Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by IanDrake | Hacker News Reader

Parent Full thread

IanDrake·

This is cool. But can someone explain how data is secured in Firebase or Meteor?

From the Leader Board sample:

// Use setWithPriority to put the name / score in Firebase, and set the priority to be the score.

userScoreRef.setWithPriority({ name:name, score:newScore }, newScore);

How about I just change newScore to 100,000 in the debug window?

View on HN

Good catch : ) We mention this briefly in our FAQ. We actually do have security in place (notice you can't enumerate other people's data for instance in our own tutorial), but the API is far from complete and we have no docs yet. There will be a full-fledged security model coming over the next few months.

That's only true until they launch a public product: at that point you can get access to or modify their data. It is downright irresponsible to launch a service like this that encourages people to use an insecure design for their service: security should be built in from the beginning, not tacked on afterwards, and even at the level of "this is a tutorial" it should be clear to the developer what they need to do to make it secure (not thrown into the advanced level of documentation, for example, like some companies do).

Highly interested in what you plan to offer for authentication options and security (both data and transport).

This sounds like Model-as-a-service from the MVC pattern.

Thanks. It will be interesting to see how you guys do that.

Great website BTW.

Hey Ian, Meteor dev here. I posted a comment earlier in this thread about how data is secured in Meteor:

http://news.ycombinator.com/item?id=3834211

Reply on news.ycombinator.com