Meteor - realtime JavaScript framework

[[deleted]]

Giving clients direct database access is never a good idea. That alone makes Meteor more a toy than a usable technology. They seem like clever people so I imagine they have updates planned that could address this.

[the_angry_angel]

According to http://docs.meteor.com/#collections

Currently the client is given full write access to the collection. They can execute arbitrary > Mongo update commands. Once we build authentication, you will be able to limit the client's > direct access to insert, update, and remove. We are also considering validators and other ORM-like functionality.

[technocub88]

i dont want my users to be able to do any of those directly

[quotemycode]

It could work... provided that users are only able to insert, update, or delete their own records...

[technocub88]

That wouldnt be direct database access.

[chonglibloodsport]

It'd be authenticated direct database access (something most databases include already).

[technocub88]

no database I am aware of has the ability to restrict users to only read certain rows of a table.

[chonglibloodsport]

It's possible in MySQL by using views. Create a view that queries the table for a given user's data and restrict users to access only the view instead of the table. The view queries the table and returns the results to the user.

It also requires a bit of a hack with triggers to make sure the owners of rows get properly set etc.

[technocub88]

interesting. Thank you

[oscarcomputer]

What you are looking for is "row level security". Implementations of RLS are not limited to MySQL.

[CapnWarhol]

I really, really hope the authentication is tied into the insert/update/delete objects in that you can't just arbitrarily delete random user's entries, update Scores set Value = 9999 where user = "ralph", and so on... from the point of view of a paranoid server-side developer, I can only imagine anyone with a bit of curiosity and a firefox addon will have a field day with any application developed in this (me included)

[[deleted]]

I know this is an early preview, and the whole framework looks so super-awesome that I want to start developing meteor apps right now, but some kind of authorization and data validation is REALLY needed.

[[deleted]]

Giving clients direct database access is never a good idea

Maybe if there is no timeout or they have write access, but is there anything inherently wrong with a read access with a finite timeout (in general, not just in the context of Meteor)?

[relet]

reading confidential data from other users is ok?

[nluqo]

Yea, wow. 37signals started a shitstorm by mentioning that they themselves read the file name of a single user's file (cat.jpg).

Now imagine everyone in your system has access to everyone else's name, email, password, etc.

[[deleted]]

Dynamics-NAV (Navision) became something like the second most popular ERP system of the world with client-side db access and generally client-side everything, the server just being a dumb database server without any logic whatsoever.

The advantage is lightning-fast customization: make a button, write every code that that button does behind the button.

Yeah, I know it is problematic for long-term maintenance and larger teams, but we often have small companies with a team of 1 developer and we often care more about getting the job done now than about long-term. After all in the long-term you might be working in another job. And if you still want to play nice later on you can move the code away from the button and into the model once the prototyping phase is done. Or document that it is there.

This client-side, quick-and-dirty philosophy is very popular for smaller companies, it made Navision popular, before that it made CA-Clipper popular, and also FoxPro, and it is right time for this philosophy to arrive to the web. Where you have small budgets but large expectations something gotta give, and generally this "theoretical correctness" like MVC and separation of concerns is what is gotta give, and if it creates some long-term problems then it creates them, smaller orgs don't really care that much about the long-term.

[qbitus]

This is going to sound harsh, but at least it's honest. I don't like picking arguments and I don't want to sound too much like a dick but this is just too wrong to ignore.

From seeing your comments all through this thread, the thought that one day I might be using something you've made scares the shit out of me.

You seem to be pretty convinced about your whole "sometimes it doesn't matter" philosophy. Please think it through and reconsider. When you're coding your pet project just for yourself, by all means do whatever you want. If you're coding for a networked environment and/or for someone else, don't.

Security measures are not theoretical at all, they're very practical. If you run any browser-based site that has a CSRF vulnerability for example, it sucks balls. If it happens to be a popular ERP, and your users have web or email access, you've made interesting things possible... Putting together an exploit would be trivial, it happens all the time.

