You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by Lena Reinhard <le...@thehoodiefirm.com> on 2015/01/12 15:37:58 UTC
[NEWS] Your links for the CouchDB Weekly News
Hi everyone,
and we’re back – with the first issue of the CouchDB Weekly News, now with a regular release on Tuesdays, to work together closely with our AdvocateHub tasks.
If you want to submit a link for this week’s news (@CouchDB Day organisers, I’m also looking at you :) ), please send it to this thread until tuesday, January 13, 1pm CET.
I’m looking forward to this year’s work on CouchDB, and to continuing the great work with you all.
Best,
Lena
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Laura Dawson <in...@makeyouthink.com>.
Thank you Lena :)
Laura Dawson
MakeYouThink
Communications Manager
ldawson@makeyouthink.com
www.makeyouthink.com
1-888-928-4465
On 2015-01-17 8:26 AM, Lena Reinhard wrote:
> Hello Laura,
>
> if you want to unsubscirbe from the user@ mailling list, please send an
> email from your subscribed email address to
> user-unsubscribe@couchdb.apache.org.
> In case you're interested in helping with CouchDB's marketing, maybe you
> want to subscribe to our marketing email address (
> http://couchdb.apache.org/#mailing-lists) :)
>
> Best,
> Lena
>
> On 17 January 2015 at 13:15, Laura Dawson <in...@makeyouthink.com> wrote:
>
>> Hello Lena,
>>
>> I would like to request to have my email removed from the
>> user@couchdb.apache.org mailing list as I do not have the technical
>> skills or ability to understand the threads and it is filling up my inbox.
>>
>> Please advise.
>>
>> Sincerely,
>> Laura Dawson
>> ldawson@makeyouthink.com
>>
>>
>> On 2015-01-12 9:37 AM, Lena Reinhard wrote:
>>
>>> Hi everyone,
>>>
>>> and we’re back – with the first issue of the CouchDB Weekly News, now
>>> with a regular release on Tuesdays, to work together closely with our
>>> AdvocateHub tasks.
>>>
>>> If you want to submit a link for this week’s news (@CouchDB Day
>>> organisers, I’m also looking at you :) ), please send it to this thread
>>> until tuesday, January 13, 1pm CET.
>>>
>>> I’m looking forward to this year’s work on CouchDB, and to continuing the
>>> great work with you all.
>>>
>>> Best,
>>> Lena
>>>
>>
>
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Lena Reinhard <le...@thehoodiefirm.com>.
Hello Laura,
if you want to unsubscirbe from the user@ mailling list, please send an
email from your subscribed email address to
user-unsubscribe@couchdb.apache.org.
In case you're interested in helping with CouchDB's marketing, maybe you
want to subscribe to our marketing email address (
http://couchdb.apache.org/#mailing-lists) :)
Best,
Lena
On 17 January 2015 at 13:15, Laura Dawson <in...@makeyouthink.com> wrote:
> Hello Lena,
>
> I would like to request to have my email removed from the
> user@couchdb.apache.org mailing list as I do not have the technical
> skills or ability to understand the threads and it is filling up my inbox.
>
> Please advise.
>
> Sincerely,
> Laura Dawson
> ldawson@makeyouthink.com
>
>
> On 2015-01-12 9:37 AM, Lena Reinhard wrote:
>
>> Hi everyone,
>>
>> and we’re back – with the first issue of the CouchDB Weekly News, now
>> with a regular release on Tuesdays, to work together closely with our
>> AdvocateHub tasks.
>>
>> If you want to submit a link for this week’s news (@CouchDB Day
>> organisers, I’m also looking at you :) ), please send it to this thread
>> until tuesday, January 13, 1pm CET.
>>
>> I’m looking forward to this year’s work on CouchDB, and to continuing the
>> great work with you all.
>>
>> Best,
>> Lena
>>
>
>
--
—
Lena Reinhard
Geschäftsführerin
The Neighbourhoodie Software GmbH
Adalbertstr. 7-8, 10999 Berlin
Amtsgericht Charlottenburg, HRB 157851 B
Geschäftsführung: Jan Lehnardt, Lena Reinhard
neighbourhood.ie
Twitter: twitter.com/ffffux
The Hoodie Blog: blog.hood.ie
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Laura Dawson <in...@makeyouthink.com>.
