Meteor

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

Kyek

Founder of wdR

Group: Administrators
Posts: 5078
Joined: 20-February 10
LocationPhiladelphia, PA, USA
Expertise:HTML,CSS,PHP,Java,Javascript,Node.js,SQL

Posted 11 April 2012 - 10:19 AM (#1)

Meteor

A web framework for 2012.

I went back and forth with myself for awhile, debating whether this belongs in Tech News Talk or Node.js. I decided that since it stands to have a decent impact on how webapps are written in the future, it belongs here

.

So the concept is this: You have a template for your HTML, and you have your application code in Javascript. Server side, client side, whatever, it's the same codebase. For simple apps, it's the same file. When you update any javascript that would affect the client side, it gets pushed to the people currently on your site, live, so they get the update. If you define an element of the page or a piece of data or something that should be kept in sync between all connected users, it happens seamlessly. Meaning, if you have a button on your page that changes a div to a different background color, you can tell that to sync between browsers and now *everyone* on your site, in real time, can see the color change when anyone clicks the button. And you do that without having to know anything about websockets or protocols or any library that isn't Meteor's own API. Doing this is literally 3 lines of code.

That's really only the tip of the iceberg. They also have a PaaS to deploy your creations to, a module packager that ensures each module you use is capable of the live-updates thing, and a million other bells and whistles. It's pretty impressive.

http://meteor.com

Some random thoughts about this:

I used to warn people against using MongoDB a lot, but they've made some recent updates that makes it warrant a second look -- so I won't hate on the basis of the DB choice for now ;-)
It DOES bother me that Mongo is the *only* choice. Their API allows for basic key/value storage as well as for more complex relational queries, so if you can only have one DB, Mongo wasn't a horrible choice... but I don't see wide adoption of the framework without supporting more types of data.
There is currently zero security around database access. Any client on your site has full DB access. That is frickin INSANE. But, when asked about this in the HN thread, they said they have an auth branch in the works that will cover this concern. Until then, Meteor can really only be treated as a cool toy.
I'm really curious what the bandwidth overhead is for this. Clearly it's using websockets (and might even implement socket.io; I haven't looked at it yet) but what all gets sent down when you save a one-line change? It's worth looking at.
The variable dependency detection in the live functions (if you watched the screencast) is fucking MAGIC and I can't WAIT to read the source to see how the hell they pulled that off.
The license is GPL. Meaning, if you want to use this for something closed-source, you're probably going to have to pay money for a commercial license. That's kinda crappy. I'd rather they profit off of their PaaS than lock down the actual library itself.

Twitter :: GitHub :: webdevRefinery ;-)

Cocoa

Group: Members
Posts: 418
Joined: 30-November 10
LocationEngland

Posted 11 April 2012 - 10:37 AM (#2)

I must be missing something here, is this a new framework or API or something.

I'm confused to say the least.

Dan || HTML || CSS || Web & Graphic Designer

Oh, there's no place like 127.0.0.1

Portfolio | Forrst (6 Invites) | Dribbble

MY FIRST TUTORIAL - HOW TO CREATE THE IRON MAN LOGO

Kyek

Founder of wdR

Group: Administrators
Posts: 5078
Joined: 20-February 10
LocationPhiladelphia, PA, USA
Expertise:HTML,CSS,PHP,Java,Javascript,Node.js,SQL

Posted 11 April 2012 - 10:54 AM (#3)

It's a full application framework -- which intrinsically has an API. Just watch the screencast

Twitter :: GitHub :: webdevRefinery ;-)

Cocoa

Group: Members
Posts: 418
Joined: 30-November 10
LocationEngland

Posted 11 April 2012 - 11:08 AM (#4)

Seems very interesting but the website is awful... not just design wise.

Dan || HTML || CSS || Web & Graphic Designer

Oh, there's no place like 127.0.0.1

Portfolio | Forrst (6 Invites) | Dribbble

MY FIRST TUTORIAL - HOW TO CREATE THE IRON MAN LOGO

Renegade

418 I'm a teapot

Group: Members
Posts: 748
Joined: 08-March 10
Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL,Graphics

Posted 11 April 2012 - 12:39 PM (#5)

This is pretty ridiculous. Is everything automated? I'm pretty skeptical. Did I pick it up correctly or is Meteor building queries based on your templates? I think that might be a little too much magic for me but I like how it's optional and I especially love how you can bundle your project so you're not entirely tied down. They know how we think.

I can see what you mean by the vulnerabilities via the client-side database interaction. I really don't know how they'll be able to secure that unless some sort of backend code is implemented. All in all, this is something to look forward to when it does finally kick-ass.

Also, it really shows how much crap we have to go through to get apps out there. Deploying an app requires a serious amount of effort, time and preparation, not to mention money.

http://adriancooney.ie ₪ Github ₪ Twitter ₪ Dribbble ₪ Forrst
We all die. The goal isn't to live forever. The goal is to create something that will.

