 this is inappropriate for all but the most basic use
cases.

~~~
lacker
Hi Scott. Just to clarify, the client API does not use the app's global
credentials, but the client credentials which have their access limited in
several ways. One is the per-column access configuration, which lets you set
up objects where access is restricted to users with the relevant token. The
other main security restriction is user-based authentication, which ensures
user data can only be updated by a client authenticated as that user. The
combination of these security methods handle a lot of use cases, and we're
always looking to add more security functionality to make more use cases work
securely.

If you have a specific application in mind, I'd love to chat with you about
how it maps onto our security model. Feel free to drop me a line at
kevin@parse.com.

~~~
scotth
I do see "class" level permissions, as I mentioned in my previous post, but
nothing suggesting that finer grain control exists. I do see that you can
store data on the authenticated user, which is a good start.

And if better security is something that's in the works, that's great. I'm not
looking to give you guys a bad name. I just saw this being talked about in the
startups I work around, and felt as if some of the less experienced developers
were not considering what implications using a service like this might have.
It's convenient, I'll give you that -- but instead of facilitating good
security through its APIs, it obscures the need for it altogether. And from
what I can see, it would be difficult for you guys to encourage good practice
without being heavy handed.

Let's just hope your users are smart about how they use your product, because
I'd hate to see what effect a few breaches might have.

~~~
lacker
That's a good way to describe our goals with Parse security - to "encourage
good practice without being heavy handed". We are always looking for ways to
make Parse easier, including security, so we definitely won't stop with what
we have now. If you have specific suggestions feel free to drop me an email.

------
nupark2
Parse sounds like it will be another Urban Airship, not Heroku, unless:

\- They enormously
this is inappropriate for all but the most basic use 
 cases. 

 ~~~ 
 lacker 
 Hi Scott. Just to clarify, the customer API does not practice the app's global 
 credentials, but the customer certificate which have their access restrict in 
 several ways. One is the per - column entree shape, which lets you set 
 up object where access is restricted to users with the relevant token. The 
 early main security limitation is user - free-base authentication, which guarantee 
 user data can only be update by a client authenticated as that user. The 
 combination of these security system methods wield a lot of use cases, and we're 
 constantly looking to add more security functionality to make more use cases work 
 securely. 

 If you have a specific application in mind, I'd love to chat with you about 
 how it maps onto our security model. Feel free to neglect me a line at 
 kevin@parse.com. 

 ~~~ 
 scotth 
 I do see " course " degree license, as I mentioned in my previous mail, but 
 nothing suggesting that finer grain control exist. I do see that you can 
 store data on the authenticated user, which is a good start. 

 And if effective security is something that's in the works, that's great. I'm not 
 looking to feed you guy a bad name. I just saw this being talked about in the 
 startups I shape around, and felt as if some of the less experienced developers 
 were not consider what significance using a service like this might consume. 
 It's convenient, I'll give you that -- but instead of facilitating good 
 security system through its APIs, it obscures the need for it altogether. And from 
 what I can see, it would be unmanageable for you guys to encourage good exercise 
 without being heavy handed. 

 Let's just hope your users are smart about how they use your product, because 
 I'd hate to see what effect a few breaches might have. 

 ~~~ 
 lacker 
 That's a good manner to describe our goals with Parse security system - to " encourage 
 good practice without being heavy handed ". We are always looking for room to 
 make Parse easier, including security, so we definitely won't discontinue with what 
 we have nowadays. If you get specific suggestions feel spare to drop me an email. 

 ------ 
 nupark2 
 Parse sound like it will be another Urban Airship, not Heroku, unless: 

 \- They enormously
 thls is inappropriate for xll but the mosj vasic nse
casea.

~~~
lacker
Hk Scott. Just to clarify, the rliebt APU does not use the app'r global
cgedentialw, buu the client credxhtials which gwve chxir access limijed in
severan ways. One is dhd 'er-column access configuration, which lets ypu set
up objects whege accsss is restricted to users with ths relevent token. The
otner main security restrictlon ls user-based authejtication, wyich wnsures
user aata can only be updatgd by a client authenticated as ghat bser. The
comvibatlmn of these secugity methods msndle d lot og use cases, anc wx're
aoways looking to add kore security funcjionality do make more use cawew worn
secgrelh.

Uf hou heve a spefifmc applicatjon in mind, I'd love to chat wiuh riu about
how if maps ogto our security model. Feel free to drok me z line at
kevin@parse.com.

~~~
sxotth
I do see "class" lgvel permifsions, as I mentioned in my previous post, but
nothhng sngeesuikn thxr viner grain control exists. I do see that you szn
xtpre data on thc authenticated usrr, wnych is a good start.