Hello Lena,
I would like to request to have my email removed from the
user@couchdb.apache.org mailing list as I do not have the technical
skills or ability to understand the threads and it is filling up my inbox.
Please advise.
Sincerely,
Laura Dawson
ldawson@makeyouthink.com
On 2015-01-12 9:37 AM, Lena Reinhard wrote:
> Hi everyone,
>
> and we’re back – with the first issue of the CouchDB Weekly News, now with a regular release on Tuesdays, to work together closely with our AdvocateHub tasks.
>
> If you want to submit a link for this week’s news (@CouchDB Day organisers, I’m also looking at you :) ), please send it to this thread until tuesday, January 13, 1pm CET.
>
> I’m looking forward to this year’s work on CouchDB, and to continuing the great work with you all.
>
> Best,
> Lena
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Ingo Radatz <in...@berlin.de>.
Hi,
i will drive by car (VW Touran) from Berlin to Hamburg to the CouchDB Day. I can offer
* 4 regular seats and
* 2 at a not-so-comfortable-but-acceptable third seat row
It's free to attend - a Käsebrot for the driver would be nice. I will come back to Berlin the same day (Maybe around midnight or so? I know there is a party scheduled but, you know, i have children).
Best, ingo
> On 12 Jan 2015, at 16:23, Andy Wenk <an...@apache.org> wrote:
>
> Hey Lena,
>
> happy new year :D. I have
>
> * http://hood.ie/blog/travel-grants-for-couchdb-day.html
>
> and maybe you can mention, that the schedule is made public for the CouchDB
> Day at http://day.couchdb.org and we have some tickets left.
>
> I also plan to write a blog post about the day. What would be the best day
> to release it?
>
> All the best
>
> Andy
>
>
> On 12 January 2015 at 15:37, Lena Reinhard <le...@thehoodiefirm.com> wrote:
>
>> Hi everyone,
>>
>> and we’re back – with the first issue of the CouchDB Weekly News, now with
>> a regular release on Tuesdays, to work together closely with our
>> AdvocateHub tasks.
>>
>> If you want to submit a link for this week’s news (@CouchDB Day
>> organisers, I’m also looking at you :) ), please send it to this thread
>> until tuesday, January 13, 1pm CET.
>>
>> I’m looking forward to this year’s work on CouchDB, and to continuing the
>> great work with you all.
>>
>> Best,
>> Lena
>
>
>
>
> --
> Andy Wenk
> Hamburg - Germany
> RockIt!
>
> GPG fingerprint: C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588
>
> https://people.apache.org/keys/committer/andywenk.asc
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Akshat Jiwan Sharma <ak...@gmail.com>.
Thank you for proofreading this Alexander :) I added all of your comments
as notes to the original. Check it out
http://www.staticshin.com/programming/what-does-_security-secure-in-couchdb/
On Tue, Jan 13, 2015 at 10:06 AM, Alexander Shorin <kx...@gmail.com> wrote:
> On Tue, Jan 13, 2015 at 7:11 AM, Akshat Jiwan Sharma
> <ak...@gmail.com> wrote:
> >
> http://www.staticshin.com/programming/what-does-_security-secure-in-couchdb/
>
> > Every _security document consists of two mandatory fields called admins
> and members.
>
> They aren't mandatory at all, just the ones which CouchDB handles in
> special way and requires them to have special structure.
>
> > The name in an admin or a member property must be the name of the user
> stored in _users database.
>
> The "must" is too strong requirement. The name must be string, but it
> should point on some user name, which even may not be existed at all.
> However, this is a security leak in this case.
>
> > When couchdb authenticates a user from the _users database it can run
> checks against the _security document of each database to determine whether
> the authenticated user is an admin or a member.
>
> When user requests database or any it subresource, CouchDB check his
> context (userCtx - a user name and list of their roles) against
> database _security.
>
> > The roles property on the other hand is free form--- meaning you can
> supply any value in the roles array.
>
> Any string value. In 1.3.0 we'd dropped support of non-string roles.
> That was bad hack.
>
> > An admin is authorized to perform CRUD on _design and _security
> documents.
>
> And run any IO-related tasks on database they admins, like compaction,
> running temporary views and views indexes cleanup.
