Datomic in the browser | Hacker News Reader

Datomic in the browser

ragnard.github.io

94 pointsbrucehauman12 comments

I had assumed that "Datomic in the browser" meant an implementation of Datomic that actually runs in the browser (presumably written in ClojureScript, though not necessarily). In fact, this looks more like "[Accessing] Datomic from the browser".

Aside from that, this does look genuinely interesting. I'd like to see more information about how people are using Datomic - I've evaluated it briefly but never saw a good enough reason to move away from familiar relational databases.

Good point, I blame it on my poor english. "Accessing Datomic from the browser" would have been a more appropriate title.

Does this mean exposing the DB server directly to the browser e.g. lan or even internet? This does not sound like a good idea! I must have missed something...

Yes, it does. Dealing with all of the security implications of this -- and there are plenty of tools available to handle it -- are beyond the scope of such a simple article.

No, it doesn't. Not really. The REST server is 'just' another Datomic peer.

Part of the value proposition of Datomic is that what is normally thought of as "the database server" is split into separate processes; the transactor and any number of peers. Peers are safe to put in user-facing applications since if one peer goes down the rest are entirely unaffected.

Sure but you still have to deal with read-access to data. This article does not explain how that might be handled.

True enough; if the REST server doesn't provide the level of access control you need then you'll have to wrap/write your own that does.

It's a query API, no different than any REST API.

But how is authentication and authorisation mapped and passed around and shared between the app server cluster and the db cluster?

There was a post a couple weeks ago about an nginx module atop PosgreSQL providing a REST interface[1]. This is a similar idea but for Datomic and using a REST server that comes bundled with it. Compared to the PG ngnix module, this one has proper handling of bind variables built into the REST api. With a loose CORS policy (the "-o '*') this can be used directly in a user's browser via AJAX requests.

There's obviously a lot of security issues to think about here, the primary one is that without authentication anybody that is network accessible to the server can execute anything. As such, I don't see much production use in exposing something like this though it does look like it could be fun to use.

Funny thing for me was when I first saw the headline I thought it was web browser database client for Datomic, which is what our company does[2] (though for other databases; we don't support Datomic yet). It'd be possible to build something similar atop this API and have it run entirely client side though it'd have the same security issues mentioned above (vs our setup where DB access is done authenticated and done server to server).

[1]: https://news.ycombinator.com/item?id=6109069

[2]: http://www.jackdb.com/

Hi, post author here.

Not all browser based applications are, or need to be exposed to the entire Internet.

If you do want to do that, you obviously need to think about who can access what, but since Datomic provides a HTTP based API, you can use any suitable HTTP based technique to achieve that.

You clearly haven't been following the Node.js (Derby and Meteor) community very closely. They've been exposing raw database APIs (mutation, deletion, insert, the works) since the beginning.

Reply on news.ycombinator.com