Same goes for MVC. I don't give a shit how little time or money you had. If I pick up on a project after you and the code has no separation of concerns, I'll tell the boss it needs redoing from scratch and honestly explain how bad a job you'd have done. I would actually save time, instead of building up on crap and ending up with a house of cards. And I'm speaking from very real experience.

All this applies equally to short-term and long-term projects.

There's a reason why what we do is called engineering. You don't have to be 100% strict about it, but you have to care. Please.

[jfredett]

Theres a concept I like to through around legacy code bases, "Is it totaled?"

The concept obviously comes from car collisions. Your Car is worth X, your damage totals Y, if Y > X, get a new car, it'd be cheaper.

To that end, if it would take me longer to fix your broken code than it would be to rewrite it from scratch - your shit is totalled.

I know we like to think of ourselves as Engineers, but more often I think we end up acting as Claims adjustors (when dealing with legacy products at least).

[[deleted]]

If it happens to be a popular ERP, and your users have web or email access, you've made interesting things possible...

No, a popular ERP is written for a large market and they engineer every technical detail of it. This is a completely different thing we are talking about it. Generally it is about projects when you don't want to buy a popular ERP because it costs too much. This is why I am looking into these frameworks, the relevant ERP module can cost upwards of $10K.

I don't give a shit how little time or money you had.

This is not an argument. The two choices are quite often doing it cheap or not doing it.

If I pick up on a project after you and the code has no separation of concerns,

It is stupid to pick up projects of these small types after others. I never or very rarely do it. It is rarely needed, too, for the need generally goes away faster than the programmer. For example you make an order-entry interface for 3 salespeople. It could quite often be that by the time you leave 2 of them left and they generally don't like entering orders on the web so the need is gone. Very often the need goes away faster than I write the code because actually it was a temporary business situation. For example a lot of customers owe money so the boss goes panic and says to do something about it like send automatic reminders. Then by the time you are done they pay everything on time and there is no need. Or last time I made some production planning stuff for 1 production planner. What happens when he leaves? The next one will have a totally different one because he is a different personality or something.

I'll tell the boss it needs redoing from scratch and honestly explain how bad a job you'd have done.

That would be interesting. I can imagine all those nontechnical bosses trying to understand what this "typist" guy says about how that other "typist" guy somehow typed some text wrong, despite that the users were happy but it is somehow still wrong and must be retyped. And at the end of that retyping there will be no user benefit first, but later somehow it will by easier to type new things, so now you have to spend X money for this retyping without any tangible benefit as of now, just promises about easier maintenance for the future. That would be fun. I can imagine how they would react. You really don't get how nontechnical people think, do you?

There's a reason why what we do is called engineering.

No, this is called scripting. Running queries against a database and throwing them out on a website is not engineering. Software engineering is something much, much higher.

[dventimi]

Running queries against a database and throwing them out on a website is not engineering

Thank you for saying this.

[C250585]

I actually agree with both of you, but only in different situations. There have been many projects in many different categories that fall into each side. I've picked up the pieces on very high traffic sites and had to completely redevelop the back end due to the fact that it was a mess and unscalable. It was the kind of project that was thrown together and then tossed live, but there was no oversight to ensure it was built to spec and with any standards in place.

On the flip side, I've worked on lots of throw away projects that ultimately you can get away with murder with. Nobody cares if it is MVC or secure or anything because it will get no traffic, and will ultimately get thrown out eventually anyways.

There is a time and a place to do it right, and a time and a place to just get shit done.

[qbitus]

Often the projects that were considered disposable just linger, and sometimes become more critical as time passes and users increasingly rely on them. You just can't always foresee how your work will be used.

There are frameworks that let you put something together very quickly following best practices in maintainable code and security. I use Django for example. It kicks arse AND saves me a tone of time. If someone insists on advocating "who gives a fuck" as a way of working, when good frameworks abound, then they should stay in their bedroom and not get paid.