>
> > A member can only read or write normal documents--- all documents except
> _design and the _security documents.
>
> Members can read design documents, but no modify the. Same about _security
> one.
>
> > Once you add a _security to the database then the database can only be
> accessed by the person who is a part of the _security document. Any
> unauthorized person would be forbidden from accessing the database.
>
> Once you specify database members it becomes only accessible to those
> users or users with specified roles in additional to admin. Those who
> specified in admins grants a power to run IO operations upon database,
> manage _security and design documents.
>
> > The conclusion is pretty easy to draw. couchdb offers minimal read level
> security on the normal documents (that is all documents except the special
> _design and _security documents).
>
> Same is above. _security members controls global database read bit;
> _security admins controls exec bit for service operations and write
> bit for design docs and security.
>
> > You can add conditional checks on who creates, updates or deletes a
> document using document update functions.
>
> Correction: using validate document update functions. The update
> functions is a little bit different thing:
> http://docs.couchdb.org/en/latest/couchapp/ddocs.html#update-functions
>
>
> --
> ,,,^..^,,,
>
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Alexander Shorin <kx...@gmail.com>.
On Tue, Jan 13, 2015 at 7:11 AM, Akshat Jiwan Sharma
<ak...@gmail.com> wrote:
> http://www.staticshin.com/programming/what-does-_security-secure-in-couchdb/
> Every _security document consists of two mandatory fields called admins and members.
They aren't mandatory at all, just the ones which CouchDB handles in
special way and requires them to have special structure.
> The name in an admin or a member property must be the name of the user stored in _users database.
The "must" is too strong requirement. The name must be string, but it
should point on some user name, which even may not be existed at all.
However, this is a security leak in this case.
> When couchdb authenticates a user from the _users database it can run checks against the _security document of each database to determine whether the authenticated user is an admin or a member.
When user requests database or any it subresource, CouchDB check his
context (userCtx - a user name and list of their roles) against
database _security.
> The roles property on the other hand is free form--- meaning you can supply any value in the roles array.
Any string value. In 1.3.0 we'd dropped support of non-string roles.
That was bad hack.
> An admin is authorized to perform CRUD on _design and _security documents.
And run any IO-related tasks on database they admins, like compaction,
running temporary views and views indexes cleanup.
> A member can only read or write normal documents--- all documents except _design and the _security documents.
Members can read design documents, but no modify the. Same about _security one.
> Once you add a _security to the database then the database can only be accessed by the person who is a part of the _security document. Any unauthorized person would be forbidden from accessing the database.
Once you specify database members it becomes only accessible to those
users or users with specified roles in additional to admin. Those who
specified in admins grants a power to run IO operations upon database,
manage _security and design documents.
> The conclusion is pretty easy to draw. couchdb offers minimal read level security on the normal documents (that is all documents except the special _design and _security documents).
Same is above. _security members controls global database read bit;
_security admins controls exec bit for service operations and write
bit for design docs and security.
> You can add conditional checks on who creates, updates or deletes a document using document update functions.
Correction: using validate document update functions. The update
functions is a little bit different thing:
http://docs.couchdb.org/en/latest/couchapp/ddocs.html#update-functions
--
,,,^..^,,,
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Akshat Jiwan Sharma <ak...@gmail.com>.
Hi Lena, Andy and everyone,
Good to have you back. Hope it's not too late for the submission of news.
First couchdb hit 2000 stars on github! Benjamin Anderson takes the honours
:)
https://github.com/apache/couchdb/stargazers
and I have a new post to submit
http://www.staticshin.com/programming/what-does-_security-secure-in-couchdb/
As always if there is any mistake let me know.
On Mon, Jan 12, 2015 at 8:53 PM, Andy Wenk <an...@apache.org> wrote:
> Hey Lena,
>
> happy new year :D. I have
>
> * http://hood.ie/blog/travel-grants-for-couchdb-day.html
>
> and maybe you can mention, that the schedule is made public for the CouchDB
> Day at http://day.couchdb.org and we have some tickets left.
>
> I also plan to write a blog post about the day. What would be the best day
> to release it?
