6 ms·
Hi HN! I'm Alex, and I've been researching and writing about WebSockets for a while now. I'm the author of the recently released WebSocket Handbook. AMA about t
by AlexTDiaconu 5y ago
Hi HN! I'm Alex, and I've been researching and writing about WebSockets for a while now. I'm the author of the recently released WebSocket Handbook. AMA about the WebSocket tech, the realtime web, Ably or anything related to Liverpool FC.
- lelanthran 5y ago> or anything related to Liverpool FC. Do people still watch football? What are the viewership numbers for Liverpool FC? Does Man United still matter? :-)
- stichers 5y agoMan Utd never mattered. Source: City supporter.
- Ostrogodsky 5y agoWhy does Klopp love to abuse referees and then play dumb?
- mathgladiator 5y agoIt's a good introduction, and it's a good document to introduce the problems induced by WebSockets (which Ably can come in an solve at scale). I recently wrote about the Woes of Websocket: http://www.adama-lang.org/blog/woe-of-websocket http://www.adama-lang.org/blog/woe-of-websocket with an errata based on HN feedback: http://www.adama-lang.org/blog/more-websocket-woe http://www.adama-lang.org/blog/more-websocket-woe The depth of this topic is very interesting, and I'm excited as I'm building some of the final pieces for my SaaS (which could compete with Ably).
- mobilio 5y agoYNWA!
- friendlydog 5y agoWhat is the right way to handle authentication over web sockets?
- JSdev1 5y agoIt's the same thing as HTTP. Websocket starts off as an HTTP request with cookies, headers etc. Use those just like HTTP to authenticate, and your Websocket server should pass the user data to the websocket object
- latch 5y agoDon't have access to the headers from JS. Best solution might be to generate a short-lived one-time-use ticket and pass it in the querystring.
- twic 5y agoIf you make a normal HTTP request first, the server can issue a standard HTTP cookie to the client. That cookie will then be included when the browser makes the websocket request. However, websockets are not subject to the same-origin policy, so this exposes you to CSRF [1]. To protect against that, you should check the Origin header on the server side. [1] https://christian-schneider.net/CrossSiteWebSocketHijacking.html https://christian-schneider.net/CrossSiteWebSocketHijacking....
- simonkagedal 5y agoCookies will be forwarded though, or..?
- z3t4 5y agoIf I understand correctly, websockets is a thin layer on TCP that does buffer data so that the application get the whole message instead of chunks. I recommend using wss to secure the websocket so that it can't be hijacked, then you don't need to send a token in each message and can do an application layer handshake once. Basically the first websock message from the client would be an authentication message with a password, token or what not.
- syspec 5y agoYeah this is the technique I've also used. The first websocket message is the original request, which will have the users cookies / headers where your session information / bearer token should live.
- superasn 5y agoHi! I want to create a web app like Google docs where multiple users can collaborate in real time to edit the document together (using a special link like gdocs generate). I want to save the docs in a MySQL db (no firebase) My questions are: 1) Since multiple people are working together how does one manage conflicts, i.e. 2 people sending different edits simultaneously. 2) If one clients gets disconnected (4g) and then reconnects later how does it sync the changes it made during it was offline? I recently watched this RAFT presentation (1) and I think I would need to use something like this? What other alternatives are viable? Also can I make it happen using just PHP, Javascript and MySQL? Thanks (1) http://thesecretlivesofdata.com/raft/ http://thesecretlivesofdata.com/raft/
- hammersmith 5y agoHave a look at https://m-ld.org/ https://m-ld.org/ , its a CRDT implementation that's all Javascript. it could help
- matt_oriordan 5y agoYup, and it supports Ably too, see https://js.m-ld.org/#ably-remotes https://js.m-ld.org/#ably-remotes! Matt, Ably co-founder
- superasn 5y agoLooks very promising. Thanks for sharing!
- AlexTDiaconu 5y agoBig question! It deserves its own blog post haha. CRDTs can be the answer. We actually wrote about them recently (https://ably.com/blog/crdts-distributed-data-consistency-challenges https://ably.com/blog/crdts-distributed-data-consistency-cha...), and there is more coming soon as our Chief Of Scientist and his team are researching CRDTs and building demos!
- jkarneges 5y agoI made a document editing demo here: https://github.com/fanout/editor https://github.com/fanout/editor It uses operational transformations ("OT") to manage conflicts, and it saves the data in MySQL. Technically any Django DB backend will work for storage, but the public demo instance uses MySQL. One of the reasons I made this thing was to show that realtime apps don't need to require heavy frameworks or unusual databases. And it loads super fast. I don't think you need Raft if you have a central database storing the document. You could also consider using CRDTs instead of OT, which may be more powerful but also more challenging to develop.
- httgp 5y agoIs Ably playing with WebTransport? If it moves up from its current trial status, how do you see that changing Ably’s core?
- matt_oriordan 5y agoWe are monitoring it closely and super excited about what WebTransport will provide, which is both a more reliable and in many cases more performant transport. However, much like WebSockets, it's still quite low level and only provides a basic communication protocol. As such, like we have done with SSE, HTTP, Websockets and MQTT, our service focusses on what developers can enable on top of these lower level transports, such as presence, deltas, history of streams, limitless scale and fan-out of data, and the list goes on https://ably.com/platform https://ably.com/platform. When WebTransport reaches prime time, I'm confident we'll be supporting it.