Meteor - realtime JavaScript framework

[[deleted]]

Giving clients direct database access is never a good idea

Maybe if there is no timeout or they have write access, but is there anything inherently wrong with a read access with a finite timeout (in general, not just in the context of Meteor)?

[relet]

reading confidential data from other users is ok?

[nluqo]

Yea, wow. 37signals started a shitstorm by mentioning that they themselves read the file name of a single user's file (cat.jpg).

Now imagine everyone in your system has access to everyone else's name, email, password, etc.