>
> All the best
>
> Andy
>
>
> On 12 January 2015 at 15:37, Lena Reinhard <le...@thehoodiefirm.com> wrote:
>
> > Hi everyone,
> >
> > and we’re back – with the first issue of the CouchDB Weekly News, now
> with
> > a regular release on Tuesdays, to work together closely with our
> > AdvocateHub tasks.
> >
> > If you want to submit a link for this week’s news (@CouchDB Day
> > organisers, I’m also looking at you :) ), please send it to this thread
> > until tuesday, January 13, 1pm CET.
> >
> > I’m looking forward to this year’s work on CouchDB, and to continuing the
> > great work with you all.
> >
> > Best,
> > Lena
>
>
>
>
> --
> Andy Wenk
> Hamburg - Germany
> RockIt!
>
> GPG fingerprint: C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588
>
> https://people.apache.org/keys/committer/andywenk.asc
>
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Andy Wenk <an...@apache.org>.
Hey Lena,
happy new year :D. I have
* http://hood.ie/blog/travel-grants-for-couchdb-day.html
and maybe you can mention, that the schedule is made public for the CouchDB
Day at http://day.couchdb.org and we have some tickets left.
I also plan to write a blog post about the day. What would be the best day
to release it?
All the best
Andy
On 12 January 2015 at 15:37, Lena Reinhard <le...@thehoodiefirm.com> wrote:
> Hi everyone,
>
> and we’re back – with the first issue of the CouchDB Weekly News, now with
> a regular release on Tuesdays, to work together closely with our
> AdvocateHub tasks.
>
> If you want to submit a link for this week’s news (@CouchDB Day
> organisers, I’m also looking at you :) ), please send it to this thread
> until tuesday, January 13, 1pm CET.
>
> I’m looking forward to this year’s work on CouchDB, and to continuing the
> great work with you all.
>
> Best,
> Lena
--
Andy Wenk
Hamburg - Germany
RockIt!
GPG fingerprint: C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588
https://people.apache.org/keys/committer/andywenk.asc
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Andy Wenk <an...@apache.org>.
Hey Lena,
happy new year :D. I have
* http://hood.ie/blog/travel-grants-for-couchdb-day.html
and maybe you can mention, that the schedule is made public for the CouchDB
Day at http://day.couchdb.org and we have some tickets left.
I also plan to write a blog post about the day. What would be the best day
to release it?
All the best
Andy
On 12 January 2015 at 15:37, Lena Reinhard <le...@thehoodiefirm.com> wrote:
> Hi everyone,
>
> and we’re back – with the first issue of the CouchDB Weekly News, now with
> a regular release on Tuesdays, to work together closely with our
> AdvocateHub tasks.
>
> If you want to submit a link for this week’s news (@CouchDB Day
> organisers, I’m also looking at you :) ), please send it to this thread
> until tuesday, January 13, 1pm CET.
>
> I’m looking forward to this year’s work on CouchDB, and to continuing the
> great work with you all.
>
> Best,
> Lena
--
Andy Wenk
Hamburg - Germany
RockIt!
GPG fingerprint: C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588
https://people.apache.org/keys/committer/andywenk.asc
Re: [NEWS] Your links for the CouchDB Weekly News
Posted by Andy Wenk <an...@apache.org>.
Hey Lena,
happy new year :D. I have
* http://hood.ie/blog/travel-grants-for-couchdb-day.html
and maybe you can mention, that the schedule is made public for the CouchDB
Day at http://day.couchdb.org and we have some tickets left.
I also plan to write a blog post about the day. What would be the best day
to release it?
All the best
Andy
On 12 January 2015 at 15:37, Lena Reinhard <le...@thehoodiefirm.com> wrote:
> Hi everyone,
>
> and we’re back – with the first issue of the CouchDB Weekly News, now with
> a regular release on Tuesdays, to work together closely with our
> AdvocateHub tasks.
>
> If you want to submit a link for this week’s news (@CouchDB Day
> organisers, I’m also looking at you :) ), please send it to this thread
> until tuesday, January 13, 1pm CET.
>
> I’m looking forward to this year’s work on CouchDB, and to continuing the
> great work with you all.
>
> Best,
> Lena
--
Andy Wenk
Hamburg - Germany
RockIt!
GPG fingerprint: C044 8322 9E12 1483 4FEC 9452 B65D 6BE3 9ED3 9588
https://people.apache.org/keys/committer/andywenk.asc