3 ms·
It worries me that security is still not a big part of this. I hope most people don't miss the fact that it's simple because it's insecure? Good luck to them so
by ukd1 14y ago
It worries me that security is still not a big part of this. I hope most people don't miss the fact that it's simple because it's insecure? Good luck to them solving it without ruining what's a nice idea.
Sample, in your console type:
Messages.remove({})
or
Users.remove({})
- mibbitier 14y agofor(var i=0;i<100;i+++) {Users.insert({name: "bot00" + i, last_seen: new Date()})}; for(var i=0;i<20;i++) {Messages.insert({user: "testuser", text: "yo!", date: new Date()})}; Security stability and scalability are the hard parts.
- ukd1 14y agoOr, if you're bored and hate everyone: Meteor.setInterval(function () { Users.remove({}); Messages.remove({}); }, 500);
- zquestz 14y agoYep all are effective. Security is something meteor is currently developing and is in very early stages. To shit on them now, when they are still in active development of a product they don't even claim is production ready... is like punching babies in the face. It is completely worthless.
- mibbitier 14y agoI think the point is that what meteor already has, isn't the hard bit. Being able to send messages asynchronously has been a solved problem for a long while now. However, judging from the ridiculous amount of xhr messages flying back and forth, perhaps even that isn't done very well yet.
- drivebyacct2 14y agoYep. I think it hits a crossroads of node.js/client-side js/ease/flashiness/demo/tutorials such that it has everyone's attention.
- zquestz 14y agoBe curious if you can find any security issues now that they have been fixed.
- cmelbye 14y agoEh, that issue is not really an issue. Server-side functions are actually a surprisingly elegant way of handling security. Basically, instead of calling Users.remove({}), .insert(), .update(), etc., you create functions on the server that are called from the client. That way, the server controls what you can and can't edit. The end result is still very simple, because you're just calling functions like user_login(), send_message(), etc. instead of operating on the database directly on the client-side.
- drivebyacct2 14y agoYou mean like every other web app in existence ever?
- pygy_ 14y agoYou can call (some) server functions from the client as if they were local. See http://nowjs.com http://nowjs.com for another implementation of the idea.
- arturadib 14y agoAccording to the FAQ they're still working on a built-in user authentication. If you have to implement a separate, server-side CRUD security check by hand, then I don't see why I would choose Meteor over say Rails or Express plus Backbone.
- zquestz 14y agoYou wouldn't get. I use backbone every day for my main job, and it's a great tool. Just imagine when frameworks like Meteor are complete and you can minimize a bunch of your boilerplate code.
- zquestz 14y agoFor more details on meteor security and what they are doing to fix it. Check out https://github.com/meteor/meteor/wiki/Getting-Started-with-Auth https://github.com/meteor/meteor/wiki/Getting-Started-with-A...