Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

131–140 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#131

Post by tlrobinson »

joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

I agree people tend to be overly negative on HN about projects like this, but the AFAICT the project does not state any caveats about the security and/or where it should or shouldn't be used.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#132

Post by scrollaway »

asadlionpk wrote: post #45
aboutruby wrote: post #34

Earlier quoted context omitted.

Probably having .htaccess / .env / database configuration / files that are not supposed to be public be exposed. For instance, Rails has a public/ folder for files that are going to be served. And jekyll hides files by pattern-matching them[1]. Zero doesn't seem to have exclude folders by default. The solution would be to run Zero is a subfoler and require file in the parent folder which would act as the tree's root.…

Currently, files starting with _ (underscore) are hidden in zero. This is still a feature spec we need to finalize as this can create confusion. Maybe a .zeroignore file (as suggested in another comment) would be a better idea.

Nextjs uses a pages/ subdirectory which gives you implicit routing, without having to compromise on the whitelist aspect. I think it's a better compromise.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#133

Post by asadlionpk »

coolgoose wrote: post #118

I am so confused why the 'good old days' of php is a good example of how to do application development. Every php framework got away from that for really good mesure, including not having your logic in the server document root.

Easier to create. With a path to scalability if ever needed.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#134

Post by freedomben »

joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often.

There's already a cultural anti-pattern in the js world of just `npm install`ing stuff and shipping to prod without auditing well (I've heard a number of times, "well it has like 60 stars on github").

If the project marketed itself as a "development only" or non-production framework then I'd agree with you 100%. However as it stands it's dangerous and could lead to extreme compromise of a system if it gets deployed to a production environment.

That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#135

Post by tlrobinson »

jlarocco wrote: post #115
beefhash wrote: post #57

Earlier quoted context omitted.

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

Is this even a serious question? Not everything runs online connected to the internet.

But almost everything does. Assumptions like this lead to ~40,000 unsecured MongoDB databases on the public internet [1]

1. https://www.information-age.com/major-security-alert-40000-m...

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#136

Post by wesleytodd »

tlrobinson wrote: post #131
joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

I agree people tend to be overly negative on HN about projects like this, but the AFAICT the project does not state any caveats about the security and/or where it should or shouldn't be used.

I think any user should be responsible for vetting their tech choices. Why would the author put a disclaimer instead of fixing the issues?

In this case, the project is clearly too new/unstable/insecure to use in any real sense. It's presence as #1 on HN says more about the audience than the project itself I think.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#137

Post by dragonwriter »

scottmf wrote: post #124
joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

>People in this thread are way overly negative. That's most of HN these days, and why I never visit anymore.

For someone who doesn't visit, you are a pretty active participant

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#138

Post by tlrobinson »

wesleytodd wrote: post #136
tlrobinson wrote: post #131

Earlier quoted context omitted.

I agree people tend to be overly negative on HN about projects like this, but the AFAICT the project does not state any caveats about the security and/or where it should or shouldn't be used.

I think any user should be responsible for vetting their tech choices. Why would the author put a disclaimer instead of fixing the issues? In this case, the project is clearly too new/unstable/insecure to use in any real sense. It's presence as #1 on HN says more about the audience than the project itself I think.

IMHO a project with a trivial directory traversal vulnerability[1] is not ready for a shiny marketing site like this.

1. https://news.ycombinator.com/item?id=19256230

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#139

Post by joshstrange »

freedomben wrote: post #134
joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of j…

> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO.

Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never production ready". Not sure what the end goals of Zero are. I will say I thought it was pretty evident that this was not for production (if only to the sheer amount of "magic" inside) but maybe that's just me and it should have a disclaimer to that effect.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#140

Post by gumbo »

asadlionpk wrote: post #42
sjroot wrote: post #39

Earlier quoted context omitted.

Check my reply to this comment. The underscore idea was one of the first things to come to mind too, but I think having a specific file makes it clear to others who might not understand Zero internals.

You are right. A .zeroignore file seems like a good idea.

Here we go. Zero conf :-)
Post reply on HN