Hacker News Reader

Hacker News

Comment by janl | Hacker News Reader

Parent Full thread

janl

Hoodie works no different than Gmail. What’s the worst that can happen there?

View on HN

On a related note, how does MailChimp have "confirm subscription" link IN MY GMAIL LIST?

http://cl.ly/image/1o1K2f202T3c

Gmail's "Actions" API.

https://developers.google.com/gmail/actions/reference/one-cl...

It's a Gmail feature called "Actions" and was launched back in 2013:

https://developers.google.com/gmail/actions/actions/actions-...

I'm actually surprised so few companies have implemented it thus far.

Well you sure as shit aren't going to see "hoodie.account.signUp(username, password);" in Gmail's client-side code.

Gmail's code base is not a "offline first, mobile first" platform. The API that is exposed to the client-side is fairly light (watch the traffic).

I highly suggest use research "business logic flaws" in web apps. Anything Jeremiah Grossman has said on this topic is good stuff.

They have frontend code that will talk to /singup or whatever the route for creating an account is. Hoodie does nothing different.

Thanks for the pointer to Jeremiah, though :)

Can you give an example for why that signup code is bad? In the case that I'm using Hoodie with CouchDB, wouldn't Hoodie just AJAX post a user document to the CouchDB _users database (which is a good implementation)? All of the access control would be in the hands of the server with minimal (if any at all) security logic in the front end.

Yeah, but you're going to see a <form> that POSTs to some target URL, with username and password as fields. The only thing protecting the plaintext password from leaking is SSL. POSTing a XmlHttpRequest is equivalent.

the signup seems to be handled by couchdb.

The difference is server-side validation of untrusted client requests.

Hoodie does server-side validation of untrusted data.

Not yet. https://github.com/espy/hoodie-plugin-tutorial

"This document describes functionality and features that don't exist yet."

I’m a Hoodie developer, I know what Hoodie does and doesn’t. That disclaimer is just there because some of the things don’t yet work as documented. The particular feature is definitely in existence :)

There, I fixed it :)

https://github.com/espy/hoodie-plugin-tutorial/pull/13

How is one of the first apps to popularize AJAX, developed on top of a proprietary cross-compiling framework by a top-3 web giant "no different" from Hoodie? Obviously you're getting at some specific point that is completely obscured by the ridiculousness of the comparison. Hopefully it's more than "client-side logic can be useful" because that much is obvious on its face. It's also obvious that the idealized promise of no-backend falls apart pretty quickly for a majority of real world apps. So what is your point exactly?

Sorry, from “delivering business logic to the client” perspective, Hoodie is no different in concept on that angle. Lots of things are very different, of course :)

Reply on news.ycombinator.com