parse guys a tech-support request on Friday morning before Memorial Day weekend. Most places you send emails to are a black hole and I didn't really expect a response until after the holiday weekend, if at all. To my surprise, I had an answer in my inbox by end of day! This is the kind of support I love in a company. I have not stopped telling everyone I know that they need to check out Parse. They're saving me tons of time getting my next app out the door.
  • deleted 14y ago
    [deleted]
• jgannonjr 14y ago
  How hard is it really to set up a data model and Rest API using Node/Sinatra/Rails or some equivalent? I agree this is convenient for those with no backend development experience (I know a few who are super stoked about this), however for me I couldn't see giving up control of the server side.
• krzyk 14y ago
  Now I'm waiting for someone to create a service where I don't have to waste my time with HTML+JS+CSS and focus on the application core :)
• sargun 14y ago
  Congratulations guys, this is cool stuff. How's your backend / infrastructure? Are you still a MongoDB shop?
  • lacker 14y ago
    We use MongoDB for some data, but we also use MySQL and Redis. Really it's a question of using the right tool for the job.
• DrCatbox 14y ago
  You cant write anything serious with this, for any business processing, where the interesting things happen, you need your own servers, not just storage and you cant trust the clients with your processing needs. For example, make a VPN service out of this, or a file sharing application with payment system?
• DavidAbrams 14y ago
  Yay, more Parse spam.
• meaydinli 14y ago
  Can some one please compare stackmob and parse and any other competitors they have? I recently started using them, and I'd appreciate your thoughts.
  • neilparikh 14y ago
    Haven't read through it myself, but some one posted this comparison: https://news.ycombinator.com/item?id=4044943 https://news.ycombinator.com/item?id=4044943
• nchuhoai 14y ago
  One question to the Parse department: How do you add indecies to fields? Do you automatically create them? If I have Users for example and I frequently want retrieve them by their email, I presume you dont do a linear scan every time?
  • andwang 14y ago
    yep, database indices are created for you automatically. This is one of the details we hope app developer should never worry about.
• prezjordan 14y ago
  Beautiful website.
• shortj 14y ago
  Someone explain what I am missing... I was able to run a simple wget, and I had 100% full functionality of an app (utilizing their API Key, and App ID and all) and run it on my local machine. Data flow is seamless between the local and hosted apps. So while I don't have to worry about a backend, neither does anyone who wants to "borrow" my app. There isn't really any form of app authentication built in that I could find, the REST API master key is the closest thing.
• neebz 14y ago
  amazing because I wrote something similar few weeks ago. It's based on Backbone though. github.com/neebz/backbone-parse
• zotron 14y ago
  Love this but running this JavaScript SDK in IE is a bit tricky. Basically, if you would like your solution to support 50% of internet users you would be forced to run your HTML/JS solution in a SSL-enabled server. I hope they enable a non-SSL solution soon. Oh! and forget about IE7 or IE6 users.
• deleted 14y ago
  [deleted]
• jasonkostempski 14y ago
  I downloaded the todo app, modified it to skip signup and login, added my own keys to Todo and saved successfully. Changed the class name and saved successfully. For what kind of app would this be OK even if users were authenticated? Data coming from a client must have a predefined, server validated schema to be useful in any real world app and business logic cannot be in the hands of the user. Am I missing something?