Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

111–120 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#111

Post by SahAssar »

wesleytodd wrote: post #109
SahAssar wrote: post #100

Earlier quoted context omitted.

I think the point is that this is almost encouraged in the node ecosystem, while in most other language ecosystems I know of it wouldn't be.

Encouraged by who? I see the same people which used to install jQuery or WordPress plugins and were able to get janky but working sites. But prolific module authors and node core contributors don't promote these approaches. Maybe if you listen too much to twitter "thought leaders" you might get this impression, but we are all aware of the problems with social media platforms...

Well, considering the amount of dependencies in popular projects like CRA that was highlighted here a few days ago I don't think it's unreasonable to extrapolate to the general ecosystem. Of course there are module authors and devs doing it differently, but in general most node projects I see are more dependency-happy than projects I see in other languages.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#113

Post by wesleytodd »

asadlionpk wrote: post #82
q3k wrote: post #75

Earlier quoted context omitted.

Putting my money where my mouth is - use this to leak any file accessible by the running user of zero from the filesystem: # curl -v --path-as-is 127.0.0.1:3000/../../../../../etc/passwd root:x:0:0:root:/root:/bin/bash [...]

Thanks for pointing this out. Fixed this particular bug!

Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2].

[1] https://github.com/remoteinterview/zero/commit/b4af5325c388e... [2] https://nodejs.org/api/url.html#url_legacy_url_api

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#114

Post by ricardobeat »

joshstrange wrote: post #7

My first thought is it doesn't have enough features or too much magic BUT that is EXACTLY why it shines. I'm not going to build the next FAANG company on this but it will let me get a backend up and running VERY quickly to test out an idea. The number of ideas of mine that have been killed in the cradle by decision paralysis is higher than I would like...

It actually has a ton of magic. This is what's acting as the initial package.json:

https://github.com/remoteinterview/zero/blob/72ea1faaef51b92...

Custom file watcher: https://github.com/remoteinterview/zero/blob/72ea1faaef51b92...

Routing / workers: https://github.com/remoteinterview/zero/blob/72ea1faaef51b92...

Dependencies for using the react renderer: https://github.com/remoteinterview/zero/blob/72ea1faaef51b92...

And so on. The routing part is a bit funny - by spawning a new process per request this is actually very close to PHP/CGI :)

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#115

Post by jlarocco »

beefhash wrote: post #57
jayar95 wrote: post #44

Earlier quoted context omitted.

If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

Is this even a serious question?

Not everything runs online connected to the internet.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#116

Post by CodeMage »

squirrelicus wrote: post #99
wesleytodd wrote: post #81

Earlier quoted context omitted.

Pretty sure student projects should teach you something other than `$ npm install`, no? When I was a hiring manager and scoped out juniors from bootcamps I had a conversation with some candidates and they would say, "I built user registration and login". When I asked them to talk more about it they said, "well I installed auth0"... Any student project which doesn't teach them how something works is not really teachin…

Expecting a student to learn how to code at all, not to mention code well, from an academic/bootcamp setting, is an expensive fool's errand for anyone that hires them. Programming is not academic. It has more in common with plumbing and carpentry and electrician work: you learn only by doing, and you learn how to do it well by doing with critical supervision from a mentor.

That slight wobble in Earth's orbit we're experiencing, that's Dijkstra rolling in his grave.

All joking aside, programming should be treated a lot more like engineering and a lot less like craft. Yes, it does have aspects of both, but neglecting the engineering aspects of it is proving to be increasingly harmful to our end users.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#117

Post by wesleytodd »

SahAssar wrote: post #111
wesleytodd wrote: post #109

Earlier quoted context omitted.

Encouraged by who? I see the same people which used to install jQuery or WordPress plugins and were able to get janky but working sites. But prolific module authors and node core contributors don't promote these approaches. Maybe if you listen too much to twitter "thought leaders" you might get this impression, but we are all aware of the problems with social media platforms...

Well, considering the amount of dependencies in popular projects like CRA that was highlighted here a few days ago I don't think it's unreasonable to extrapolate to the general ecosystem. Of course there are module authors and devs doing it differently, but in general most node projects I see are more dependency-happy than projects I see in other languages.

Give people a useful tool (npm) and they will muck it up. This is both the best and worst part of the general node ecosystem. The issue is people saying things like "that's just node". It is not node, it is the ease of use and popularity meaning there will be more of these examples. If you care to make high quality use of the platform and tools you can, but that means not following the crowd.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#119

Post by SahAssar »

wesleytodd wrote: post #117
SahAssar wrote: post #111

Earlier quoted context omitted.

Well, considering the amount of dependencies in popular projects like CRA that was highlighted here a few days ago I don't think it's unreasonable to extrapolate to the general ecosystem. Of course there are module authors and devs doing it differently, but in general most node projects I see are more dependency-happy than projects I see in other languages.

Give people a useful tool (npm) and they will muck it up. This is both the best and worst part of the general node ecosystem. The issue is people saying things like "that's just node". It is not node, it is the ease of use and popularity meaning there will be more of these examples. If you care to make high quality use of the platform and tools you can, but that means not following the crowd.

Agreed, but for whatever reason it seems more prevalent in the node ecosystem than in others (even when comparing high-profile projects).

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#120

Post by cat199 »

Sephr wrote: post #96
q3k wrote: post #92

Earlier quoted context omitted.

You also need to report this to security@npmjs.com so they post an advisory [1] and mark the existing versions as vulnerable. [1] - https://www.npmjs.com/advisories

Anyone, including yourself can do that.

or, the person who should do it should do it and not rely on others to do their job for them?
Post reply on HN