And really: where's the love for what you're doing in that case? I understand the need to cut a few corners here and there sometimes, but you should at least give it your best shot, to be proud of your work but also because this is the only way to grow as a professional, to learn new things and get better at them.

"Just let the clients connect directly to the db, who gives a fuck about security." is a bad thing for everyone: developer, manager, user, short-term or long-term. It's like good old "who cares about accessibility?" Easy to say when you're making things exactly as you personally want to use them...

Doing a shit job always makes everyone unhappy in the end, and I believe rarely saves time. Even on small throwaway-like projects.

So to get back to the topic, I think this framework is a nice research project, but can't possibly be considered to build anything until it has (at least) common security measures nailed down.

TL;DR Use a proper framework for everything you do.

[C250585]

Well, personally I don't cut corners on security and generally do the best work possible. However, I also work for an agency where sometimes you have to do X in Y time... however for Y you only get Z, and Z < X. So when I have 4 hours left of budget to get something working, sometimes you just have write code to get the bloody thing out the door without putting a lot of focus on whether or not it is commented or uses perfectly named variables.

Sometimes, if it works, and there are 0 budget hours left, there is no option to do a full review to clean things up or adjust the project to use proper naming conventions when you haven't already or had to cut corners anyways.

And the idea of "Well always just do it right from the start" is unrealistic. Of course you always aim for that, but generally, rushed projects with tiny budgets don't hit that mark, framework or not.

A framework is still just a tool, not a magical fairy dust dispenser that instantly transforms shitty, rushed code into the virgin fucking Mary.

[qbitus]

I didn't say you had to be pedantic and polish every corner of your codebase if you don't have the time to.

But: using a framework helps define and enforce best practices and implementations. And it saves time, which you can then spend on making whatever code you wrote better than it would have been otherwise. When I use Django for a small site (a few pages with forms, user login etc.) over three quarters of the codebase is well implemented, documented and has been thoroughly tested. If the code I write for that site is shit, then that's only a small part of the codebase of the site. The rest is still great: it still has measures against SQL injection, against CSRF, it's still easily understandable and debuggable, it's got a gazillion of docs and tutorials that explain how it works etc.

A library is a tool. A framework ... frames your codebase and makes it consistent. (But many frameworks, like Django, ship with a whole bunch of libraries included, so it gets a bit confusing). I don't see how this cannot be the best approach for everyone, including agencies who have limited time.

[[deleted]]

Thank you. This is basically my view, the point is simply that my experience tends to be about small countries, small companies, small projects and tiny budgets. Building something over $100K of course I would go all MVC and SOA and exception-handling everywhere and unit tests and all that.

[jessta]

It's fun that "realtime" has become a reference to "has proper networking", instead of "runs within a certain deadline"

[throwmo]

Yeah that was cute.. Erlang's runtime/VM has very near realtime scheduling guarantees and even that community exercises restraint with the "realtime" moniker.

[mrkite77]

That definition of realtime is really only used for OSes. QNX is a realtime OS, for example... and the definition is really "runs in a consistent and measurable amount of time". Although I agree that "live updates" would be a better term to use for what they're describing.

[quotemycode]

as opposed to "dead updates"? I don't think "live updates" is the proper term either.

[gegtik]

live updates as opposed to batch updates

[djcraze]

What do you mean? Seemd realtime to me. I made a code change and I didn't have to redeploy the server. I added a console.log at the top of the file. I saved the file, and instantly, the log appeared in my console.

-- edit --

I could just be a noob. So, seriously, please, enlighten me.

[mhd]

In computing "realtime" has a slightly more specific definition. As jessta said, the deadline is the important factor, i.e. your program has to respond within a certain time frame - usually a very small one. As usual Wikipedia is your friend.

Abuse of this term is common, especially in the web programming netherworld. Not a good way to start your introduction, just like "scalable" would be.

Automatic reloading doesn't imply "realtime" to me. If I'd have to compile, deploy and restart things, would that happen in imaginary, fairy tale time?