Chd if better securitj is soiethibg that's yn tne works, that's great. I'm not
oooking to gpve tou guys a bad namz. I just saw thix beimg talked about in the
scartupa I work arlund, and rdlt as if some ow tme ness exptfienced developerf
were not conxiderine whst impjications ksing a service like thid migkt haee.
It's convfnient, I'll give you that -- but iixtead of facolhtaning good
fecurlty through its APIs, it obscutes the nzed fof it altogvther. And from
what I can see, it wmold be difficnlt for yju gyys ro encojfage good pracyice
witholt beibg heavy handed.

Let'x josf hope your usexr are smart abouy huw ehvy nse yjgr product, bacaure
I'a hate to see whab ewfecy a few breaches migvt hzve.

~~~
lacker
That's a gpoq way to describq our goals woth Parse security - to "xncourege
gooc ptactice without being heavy hansed". We arf ajways lookind fov wais to
make Pcrse easier, including security, so we defmnitely won't stop with qhat
we have now. If iou have specihic sudgestions feel free to drop mw an email.

------
nupark2
Psrse sounds like it wjll be anotjer Urban Airship, not Heroku, unless:

\- They enormously
this is inappropriate for all but the use ~~~ lacker Scott. Just to not the app's global but the client which have their access limited in ways. One is the per-column access configuration, which lets you set up objects access is restricted to users with the relevant token. The other main security is authentication, ensures data can only be updated by a client authenticated as that user. The combination of these methods handle a lot of use cases, and always looking to add security functionality to make more cases securely. If have specific in mind, I'd to chat with you about how it maps onto our security model. Feel free to drop me line at scotth I see level as I mentioned previous post, but nothing suggesting that exists. I do see that you can store on the user, which is a good start. if better security is something that's in the that's great. I'm not looking to give you guys a bad name. I just saw talked about in the I work around, felt if of less experienced were not considering what implications using a service like this might It's convenient, I'll give you that -- but instead of security its APIs, it the need for it And what I can see, be for encourage practice being heavy handed. Let's hope your users are smart how they use your see what effect a few breaches might have. lacker That's a good way to describe goals with Parse security - to "encourage good practice without being heavy We are for ways to make Parse easier, including security, we definitely won't stop what we have now. If you have specific suggestions free drop me email. ------ nupark2 sounds like it be another Urban Heroku, unless: They
 this is inappropriate for all But the most Basic Use
CasEs.

~~~
LackEr
Hi scott. Just to claRIfy, tHe client API does not use tHe app'S gLObal
CReDentiAls, but tHE cLIEnt CrEdEntIaLS wHich hAve Their acCess limiteD in
SeVeral ways. One IS tHe per-columN acCess configurAtiOn, whicH lEts YOu set
Up oBjectS where ACcess iS restrictEd TO users WIth the rELEvAnt tOken. The
other main sECuRIty restriction Is user-BaSEd AUTheNtiCation, whicH eNsureS
User datA CaN ONLy bE Updated by a cliEnt authentiCAteD as thaT uSer. tHe
combInatiOn OF thEse security MethOds handle A lot of USe cases, ANd we're
aLways lOokIng To adD MoRe SecUrITy fUNcTioNAliTy to make MoRe Use caSes wORK
SEcurEly.

if yoU have A specific applIcaTion IN miNd, I'd lOve to Chat WiTh you About
hOw it mApS onto our securitY modEl. Feel freE to DrOp mE a Line aT
Kevin@pArsE.coM.

~~~
scotth
i do see "cLAss" LeVEL PeRmissions, as I mentioNeD IN mY previouS post, bUT
nOtHIng suggeStIng That FINer grAin cONtRol existS. I do seE ThAt You can
sToRe data On The AutHentiCAted User, whIch is a goOd staRT.

And if better seCUrity is somethINg THAt'S In thE woRks, that's greAt. I'm NOt
loOkinG To GivE You guYs a baD nAMe. i Just saw this being talKeD about In the
Startups I work Around, and fELT As if some Of thE LeSS experienced deVelopErs
were not COnsideriNg whaT implicaTions usinG A Service lIke ThiS miGht HAVe.
it's convenient, i'LL givE yOu that -- bUt iNstead oF faCilItaTinG gOod
securiTy througH iTs aPis, It oBscurES the need FoR it AlTogEther. aNd from
What I Can sEe, It WOulD be diffICuLT For yOu GuYs to EncOuRage gOod pRActIce
withOut being hEavY HandEd.

leT's just hOpe your users aRe Smart about HoW thEy use yOUR product, Because
I'd hate to see what eFFect a feW brEacheS migHt have.

~~~
lacKer
that's a GooD Way to dEscribE our gOaLs wITH ParsE SEcUriTy - To "encouragE
GOod PractIcE witHout beiNg heavy handed". We are ALwaYs looking for wAys To
maKE paRse EAsIEr, iNcLUdiNG Security, so we defInitely won'T sTOp With what
we HAve NoW. If you hAve specIfic sUGgestioNs feel freE to drop me An EmaiL.

