lloyd / blobastorus Goto Github PK

instead of twitter auth.

Another thing that would be cool would be to have a Blobastorus.onChange(callback) or somesuch, which the client app could use for simple push notifications...

it would be nice for performance and scalability if the only time that HTTPS were required was in sending down user authentication secrets, and if everything else could happen over HTTP. This is a little on the belt and suspenders side of the spectrum, but a 404 over ssl for me takes ~200ms while one over HTTP takes ~100ms to the vm. Two challenges exist in making this happen:

• the /set/ api must be secured with some scheme of signatures and nonces
• the /auth/callback handler must proxy credentials locally into local storage for http://blobastor.us - this can be readily done with conduits and given that this only occurs at authentication time, a little delay is acceptable.

If anyone actually uses the service, it'll probably fall over: we'd probably need to think about:

1. more sophisticated interfacing of mongodb
2. data limits to handle lotsa domains or users
3. more searchy and less listy apis throughout

this is a rollup issue to optimize later.

It would be really nice if it were possible to scope blobastorus storage to a particular sub-key that's defined by the domain, btw. For instance, htmlpad.org and github's gh-pages features don't support creating your own subdomains, but it'd be really nice to be able to host multiple apps on them, even if they're not technically isolated from one another... So being able to say "hey, Blobastorus, get me the 'foo-app' blob for @bob on toolness.github.com!" would be super nice.

(contributed by @toolness)