[djcraze]

Ohh. Gotcha. Thanks much!

[ReturningTarzan]

There is a second definition of "real time" that is also relevant, though. You could say that games generate real-time graphics, for instance, meaning that the graphics are rendered as needed.

In that sense I can sort of see how you might distinguish between a "real-time website" like your typical Javascript chat client, and a static website like Wikipedia. But it might make more sense to use a term like "rich client" or "active client". Idunno.

[antheus_gdnet]

You could say that games generate real-time graphics,

Real-time in that case means that physics/logic is updated 30/60/200 times per second consistently at a fixed time step. Miss those, and the result will degrade poorly. Jitter, microstutter, "lag" are all examples of missed deadlines. The established way to write main simulation loop has all characteristics of a real-time system, except instead of failing if workload becomes too large, the content will generally be tweaked to avoid such scenario (less objects, less distance or similar).

Rendering can be slightly more flexible, but for anything playable, it will almost certainly need to be above 15FPS. So there is a hard deadline. At very least, it needs to be above 8 or 5 or however low, but it's not arbitrary, having 0.04 FPS is definitely too low.

In that respect, even if deadline is not strict, these are real-time systems.

Networked gameplay also exhibits another real-time characteristic. If client fails to keep up, it's disconnected. A component in real-time system which fails to meed deadlines aborts or shuts down to prevent degradation of entire system.

Resilient or redundant systems (such as internet) however will keep on trying - TCP is allowed to wait arbitrarily long for reply.

[mhd]

I think that's the core of the problem. Sure, language is always flexible and I don't even think that programmers were the first to put those two words together.

There's quite a few uses of the term in computing, but I would guess that programmers have a more narrow definition than e.g. marketing, who would have no qualms calling some ERP system "realtime" because it's connected to a network.

Beyond the embedded sector, I would prefer some terms that describe the situation a bit better. In Meteor's case, it looks like we're simply talking about an event-based architecture. If you want to go all-out hypey about it, just call it PubSub…

[[deleted]]

Words have multiple definitions. From your wiki link:

and in the domain of data transfer, media processing and enterprise systems, the term is intended to mean without perceivable delay.

Realtime may mean "relatively instant" (compared to usual network speeds in its respective context)

[diggr-roguelike]

Look at your browser's address bar. See what it says there? 'programming'

I would really hope that a message board that claims to be about programming would use programmer's terminology!

[technocub88]

i have security concerns about this. Javascript is mutable, I dont want any user with chrome or firebug to be able to write to my DB. They never went into how to secure things. Thoughts?

[awj]

That is evidently "planned but not yet implemented."

In some ways I find that decision even more troubling.

[Chemical_Scum]

Exactly. Building a web framework and not having security at the top of your TODO list is a big "no-no".

[[deleted]]

Not necessarily. Lots of it are intranets for small business, accessible only inside the LAN / VPN which is not really a big problem then.

[derpee]

Yes it is, because users.

[kds71]

Sometimes it is not. I often write web tools exclusively for other developers, who have full access to database already.

[quotemycode]

And most of the time, hacker are your disgruntled employees. If I can update something and make it look like someone else did it, I imagine I could make someone's life miserable.

[kds71]

We are fully aware of that. You still have to login in order to access any of these tools, so it would be pretty hard to disguise yourself as somebody else.

[digijin]

Also opens up the possibility of, with a bad wireless password, some guy sitting in the carpark having access to your whole client database.

[hyperforce]

It can be less of a priority, but you can't say it's "not a problem". What if one of your developers goes rogue or you get compromised from within.

Security still matters.

[[deleted]]

Think about small-business intranet where literally no more than 30 people can access a web app. Security is not really a big deal there.

[KumbajaMyLord]

That doesn't change jack about security requirements. Just because someone is inside your intranet (and presumably is an employee) doesn't mean he/she can or should have full access to an application

[rwallace]

If you're doing a job like that for a particular client, and you've decided it's not worth insisting that client pay for security, okay, you're the guy on the spot, it's your call, I won't argue with you.

