Ameo – Redis-compatible distributed key-value store with WebSocket API | Hacker News Reader

Ameo – Redis-compatible distributed key-value store with WebSocket API

marianoguerra.org

40 pointsnetworked14 comments

Cool. I implemented a similar toy project once, to directly expose a database on the server to the client via web socket. I say “toy” because that’s obviously incredibly insecure.

What are the security considerations here? If you have multiple clients, should their topics be isolated? Presumably Alice should not be able to run a DEL command on a topic owned by Bob. Where would you put code for authentication / ACL?

There are a couple projects that solve this by adding a rules engine that manages ACL.

https://deepstreamhub.com https://crossbar.io

We solved this by actually enabling P2P user accounts that secure the data and permissions through cryptographic signatures! https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi...

This means the servers themselves can't even middleman the data.

> I say “toy” because that’s obviously incredibly insecure.

I trust postgres row-level access control a lot more than a php script with dbowner access to the db - so I think this depends a lot on which db, and what "direct access" means...

True. This was a college project years ago but recently I’ve been thinking about revisiting it. With properly provisioned DB users, ACLs, and stored procedures, it could actually end up being more secure than it would be with an intermediary application server.

the idea is to expose the websocket api to the public (for now only subscribe) and the redis api only to internal servers so they can publish/subscribe.

Cool!

I built CurioDB a while back with the same idea, but using Akka as the underlying framework. Persistent Redis with distributed transactions, embedded Lua and a websocket front-end:

https://github.com/stephenmcd/curiodb

Is ameo related in any way to altayanta?

linguistically yes, in any other way, I have no idea :)

Isn't WebSocket dead and buried, replaced by HTTP/2?

I hadnt heard this - after a bit of digging it looks like SSE + http/2 will replace a lot of the same use cases, but the consensus seems to be no: https://stackoverflow.com/questions/28582935/does-http-2-mak...

Interesting thought though - I think more options there will be better in the long run, as long as it a "both" instead of an "either/or".

The title and article read like they were generated by a buzzword generator.

Submitted title was "Ameo – Redis-compatible distributed KV store on riak_core with WebSocket API"

maybe, it's hard to write a meaningful title that describes the thing and it's still understandable.

but all the technologies are used and for a good reason, no "throw technologies, mix it and see what comes out".

Reply on news.ycombinator.com