Array(16).join({}-{}) + " Batman!";

dida

Group: Members
Posts: 1976
Joined: 10-March 10
Expertise:HTML,CSS,PHP,Java,Javascript,Python,Ruby on Rails,Node.js,SQL,Graphics,Flash,MongoDB,CouchDB,Cassandra

Posted 11 April 2012 - 01:22 PM (#6)

Cool.

Nand

Group: Members
Posts: 36
Joined: 24-February 12
Expertise:PHP,SQL

Posted 11 April 2012 - 03:01 PM (#7)

What kind of witchery is this?!

Memes aside, this is pretty damn cool.
I don't have the faintest idea how they do it, so I'm confused as to what it really is.

Really want to dig into this...

callumacrae

{{ post.author }}

Group: Members
Posts: 2862
Joined: 20-January 11
LocationWarwickshire, England
Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL

Posted 11 April 2012 - 03:38 PM (#8)

Kyek, on 11 April 2012 - 10:19 AM, said:

[*]The license is GPL. Meaning, if you want to use this for something closed-source, you're probably going to have to pay money for a commercial license. That's kinda crappy. I'd rather they profit off of their PaaS than lock down the actual library itself.

I haven't used GPL3 so I could be wrong, but since when has that been how GPL works?

Front-end developer and writer
Twitter | GitHub | phpBB Contributor and Website Team Member | lynxphp

Renegade

418 I'm a teapot

Group: Members
Posts: 748
Joined: 08-March 10
Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL,Graphics

Posted 11 April 2012 - 04:06 PM (#9)

After taking a deeper look into the examples, I can't really warm to this. There just seems to be too much going on.

The source on http://wordplay.meteor.com/:


<!DOCTYPE html> 
<html> 
<head> 
  <link rel="stylesheet" href="/1c58da6d0bc1e1e7b29bf5db7cf1dd089637c5e5.css"> 
 
 
 
  <title>Word play!</title> 
 
 
  <script type="text/javascript" src="/f508fd5298a0add8b255958345dae52197472b6c.js"></script> 
 
</head> 
<body> 
 
</body> 
</html>

No content whatsoever, all added dynamically seemingly. Also, I opened two windows and added two players. I then opened console and did

Players.remove({})

(empties the collection) and both players exited. I really don't see how this could've been released with that amount of vulnerability. I suppose you could overwrite those functions that access the database but they're created after your code is executed.

http://adriancooney.ie ₪ Github ₪ Twitter ₪ Dribbble ₪ Forrst
We all die. The goal isn't to live forever. The goal is to create something that will.

Array(16).join({}-{}) + " Batman!";

Cyril

Group: Members
Posts: 2544
Joined: 03-August 10
Expertise:HTML,CSS,PHP,Javascript,Graphics

Posted 11 April 2012 - 04:19 PM (#10)

I'm with Renegade on this. Databases have security, authentication for a reason... Being able to open up a console and changing stuff as a client totally defeats the purpose of that.
Even if they're implementing that, the whole idea of even being able to access a DB like that is, IMO, bonkers. Which in turn, makes me think this whole thing is an insecure useless pile of excrement. I'll stay with sockets, thank you very much.

website :: github :: twitter :: dribbble :: ~~forrst~~
html, css, php, javascript, graphics

Kyek

Founder of wdR

Group: Administrators
Posts: 5078
Joined: 20-February 10
LocationPhiladelphia, PA, USA
Expertise:HTML,CSS,PHP,Java,Javascript,Node.js,SQL

Posted 12 April 2012 - 08:21 AM (#11)

Whoa, all the hate ;-).

I'm actually a huge supporter of building the application entirely through Javascript. Here's why: There's a feature in your web browser, right now, to "pin" a tab. This encourages you to keep open tabs on a long-term basis; something that many people were doing anyway with things like GMail, Trello, and other webapps that update in real time. So if you're the author of one of those applications, you're faced with a problem: A significant percentage of your userbase is never reloading your page. So how do you push updates? Well, there are pretty much three ways to do this:

Reload the page every X hours as long as there's no activity for the past Y minutes. But maybe the user was looking at the site, just not interacting with it, and you've interrupted them. Maybe they had text entered into a form element and you just erased it. You should never assume you should control when your page is reloaded. So, bad solution.
Make the page aware of an update flag. Whenever you update the app, you either stop your users from performing any major actions, or just pop up a big notice that says "Please reload the page to see our new version!". In any case, you're interrupting the user and causing an annoyance, no matter how minor. Bad solution.
Realize that your web app is just that: An application. Not some distinction between static and dynamic content; an application that is interacting with a server, where anything can be created or destroyed dynamically. This gives the server full control over the content of the users' pages, and allows for seamless updates without any level of annoyance or even an awareness that an update is happening. While this requires some extra planning on the part of the programmer (or, not so much if you're using Meteor), this is the best solution for the end user. And that's the most important person.