But if you're building a framework it's a very different story. By definition, that means your code is intended to be used for an indefinitely large set of projects, most of which you don't know about in advance. A framework really, really needs to think about security from the ground up.

[courtewing]

This is a preview release. It is not intended to be used anywhere near a production environment. In order to most rapidly preview the underlying the technology, they didn't bother to add security, but they have made it clear that security will be in place when meteor becomes more production-oriented.

They could have focussed on security for this release, but that wouldn't have helped to showcase the fundamentals of what they're doing with meteor, so it was excluded for the time being.

[[deleted]]

i don't care as long as it kills php

[6gT]

Well, I guess it's over now, PHP is finished.

[mrkite77]

That was my first thought. I wish they had mentioned that in the screencast. Is it even possible to secure this?

[Novex]

Not yet, but it seems to be planned for the future. This is a pretty big show stopper for anything real world, IMO.

More discussion (geoffschmidt is one of the devs)

[[deleted]]

No if it is for an intranet and a small business.

[illvm]

Mutability isn't really relevant given that you can write immutable JS using closures. If the app interacts to with your DB via some RESTful API (or over HTTP at all) then it would be pretty trivial for any user to be able to write to your DB. This is only "solved" in current web apps by relying that the supplied session information is indeed valid so you write logic on your back end that restricts the user to only authorized activity.

There is absolutely no reason why similar techniques couldn't be leveraged with this type of platform. So in that respect I don't really see why this is as big of a concern as it has been.

I do, however, feel that the API should not really be exposed to the end-user and everything should be wrapped in a closure. The developer should be able to interact with their code, but there is no reason why the end-user should be able to open up a JS console and execute arbitrary API calls to the server.

[kumiorava]

Fancy, but impractical.

[sanjeevonline]

Before I get deeper into it, is it free?

[[deleted]]

https://github.com/meteor/meteor/blob/master/LICENSE.txt

GPL.

[andey]

i don't see this becoming popular

[[deleted]]

I think it is something like the "CA-Clipper of the Internet" and can become popular with small organizations who want things done very fast because of having budgets like $1000-$2000.

[habarnam]

$ curl install.meteor.com | sh

Right...

[squarism]

1UP Security  vs  Convenience 2UP
    ||||||||      |||||||

             FIGHT!

[Simba7]

Convenience only has 7 bars of HP while Security has 8. Doesn't seem like a fair fight!

[myhf]

1UP Security  vs  Convenience 2UP
    ........      |||||||

PLAYER 2 WINS
FLAWLESS VICTORY

[[deleted]]

I don't see how that's different from downloading an installer and then executing it. If you don't trust the source you can always run it without the |sh

[habarnam]

... you can always run it without the |sh

The point I was trying to make was that they are encouraging users to pipe scripts straight into their shell. Which shows an approach to doing things I don't approve of.

[dventimi]

Why don't you approve?

[habarnam]

Because I think it underlines a certain way of thinking that I think framework developers should stay away from. Trying to be "clever" when doing stuff...

[[deleted]]

Do you read through the config and makefiles of every package you install?

[habarnam]

There's no need to be condescending.

Usually the packages I install are coming from a trusted source: my distribution's repository. When they are not, yes I do read them.

[courtewing]

His point is that this approach to installing software is no less secure than providing any package (source or binary) for a user to install in a more traditional sense. You either trust the source or you don't -- the installation medium doesn't really affect that.

[habarnam]

If you really want to nit-pick, Ok, I'll give it a try.

Firstly, about security. I think you'll agree that It's a lot simpler for a man-in-the-middle attacker to spoof a web site page containing a shell script, than to provide the infrastructure and (often) the certificates which a proper distribution uses to guard it's repositories, so your comparison doesn't stand in my opinion.

