Hacker News Reader

I made a toy project once shortly after meteor had just been released. I just kept bricking myself that I'd overlook some security setting that would allow people to run arbitrary queries against my DB. When I also looked into scaling I gave up.

Now with the way things have gone with an emphasis on mobile, most sites I'd want to make would be better written as REST-style app servers with pluggable clients.

View on HN

Firstly, your concern about security is completely unfounded; Meteor only allows you to run queries against the database if you write specific ALLOW/DENY rules to let them through. Otherwise, all DB calls go through Meteor methods that are run both on the client (for optimistic updates) and on the server (in a controlled environment). So you let through whatever you choose to let through.

Secondly, Meteor has several modules that allow you to expose Meteor methods as a REST frontend, so it's a trivial change to get that functionality added in.

Reply on news.ycombinator.com