What do you think of allow/deny collection methods return false as default?

[gabrielhpugliese]

People can forget to change them.
And I think scaffolding only the allow method sufficient. I usually add deny methods in very specific parts of my project.

[lirbank]

Just realized the default allow/deny rules allows anyone full write access to the DB. I totally assumed it was the opposite. Having these rules is like adding the "insecure" package twice...

I vote for changing this. It should be locked down by default and then the developer can gradually open up access as needed.

My take is, while Meteors 'insecure' package is for playing around and get an app up and running quickly, I think by the time a developer start to use/need EM it is probably already writing production code. And thus the first thing you do is to remove insecure and autopublish. My 2 cents.

[gabrielhpugliese]

👏