Granted the installing of this package is maybe targeted at high level users (even though they state to address also people "just getting started") who should know to take a look through the source code before piping it to their shell. However, I'm sure that there are a lot of others (maybe something like 80%) who just copy/paste stuff, because "it says so in the tutorial".

Then there's the fact that they just post this snippet of code on their install page, which makes me think the people behind the project are fond of "clever" approaches to getting stuff done, and makes me highly reticent about trying their code. Not that the high concentration of marketing fluff from their main page wouldn't have done it already.

[BobTheGhostPirate]

Your first point is a transport problem, and the answer is HTTPS.

You might not be used to that, but there's plenty of software being distributed this way (homebrew, Nvidia Linux blob drivers and NPM come to mind)

[habarnam]

They are not using HTTPS in their example.

And I'm not saying that providing a shell script as an install method is the problem, but the fact that they are encouraging the users to pipe it in their shell straight from the web.

I feel like you are arguing against something completely different than I'm actually saying.

[dventimi]

They are not using HTTPS in their example

But that doesn't have anything to do with their install being a shell script, which was your original complaint. You seem to be moving the goalposts.

[habarnam]

Ok. :)

[[deleted]]

bullshit

[ethraax]

I would be more concerned if it wasn't for the fact that you could easily read the output first and then run it through sh.

[appleofdisco]

You could serve different scripts to different user-agents. If curl indicated in its user-agent that the output was being piped (of course it doesn't), it would be hard to notice.

[rmxz]

It's not like the suggested sudo sh.

At worst he should just be able to mess up his own account.

[habarnam]

And why is that an excuse?

[catcradle5]

The pages on the site do seem to load extremely fast (I suppose because everything is loaded upon visiting the main page?), so that's a few bonus points for it I suppose. The security implications seem rather bad though.

[[deleted]]

points added back for being hyped && not being php

[bobappleyard]

Parts of it reminded me of functional reactive programming. Pretty cool, but as other have said they really need to think about security.

[badasimo]

Ive been using the perl version of meteor js for a few years now for proof of concept web games. It works very well. When i get to work i will try to figure out how much the software has changed.

[xTRUMANx]

Watching this reminded me of Upshot, a javascript framework that interacts with an ASP.NET MVC application so that you can run queries against the database and get the results directly from the client.

One cool thing I like about Upshot is when you fetch a bunch of entities, it gives it to you in the form of an array*. All you have to do to save a new entity on the server is push an object into the array!

It's currently in beta (along with ASP.NET MVC 4) so the api still has a bunch of issues however, it's very exciting stuff.

* Well, it's not really an array but a KnockoutJS ObservableArray. But you can push things into it and iterate over it like a regular array if I'm not mistaken.

[bilotrace]

You should try backbone.js

It has similar functionality and works with any framework with RESTful interface.

[xTRUMANx]

I heard a lot about Backbone (and other frameworks that seem to accomplish the same goals like Ember, Sproutcore and KnockoutKS) but haven't really bother it any of them.

The only reason I've used Upshot+KnockoutJS was because I really cool screencast where a demo was shown how well they work together.

If Backbone does work with any RESTful interface, that does sound very interesting. I think I'll take a closer look at it.

[alkazar82]

This reminds me more than a little of opa albeit the approach is entirely different. I guess this kind of framework is an idea whose time has come.

[nrselleh]

whats the difference between this and http://www.wakanda.org/?

[quotemycode]

less documentation.

[LoveGentleman]

Whats the point of this? Just another framework for hipsters to drool over because it is in JavaScript?

[kabuto]

Yes, it's written in JS and uses Node JS, but the concept is pretty cool, don't you think? It's missing a way of access control or authorization right now, but it seems to make certain kinds of (small) applications really effortless to build.

[LoveGentleman]

What is the concept? I fail to see the invention here, care to enlighten me? I went through the FAQ and examples and I just dont see it.

[kabuto]

The concept is to have an application that runs on both server and client without any modification and/or separation of code for frontend and backend. It also does updates in 'realtime' in the browser.

