Rule 35: Every year, someone somewhere will reinvent PHP or CGI or some combination of the two.
Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
101–110 of 256 posts
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#102Earlier quoted context omitted.
I don't disagree that this doesn't seem necessarily secure and the auto dependency resolution is a bad idea for other reasons in my opinion, but I don't see the security aspect of it. The moment I can upload files to the application folder that are executed, I can just `require('child_process').spawn("my_evil_stuff", [])`. In particular "my_evil_stuff" could be some npm install command. I don't see how automatically…
Well, for one giving the app the kinds of write permissions needed for this to work is not exactly ideal.
So the app would need write permissions to its own folder. That's obviously a bad idea in a production deployment. I guess I was thinking that the dependencies would be installed during a privileged one-time "deployment run" so you wouldn't need the permissions after. Maybe I'm giving the thing too much credit.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#103> Zero reads credentials from environment variables. Zero also loads variables from .env file in your project root, if it's present. Security nightmare? Can I do myapp.com/.env and read the credentials from the wider internet?
Why would you assume that they have this bug? If you’re actually curious if the bug exists go read the code or try it yourself.
Another common on this page documents this bug on their production website.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#104Weird how does it knows what certificate to get for https
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#105Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#106Earlier quoted context omitted.
> If security is a concern At the risk of being presumptuous... When is security ever not a concern?
Prototyping or proofs of concept
If you're ever running this, and you've left it open to a LAN or the internet, your entire system is vulnerable for use in whatever way someone wants. There are bots looking for stuff like this all the time.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#107Weird how does it knows what certificate to get for https
You probably need nginx in front of this.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#108Earlier quoted context omitted.
Welcome to the world of node.
This is nothing to do with node. This is poor programmer decision making. You can build great node apps with a real minimalist approach. Holding up projects which pull in half of npm as "the world of node" is like holding up a hot and ready 5$ pizza and saying all Italian food is bad.
[deleted]
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#109Earlier quoted context omitted.
This is nothing to do with node. This is poor programmer decision making. You can build great node apps with a real minimalist approach. Holding up projects which pull in half of npm as "the world of node" is like holding up a hot and ready 5$ pizza and saying all Italian food is bad.
I think the point is that this is almost encouraged in the node ecosystem, while in most other language ecosystems I know of it wouldn't be.
Encouraged by who? I see the same people which used to install jQuery or WordPress plugins and were able to get janky but working sites. But prolific module authors and node core contributors don't promote these approaches.
Maybe if you listen too much to twitter "thought leaders" you might get this impression, but we are all aware of the problems with social media platforms...
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#110My God, the people on this thread. There are people out there, working as software "engineers," who think that if they can't personally find a vuln in 5 seconds, the system must be secure. How is this #1 on the site right now?