Mailing-List: contact couchdb-user-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: couchdb-user@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of jchris@gmail.com designates
 74.125.46.155 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=qABwkFoe8eIig53dJ1Ge4UXRtFphYWgNeAFszTGh5s5Zy+lSGSLeMeVWbJU+MXn6dS
         /nzQFknd2GziLazXBKEFm6nxp6GxGHNjCP/eZazcUEok+tWG2T6PL0wlh1LhHVVq4kko
         aui3d4rdSD5885JBgXp01wTPQYedJ0f2BZAtg=
Message-ID: <e282921e0811102122o73eea8a3x178b4a8814f57c4f@mail.gmail.com>
Date: Mon, 10 Nov 2008 21:22:51 -0800
From: "Chris Anderson" <jchris@apache.org>
Sender: jchris@gmail.com
To: couchdb-user@incubator.apache.org
Subject: Re: action servers
In-Reply-To: <64a10fff0811102016i4fd830a6yfaacf4365346b2d7@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <64a10fff0811101758g33973bbau1fff53f4c789f11e@mail.gmail.com>
	 <e2111bbb0811101904y42d740ay154b00786120999b@mail.gmail.com>
	 <64a10fff0811101928q36c862fayb5532f92be342467@mail.gmail.com>
	 <e282921e0811101942w784afee2y7094618b6990b500@mail.gmail.com>
	 <64a10fff0811102016i4fd830a6yfaacf4365346b2d7@mail.gmail.com>

On Mon, Nov 10, 2008 at 8:16 PM, Dean Landolt <dean@deanlandolt.com> wrote:
> Are there any other security concerns in that light?
> I've left my instance wide for a few friends to play with -- perhaps I
> should have asked this earlier.

All I can think of is that we're only as safe as the couchjs sandbox.
Which is probably safe, but you can send arbitrary http requests with
action servers (and even from views if you are psycho) so there's
always the danger of abuse from people who can edit design docs.


> But yeah, if I squash the unobtrusive thing I'll probably only
> need an action for periodic feed updates

As long as you don't care about Google or people who haven't updated
their browser in 3 years, there's no reason to be creating dynamic
html.

> I already tried it -- I couldn't help myself. An hour ago all I got was a
> black screen -- now I see some action down below (other than the tweet form
> everything gets cut off on Firefox Ubuntu Hardy).

Yeah that's a not very fun failure mode. I should at least put up
"you're not alone" screen for when that happens. I'm still not sure
the cause of it. The Twitter API is a little flaky, so who know's what
role it plays here.


-- 
Chris Anderson
http://jchris.mfdz.com