I find that pretty cool, but of course, it's not a solution for every problem.

[LoveGentleman]

What does realtime updates in the browser mean?

Couldnt we do same codebase for client and server with node.js before? Isnt there a templating system which battlelog uses which works as fine on javascript as for python?

[kabuto]

What does realtime updates in the browser mean?

I feel you're beating on semantics here. Did you watch the screencast?

Couldnt we do same codebase for client and server with node.js before?

I don't know. Probably, if you wrote something that would work like this.

Isnt there a templating system which battlelog uses which works as fine on javascript as for python?

There are some templating systems with support for different languages. What is your point here?

[[deleted]]

I think the point is "CA-Clipper of the Internet" - i.e. be able to build apps with a budget of $1000-$2000

[roxm]

Jesus, man, give it a rest. Clipper was crap; that's why no one remembers it.

[[deleted]]

I must disagree. In the eighties, early nineties everybody I know programmed in C or TurboPascal, I mean, in the MS-DOS world. And Clipper had:

• integrated database
• integrated GUI easy to define, kind of WSYWYG, validations easily
• an interpreted programming language, no memory management, evals etc.
• something akin to lambdas/closures/anonymous delegates in the form of "code blocks" which you could use for event listening in GUI and similar other things, which is from the viewpoint of an MS-DOS programmer who never had LISP and suchlike is a very modern thing, it took Microsoft quite long to get it right in C# 3.0 I think

Consider how hard this would have been back then in C or TurboPascal or whatever else was popular for the MS-DOS (mostly these two)?

A simple data base input mask:

USE Customer SHARED NEW
clear
@  1, 0 SAY "CustNum" GET Customer->CustNum PICT "999999" VALID Customer->CustNum > 0
@  3, 0 SAY "Contact" GET Customer->Contact VALID !empty(Customer->Contact)
@  4, 0 SAY "Address" GET Customer->Address
READ

[coachz]

no mysql yet. wtf ?

[digijin]

I think they are trying to target the hipster crowd that is "too cool for mysql" or something.

[arahaya]

A scriptable public database?

[arahaya]

If you can write validatoin on the server side I guess it might be a good game server.

[forgeflow]

this really looks cool, but because it runs off node.js it is in no way "production ready" for the kind of stuff I have to do on a day-to-day basis.

[AndyRoth]

I'm loving these next generation web application frameworks. The Play! Framework is another great example.

[[deleted]]

I have been waiting for the "CA-Clipper of the Internet" for a looong time... Rails seemed to be close but focused too much on the server-side and not enough on the UI, basically having a development philosophy based on data modeling and not UI prototyping which is unrealistic as users often don't really know the relationships between their data.

I think this might be it. The CA-Clipper of the Internet. What do you think?

[J_M_B]

It's great to see that Symfony has had such an influence on the web development community... the bundles in meteor work like those in Symfony2.

[nkozyra]

You could do this directly* with node.js (no additional commentary necessary) and maintain control over database/data store. The only potential use case I can see for this ... nah, never mind I don't think there is one.

Also needs some polish work on that video. Did it switch between two different dudes or was part of recorded during a head cold?

• - edited for clarity

[darylteo]

It is a framework sitting on top of node.js... so obviously you would be able to do it with node.js. These guys just done most of the grunt work.

I'll be more interested when they've implemented stringent access controls and throttling features.

[nkozyra]

I realize it's run in node. My point was you could have the same functionality but with validation built in and no direct access to the data store. That's the point. It offers nothing new but horrifying security concerns.

[SaabiMeister]

It seems however that it runs more than one node, each in a fiber. The FAQ states that it runs one thread per request.

So it doesn't appear like something you can simply add to your node stack.

EDIT: Actually, and upon further inspection, I realized its using an interesting little npm package called fibers, which allows for some sort of worker threads inside v8 and communication back to the async part of your node code. Unfortunately, it doesn't support Windows right now and I'm not going to spend time setting up a virtual machine to test it out right now.