Hacker News Reader

Comment by danfitch | Hacker News Reader

Eh... Go play, I built the site to learn how these technologies would work together. I learned that its cool and very simple to hookup but that means with simplicity comes some extra work to secure it. I'll work out the kinks later and do a writeup but what I learned and post the source.

View on HN

Is it hard to validate things server side? From the little I know about the setup it seems like you publish from a client, and it gets pushed out to all clients automatically.

Hopefully there's a way to deny certain publishes from clients, cleanse input, validate etc etc on the server, before it gets relayed to the other clients.

For example the channel '/client_count' should never accept any publishes from outside the server. Wonder how easy that is to adjust.

It does seem pretty nice and responsive though :) Nice job.

Yeah Faye makes it dead simple to set up the channels to communicate on but there doesn't seem to be much in the way of filtering for the channels. I am sure it is something that could be added, but I didn't take the time yet.

Thanks!

Web frameworks/libraries/apps that make correct HTML encoding possible without much fuss are a pleasant surprise on those rare occasions when I encounter them. Web frameworks/libraries/apps that actually do it right knock me over. I don't know of very many examples that even come close.

(This isn't my only metric, but it's a good start: Set a variable to ampersand, then do the basic string output that your template library or whatever has, feeding it that variable. If you get & automatically and have to ask extra hard for a bare ampersand, you've officially gotten me up to "Hey, wow!" That's just one metric I use of many, but making the safe thing easy and the dangerous thing harder is a good start! This knocks out almost every web framework/library/web templating system I've tried.)

Reply on news.ycombinator.com