Hacker News Reader

Comment by bontaq | Hacker News Reader

Made because I couldn't find a simple, no-sign-up service to sync a list of names for a command line tool. And resubmitted because yesterday I goofed and the curl commands listed didn't point to the right location, which really took the fun out of it.

Favorite part of the project: trying out Phoenix's built in pub sub + live view (the live view subscribes to a data/:id topic, which the api write endpoint publishes to) to get that nice instant update on write if you have the data open in the browser without polling.

It's also fun to see how fast it syncs multiple browser windows watching the same data when you edit it in one window. That's not useful, but I give it 1 "neat".

View on HN

Hey, if you ever wanted to come on my podcast to talk about your tech stack (how it was developed, deployed, lessons learned, etc.) I'd love to have you on.

There's a few Phoenix episodes out currently, but none are using Live View yet. It would be really fun to talk about how someone is using it in production.

If you do, head over to https://runninginproduction.com/ and click the "become a guest" button on the top right to get the ball rolling.

That's pretty cool! Are you doing anything like rate-limiting to prevent abuse?

Thanks 8), rate limiting is just the most basic of nginx configs to like, 10 requests / second / ip

Oh nice, that sounds simple enough.

Really simple cool! One minor thing on the IP rate limiting side.... LOTS of mobile/cell users might end up NAT'ed behind a single IP. Just an FYI.

That's a good point. How does one rate limit correctly in that case?

I don't think it's possible to correctly rate limit IPs behind NAT, at least with NGINX.

> Note that IP addresses can be shared behind NAT devices, so limiting by IP address should be used judiciously.

https://docs.nginx.com/nginx/admin-guide/security-controls/c...

Rate limiting by data UUID might actually be pretty effective. I should add that to patchbay.pub.

That might be an issue if someone is using it to deliver lets say settings json and multiple users try to request the file.

wellllll there's no GREAT answer. Usuallllllyyy this is why some lightweight authentication is a good idea? Some kind of TGT/token scheme, and then rate limit based on that? But does make it all a little less "just works"

Reply on news.ycombinator.com