What I think most web devs, and me included, are guilty of in a field moving as fast as ours is getting too comfortable with one way to do things, and trying to hold on to that. The best web apps are dynamic now, and if you look at trends in what popular web apps are doing, it's only moving more rapidly to a dynamic interface. So, you can either plant yourself in the ground and say that web applications should have a static component and anything that challenges that is too much, or you can consider that this move might be inevitable to support concepts like long-running applications and fully dynamic UX. So on that front, I think Meteor is absolutely huge.

I *do* agree with the database security stuff, but read back up to my first post -- this isn't 1.0, it's still a toy, and there's an 'auth' branch of their repo that's addressing this concern. So in the nearer future, we'll have higher security on this. For now, we can still dive in and learn about it

. I have to disagree with this line, though:

Cyril, on 11 April 2012 - 04:19 PM, said:

Databases have security, authentication for a reason...

Many databases (in fact, nearly all NoSQL databases) either have no authentication layer, or have it off by default. The idea is that if you can access it through the network, you have permission to use it. Riak, Cassandra, MongoDB, Couch, Membase, Redis, the list goes on and on and on. More and more, the responsibility of authentication is being left to the application, not the database. Which is why it makes so much sense that the auth branch is being developed for Meteor, rather than Meteor doing something like enabling Mongo's simplistic auth layer and trying to proxy to that. I think it's a pretty good approach, and I'm excited to see what they do with it.

Also worth note is that you don't HAVE to expose your DB to the client with Meteor -- that was just part of their example. You can have model-like functions that enforce permissions instead, right now, without waiting for the auth branch.

Twitter :: GitHub :: webdevRefinery ;-)

ianonavy

Group: Members
Posts: 685
Joined: 14-April 10
Expertise:HTML,CSS,Java,Javascript,Python

Posted 12 April 2012 - 11:36 AM (#12)

O_o still, the idea that any client could just type

Colors = new Meteor.Collection("colors");
Colors.remove({});

and wipe the whole table from their browser's JS console is a bit frightening.

Once the auth branch is done, I'll be so excited to start playing around with this.

reputation += 1 if post.is_helpful else 0

Kyek

Founder of wdR

Group: Administrators
Posts: 5078
Joined: 20-February 10
LocationPhiladelphia, PA, USA
Expertise:HTML,CSS,PHP,Java,Javascript,Node.js,SQL

Posted 13 April 2012 - 07:59 AM (#13)

callumacrae, on 11 April 2012 - 03:38 PM, said:

I haven't used GPL3 so I could be wrong, but since when has that been how GPL works?

Sorry, I missed this one in my reply -- GPL requires that derivative works provide their source code, non-obfuscated. As a result, most software businesses can't use GPL code within their stack (since they'd be giving their product away for free), and instead have to purchase a commercial license. It's a great way to force for-profit orgs to pay for your product, but it's a really risky move because, being open source, nothing stops someone from creating a similar framework (or adapting some of Meteor's features into an existing framework) and releasing it under a permissive license. There's a really good article arguing that it's a near-certainty that this will happen.

ianonavy, on 12 April 2012 - 11:36 AM, said:

O_o still, the idea that any client could just type

Colors = new Meteor.Collection("colors");
Colors.remove({});

and wipe the whole table from their browser's JS console is a bit frightening.

Once the auth branch is done, I'll be so excited to start playing around with this.

Kyek, on 12 April 2012 - 08:21 AM, said:

Also worth note is that you don't HAVE to expose your DB to the client with Meteor -- that was just part of their example. You can have model-like functions that enforce permissions instead, right now, without waiting for the auth branch.

Twitter :: GitHub :: webdevRefinery ;-)

gibbonweb

兄ヨハネス

Group: Members
Posts: 2061
Joined: 23-June 10
LocationMunich(DE)
Expertise:HTML,CSS,PHP,Javascript,Python,SQL,Graphics

Posted 21 May 2012 - 04:42 AM (#14)

Am I the only one besides Renegade who doesn't like that empty body tag? In that respect, Meteor behaves even worse than those good old Flash-based sites everybody likes to hate because of... well, their lack of semantics and accessibility.
And those obvious security flaws 'by design'... wtf?

a hoopy frood who really knows where his towel is. ~~~ gibbonweb | github | hdr photography
my wife has a new DIY/decorations/floristry blog, wanna take a look? (stay tuned for English translations...)

SapporoGuy

Group: Members
Posts: 906
Joined: 10-June 11
LocationSonyLand

Posted 21 May 2012 - 03:45 PM (#15)

Drool!
Makes me want to stop using php :-(

Ok, so here I am invested in php but from a user download standpoint what do you all think? Let's say I want to make a forum, offer it as BSD or MIT. Do you think if it were feature comparable to say fluxBB would people actually download a nodejs app compared to a php one?