PouchDB, the In-Browser Database That Replicates | Hacker News Reader

PouchDB, the In-Browser Database That Replicates

cloudant.com

79 pointsmbroberg35 comments

Nice to see some good discussion about PouchDB, cheers for all the thanks as well but just wanted to make sure the credit goes where its due, PouchDB is a fairly small project that I do in my (rare) spare time, but it has 55 contributors who very much make it the project it is

https://github.com/daleharvey/pouchdb/graphs/contributors

I'm surprised more people haven't heard of PouchDB, so good on Cloudant for donating buzz to an excellent FOSS project. And thanks again, Dale Harvey, for being a fscking genius. :)

My boss tells me I'll be making a whole private document management & CRM around it and CouchDB, and that's my fault for showing them to him.

I'm just getting interested in CouchDB and PouchDB. I almost jumped out of my chair when I found PouchDB earlier this week. So brilliant!

Will you be sharing your development experiences somewhere? It seems there is less info out there compared to, say, Mongo.

As much as possible, yes -- my employer has only recently gotten into sponsoring FOSS, so I have to do a lot of comforting around the, "but what if someone else takes this and copies us" question. Which is fair: They (still) don't teach FOSS community balancing in MBA school. In fact, I just made the term 'community balancing' up, but only because we both know there should be one, and isn't.

So many kudos to Dale Harvey for driving this incredible project. CouchDB's concept of replication is itself mind-blowing, but PouchDB bringing that to the {app,client}-layer opens up untold possibilities for robust, distributed systems.

Apparently Cloudant is a couch-compatible cloud-scale database. It would be nice if they mentioned this somewhere on their site, especially after having named their product PouchDB.

A question that remains unanswered for me is how do they go about storing the local data in the browser? Do they use local storage? Are there size limits? What's reliability like?

http://pouchdb.com/faq.html addresses many of these questions.

> especially after having named their product PouchDB.

Ah, PouchDB isn't our product. It's just something super awesome that we want to support and promote. In fact, it's built by Dale Harvey, who works at Mozilla.

Disclosure: I'm a developer at Cloudant.

As far as I know, cloudant's product is BigCouch which was a fork of CouchDB but has recently been merged back in:

https://blogs.apache.org/couchdb/entry/welcome_bigcouch

Cloudant is a hosted, managed, distributed database as a service. We're based on CouchDB, but then added clustering, then full-text search, and -- coming soon -- geo-indexing :D

BigCouch, and the clustering abilities that we're merging back into CouchDB, are open-source artifacts of the work we do on the core product. The open-source community gave us so much, and we love giving back :D

Ah, thanks for clarifying!

And I think it's great that BigCouch is being merged back into CouchDB. I'm just getting interested in CouchDB and PouchDB and it seems these projects deserve the love.

How does this handle security? Sending data directly into a database from the browser with no application layer sounds a bit scary.

If you look at their demo code it has a username and password right in the javascript source - as you would expect - which means keen users could do all kinds of things.

Aye, which is why putting your administrative credentials in client-side JavaScript is an unspeakably bad idea.

Instead, serve {client,user}-specific keys from the server on request, or let the user generate them through a signin process in the frontend, say by using the _users database that CouchDB and Cloudant allow.

Yes. But it is demo code, meaning that the use case isn't production, it's education. And the UX of education is a lot worse when you have to begin by saying, "this will look different from yours" and "here's a whole extra layer of complication I'm going to introduce, but don't worry it's a best practice."

Exactly, the username / password combination is most certainly to make life simpler for a demo, would never expect someone to do that in real code.

I plan on extending the getting started tutorial with an extention that does a database oer user when logged in (via persona), it actually wont make the tutorial much more complex and gets very close to what it should look like in production (https://github.com/daleharvey/couch-persona)

It's supposed to be used with one db per user for a subset of data I think, in which case security would not matter much.

Think of it like this:

1. Any application layer is in effect a transform, with security and sanity constraints, on user input.

2. There is at least the degenerate case where user input does not need to be transformed, only constrained

3. And about those constraints. CouchDB requires you write a validation function, and it lives inside the database, again obviating the need for that logic in the application layer.

4. What was your anxiety again?

"CouchApps" have worked like this for at least four years ... they've been replaced by erica[1] which is described at: https://github.com/benoitc/erica. It's broadly compatible with BigCouch.

And this is why your database server needs row-level security

Ask and you may receive. Stay tuned.

PouchDB is optimized for the use case of one database per user, a logged in user has full access to a specific database that only they have access to (for shared data access you can use replication on the server side)

According to the FAQ in FF it's using IndexedDB, what's it using in Chrome/Opera/IE? LocalStorage?

Also, what do you do about FF's seeming need to pluralize all store names, default out-of-order keys, and clear cache issue?

edit for clarity

Your first question is answered here, under "Browser Support": http://pouchdb.com/learn.html

for question 1: Chrome, Opera and IE (10) all use IndexedDB as does most other browsers , a few other browsers (android and safari I believe) fallback to WebSQL.

as for question 2, I'm not aware of any FF issues in that regard aka I have no idea what your talking about, link?

PouchDB will also sync with Couchbase Sync Gateway. We use PouchDB as part of the load-generator cluster for performance testing. http://www.couchbase.com/communities/couchbase-sync-gateway

There are more and more things that can sync this awesome JSON HTTP protocol. http://syncable.org/

Thanks Dale!

And jchris jumps in with the couchbase marketing, love it. You're right, though, about how rad it is that so many things speak the Apache CouchDB replication protocol. I'm eager to hear Max talk more about syncable because I thought that may be a more minimal protocol for sync than the full Couch dance.

I was immediately struck by the scary thing of putting the password in the URL:

    remote = 'https://USERNAME:PASSWORD@USERNAME.cloudant.com/DATABASE'

I know HTTPS URLs are encrypted, but it still strikes me as unsafe. What does HN think?

This is demo code. See this comment: https://news.ycombinator.com/item?id=6612482

But it can work with cookie authentication with just a little more lines of code.

Does it store data serialized or in object form? I am not sure how JS reacts to a few millions objects.

It stored plain objects, they are persisted to disk so memory shouldnt really be a concern, it uses idb in firefox / chrome, websql in others (or leveldb in node)

I use pouchdb with pouchappy.com. Excellent combination.

Does it have any offline-storage capabilities?

Yep! It replicates your remote database to a local store (IndexedDB on the browser, LevelDB in Node.js), so that losing connection doesn't stop your app. When you regain connection, it continues replicating as normal.

Sweet.

Reply on news.ycombinator.com