Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

141–150 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#141

Post by insulfrable »

joshstrange wrote: post #139
freedomben wrote: post #134

Earlier quoted context omitted.

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of j…

> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO. Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never pr…

Maybe security people are getting tired of inconsiderate developers that keep shipping bazillions of insecure packages all over mission critical applications.

Devs need to change their culture. This behavior is actively harming end-users through repeated data breaches.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#142

Post by hombre_fatal »

wesleytodd wrote: post #113
asadlionpk wrote: post #82

Earlier quoted context omitted.

Thanks for pointing this out. Fixed this particular bug!

Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2]. [1] https://github.com/remoteinterview/zero/commit/b4af5325c388e... [2] https://nodejs.org/api/url.html#url_legacy_url_api

A simpler fix might be to canonicalize (i.e. no "..") the public folder path and the requested file path and then ensure the public path is a prefix of the other.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#143

Post by joshstrange »

insulfrable wrote: post #141
joshstrange wrote: post #139

Earlier quoted context omitted.

> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO. Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never pr…

Maybe security people are getting tired of inconsiderate developers that keep shipping bazillions of insecure packages all over mission critical applications. Devs need to change their culture. This behavior is actively harming end-users through repeated data breaches.

Do you honestly think it is developer's "inconsiderate" behavior that the root cause or even a main factor in the "repeated data breaches"?

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#144

Post by Vinnl »

marcrosoft wrote: post #93

Zero configuration... read "We made choices for you, just trust us. Read our documentation to see what your missing. Oh, also since you didn't configure it we'll change (the defaults) on our next release".

> Oh, also since you didn't configure it we'll change (the defaults) on our next release

That doesn't really matter, since I'll only use the next release for my next release, and the previous prototype has either been thrown away or turned into a proper stack.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#145

Post by laurent123456 »

That's pretty cool to quickly put together a POC app. There should be an "eject" command that would export everything to a "real" Node application, with package.json and so on, so that the POC can be converted to a real app easily.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#146

Post by insulfrable »

joshstrange wrote: post #143
insulfrable wrote: post #141

Earlier quoted context omitted.

Maybe security people are getting tired of inconsiderate developers that keep shipping bazillions of insecure packages all over mission critical applications. Devs need to change their culture. This behavior is actively harming end-users through repeated data breaches.

Do you honestly think it is developer's "inconsiderate" behavior that the root cause or even a main factor in the "repeated data breaches"?

Partly yes. They certainly have a professional responsibility to write applications that resist well known attacks, such as directory traversal, xss, sqli, etc.

This isn't new, and not knowing how to deal with it is like a builder not knowing how to safely stand up a wall.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#147

Post by Vinnl »

progx wrote: post #71
wesleytodd wrote: post #66

Wow, I love that people can wrap express and many of its components and end with something so different from its foundation. That being said, this level of "batteries included" approach has a cost. In this example, it is the complexity of this file[1] and the fact that if you were to write this as a single express middleware you could probably write it in less than 20 lines. Guess this is just not my cup of tea? [1]…

Yes, writting an express backend is really simple, some plugins, error-handling etc. and you can run it in less than 1 hour. But the Frontend with webpack needs definitely more time, hours and hours to fiddle webpack to your needs. This project has a definded strucutre and support defined modules (react), so it could save you a lot of webpack config time, but you can not do everything with it. You have to use it as i…

Setting up Webpack isn't even the time-consuming part, in my experience - it's getting the back-end and front-end to work together and having a comfortable development environment in which both live reload.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#148

Post by asadlionpk »

benhowdle wrote: post #72
dammod wrote: post #69

Earlier quoted context omitted.

As others have pointed out, make sure to mark files that are not supposed to be exposed to the client by prefixing them with a underscore, otherwise you'll have a bit of a security issue. Otherwise, you're good to go.

Ace! but in terms of running it, how would Heroku know how to, ie. if there's no `package.json`, there'll be no `npm run start` defined?

This should help: https://github.com/remoteinterview/zero#running-on-cloud

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#149

Post by joshstrange »

tlrobinson wrote: post #138
wesleytodd wrote: post #136

Earlier quoted context omitted.

I think any user should be responsible for vetting their tech choices. Why would the author put a disclaimer instead of fixing the issues? In this case, the project is clearly too new/unstable/insecure to use in any real sense. It's presence as #1 on HN says more about the audience than the project itself I think.

IMHO a project with a trivial directory traversal vulnerability[1] is not ready for a shiny marketing site like this. 1. https://news.ycombinator.com/item?id=19256230

We can talk in generalities but since in this case we have more specifics let's go that route.

This is an open-sourcing of, presumably, an internal tool used at CodeInterview. It's "shiny marketing site" feels very cookie-cutter to me and I'd be shocked if that wasn't either a template or a very few handful of components from something like bootstrap/similar. And it was posted to "Show HN", which is important given the rules of Show HN [1].

> In Comments

[0] https://codeinterview.io/

[1] https://news.ycombinator.com/showhn.html

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#150

Post by Kalium »

freedomben wrote: post #134
joshstrange wrote: post #121

People in this thread are way overly negative. I understand this tool as something to be used for prototyping and locally-only but everyone is jumping on how insecure it is or how it's got a bunch of dependencies, or it's just express, etc. None of that matters if you aren't exposing this to the internet. This is a really neat project that lets you play with something right away and a lot of you all are bashing the a…

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of j…

> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO.

That's a wonderful idea! I'm absolutely certain that people will invariably respond quickly and reasonably to kind, compassionate, considerately made points. Especially ones that are very cautious to cough anything that might be taken as negative as a potential or a possibility.

For my own part, I've found this practice to be both exhausting to implement and highly unreliable in deployment. I'm absolutely certain that these just reflect my own failures. I'm similarly sure that you've seen infinitely better results!

After all, everyone knows that casually documenting something to the tune of "This code might not be as safe for production as it could be" will yield a reasonable level of caution in all developers.

Post reply on HN