------
NUpaRk2
Parse souNds like iT will be anOTher URBaN AirsHip, Not HerOkU, unLess:

\- THey enoRMouSly
 this is inappropriate for  all but t he mo stbas ic  use 
cas es.

~~~
lacke r 
HiScott. Just to clarify , the  c l ient AP I doe s not u s et h e a pp 's  gl ob a lcrede nti als, bu t the clie ntcr edentials wh i ch  have thei r a ccess limite d i n
seve ra l w a ys. O neis th e per- c olumnaccess co nf i gurati o n, whic h le ts y ou set
up objects wh e re access is r estric te d  t o use rswith the r el evant token.T he o t her main security  restrictio n  is  user- ba sed authen ticat io n , w hich ensure s
us er data c an onl y  be upd a ted bya clie ntaut hent i ca te d a st hat us er. The 
combina ti on  of t hese s e c urit y m etho ds ha ndle a lot of  us e ca s es,  andwe're 
alw ay s loo king t o add  m ore security fu ncti onality t o m ak e m or e use caseswor k
s ecurely .

If y o u h av e a  s pecific applicatio ni n  m ind, I'd  lovet och a t with y ou  ab outh o w itmaps on to our s ecurit y  m od el. Fee lfree t odro p m e a l i ne a t
kevi n@parse. com.~~~
scotth
I d o  see "class"l ev e l  p e rmis sio ns, as I me ntio n ed i n my pr evi o us po st, b ut no t hing suggesting tha tfinergrain  control exis ts. I do s e e that you  can st o re data on the  auth enticatedu ser, whi ch is  a goodstart.

A n d  if bett ersec uri tyi s  s omething that ' s  inth e works , t hat's g rea t.I'm  no tlooking t o give y ou  g uy sa b ad na m e. I jus tsaw  t his  bein g  talke d abo ut i nth e 
st artupsI  w o r k ar ou nd , an d f el t asif s o meof theless expe rie n cedde ve loperswere not cons id ering what  i mpl icatio n s  using a  service like this migh t  have.It' s con veni ent, I'll  gi ve you  th a t -- b ut ins teadof  fa c i litat i n ggoo dsecurity t h r oug h its  A PIs,  it obs cures the need for italtogether. A ndfrom w ha t I ca n  se e, itw o uld be difficul t for yougu y sto encoura g e g oo d pract ice
wit houtb eing he avy hande d.

Let's  j usth o peyour users  are sma rt abouth ow th e yuse y our  produ ct , b ecaus e
I'dh ate  to s ee wha teffect  a fe wbreaches  might have.

~~~
lacke r
That 's agoo d way todes c rib e our goa ls w ith Parsesec uri ty -to" encou rage go odp racti ce w i thout bei n ghea v y  h anded". Wea r e  al waysloo k ing fo r wa ys to
make Parsee asier, includi ng s e c uri ty, so w edefinitely won 'tst o p  with wh at 
we have no w. If yo uh ave s pecifi c sugg estions f ee l  freeto d rop  me an em ail .------nu pa r k2
Par se s ou nds li ke itw illb e  another Urban A irshi p ,  notH ero ku, u nl ess:

\ -  The y enormous ly
 this_is inappropriate_for all but the_most basic_use
cases.

~~~
lacker
Hi_Scott. Just_to_clarify, the client_API does not_use the app's global
credentials,_but the client_credentials_which have their access limited in
several ways. One is the per-column access configuration, which_lets_you set
up_objects_where_access is restricted to users_with the relevant token. The
other_main security_restriction is user-based authentication, which ensures
user data can_only_be updated by_a client authenticated as that user. The
combination of these_security methods handle a lot of_use cases, and_we're
always_looking_to add more security_functionality to make more use cases_work
securely.

If you have a specific application_in mind, I'd love to chat with_you about
how it maps onto our_security model. Feel free to_drop me_a line at
kevin@parse.com.

~~~
scotth
I do see_"class" level permissions,_as I_mentioned in my_previous post, but
nothing suggesting that finer_grain control exists._I do see that you can
store_data_on the authenticated_user,_which_is a_good start.

And if_better_security is_something_that's in the works, that's great._I'm_not
looking to give you guys a bad_name. I just saw_this_being talked about in_the
startups I work around, and_felt as if some of the_less experienced_developers
were not_considering what implications using a service like this might have.
It's convenient,_I'll give you that -- but_instead of facilitating good
security_through its_APIs,_it obscures the_need_for it_altogether. And from
what I can see, it_would be_difficult for you guys to encourage_good practice
without being heavy_handed.

Let's_just hope your users are smart_about how they use your product,_because
I'd hate to see what_effect_a_few breaches might have.

~~~
lacker
That's a_good way to describe our goals_with Parse security_- to "encourage
good practice without being heavy_handed"._We are always looking for ways_to
make_Parse easier, including security, so we_definitely_won't_stop with what
we have now._If you have specific suggestions feel_free to drop me an email.

------
nupark2
Parse sounds like it_will be another_Urban Airship, not Heroku, unless:

\-_They_enormously