Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

151–160 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#151

Post by Kalium »

hombre_fatal wrote: post #142
wesleytodd wrote: post #113

Earlier quoted context omitted.

Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2]. [1] https://github.com/remoteinterview/zero/commit/b4af5325c388e... [2] https://nodejs.org/api/url.html#url_legacy_url_api

A simpler fix might be to canonicalize (i.e. no "..") the public folder path and the requested file path and then ensure the public path is a prefix of the other.

Any fix also needs to be sure to resolve any symlinks before doing a prefix check.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#152

Post by adrusi »

SahAssar wrote: post #91
adrusi wrote: post #52

Earlier quoted context omitted.

Make your application directory read-only to the user running the application, as it ought to be anyway. Automatic dependency resolution however... Fantastic for experimentation, but that's a dealbreaker for production. Maybe it would be OK if it actually wrote the package-lock.json to the application directory, I'd have to think about that.

In this case the application also tries to auto-install dependencies, so making it read-only removes one of the stated features. I think this framework hasn't been written with security in mind at all.

Whatever it's doing, it's not writing the packages into the application directory.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#153

Post by IshKebab »

q3k wrote: post #75
q3k wrote: post #26

> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…

Putting my money where my mouth is - use this to leak any file accessible by the running user of zero from the filesystem: # curl -v --path-as-is 127.0.0.1:3000/../../../../../etc/passwd root:x:0:0:root:/root:/bin/bash [...]

I don't think I would use any package that makes this classic mistake in 2019. Web services need to be at least vaguely secure and this destroys all my confidence of that.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#154

Post by jayar95 »

beefhash wrote: post #57
jayar95 wrote: post #44

Earlier quoted context omitted.

If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

You know it's always a concern, but context is everything.

> small little one-off apps that might need _some_ backend functionality

The security implications of serving a static website vs. a dynamic application that processes payment and queries the database are two different beasts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#155

Post by jeremy_wiebe »

tlrobinson wrote: post #135
jlarocco wrote: post #115

Earlier quoted context omitted.

Is this even a serious question? Not everything runs online connected to the internet.

But almost everything does. Assumptions like this lead to ~40,000 unsecured MongoDB databases on the public internet [1] 1. https://www.information-age.com/major-security-alert-40000-m...

And printers. Although in the linked story the exploit already existed and the guy who did the printing sounds like basically a script-kiddie.

https://www.theverge.com/2018/11/30/18119576/pewdiepie-print...

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#156

Post by nvusuvu »

asadlionpk wrote: post #29
davish wrote: post #27

Looking through the code on github found a .py file handler in the works: https://github.com/remoteinterview/zero/blob/master/packages... Any idea of a timeline on this feature? I think it could be really awesome to be able to prototype with python in addition to js.

The js part (React, MDX, Node) is almost complete. I will put out a basic handler for python ASAP if that's going to be useful to you :)

Would be for me.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#157

Post by Kalium »

joshstrange wrote: post #139
freedomben wrote: post #134

Earlier quoted context omitted.

I agree with you about the over-negativity, but I have to disagree about the value of the "security nightmare" comments. Nowhere on the marketing page (that I saw) does it say, "prototype/development use only!" In fact I got the opposite impression. It seems to want to be a new framework. It's critically important to surface security issues early and often. There's already a cultural anti-pattern in the js world of j…

> That said security-minded people are often inconsiderate and horribly untactful in their approach. That needs to change. You don't need to be overly negative to point out a security issue. Something like, "Cool start, but might want to point out that it's not meant for production!" would be a lot better IMHO. Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never pr…

> Agreed, and I also agree that maybe it should have a tagline about "not production ready" or even "never production ready".

That's a great idea! It should definitely be implemented.

With that said, what do you make of the point that things that are clearly not suitable for production (and sometimes labeled accordingly) have a nasty habit of making their way into production anyway? Do you think it has salience here? You're clearly a thoughtful person with your hear in the right place, so I'd very much like to hear your opinion.

Again, your point is both completely valid and absolutely correct. Purpose and labeling should be clear enough that no person could possibly miss them.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#159

Post by BinaryIdiot »

"Zero configuration"

But, you can install express, copy paste the getting started code and be up and running at a similar level in 5 minutes. I...guess I don't understand why I should trade something super simple and easy to use for this additional level of abstraction magic.

There is such a thing as too much abstraction.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#160

Post by the_mitsuhiko »

wesleytodd wrote: post #113
asadlionpk wrote: post #82

Earlier quoted context omitted.

Thanks for pointing this out. Fixed this particular bug!

Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2]. [1] https://github.com/remoteinterview/zero/commit/b4af5325c388e... [2] https://nodejs.org/api/url.html#url_legacy_url_api

This fix does not even work on windows. You can still request data on a different drive.
Post reply on HN