Earlier quoted context omitted.
Where can I find the other rules?
These will carry you over until the "real" ones appear: https://spacecraft.ssl.umd.edu/akins_laws.html
I want to print these out and share them with past teams I've worked on.
Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
221–230 of 256 posts
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#222Make a RealWorld.io implementation or it doesn't exist! https://github.com/gothinkster/realworld
This is wonderful. Great antidote to toy framework fatigue.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#223"Zero configuration" But, you can install express, copy paste the getting started code and be up and running at a similar level in 5 minutes. I...guess I don't understand why I should trade something super simple and easy to use for this additional level of abstraction magic. There is such a thing as too much abstraction.
I wrote a shallow http.createServer abstraction for one of my projects that works directly from the terminal and takes a port number as its only argument. I just copy/paste this every time I need a web server. Its literally like 2 minutes of effort and has no dependencies.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#224Earlier quoted context omitted.
I think your comment about scalability is accurate. Small apps become big apps, and small user bases get bigger. I’ve seen it happen — but I’m not going to think about scaling to thousands of users when I just need a small application to share with my team. If I spent five days building it to the utmost standards, instead of spending one day on something that solves a problem immediately, I’d be laughed at. It is the…
> I wouldn’t store any of my customers’ data on an insecure internal service! I know that’s mad! I'm completely sure that you're right. You know that would be irresponsible and reckless with lots of very sensitive data. With that said, how sure can you be of every other person writing a simple, small, business app for just a handful of their coworkers? I've encountered some people doing exactly what you've described…
At some point you will be outcompeted by businesses where they don't sweat stuff like this.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#225Earlier quoted context omitted.
You would've thought OP posting to HN should've considered security backlash. Unfortunately, damage is done for me too.
This was fixed literally the minute it was commented here. Securing any project is always a long-term and continuous effort. This project is brand new, I posted the repo publicly this morning. I frankly think this subthread is an overreaction. I don’t get the hate.
> This project is brand new, I posted the repo publicly this morning.
Are you implying that you don’t think it’s ready for production use? If so, maybe you should do like a lot of projects, and warn about it loud and clear in the docs. It’s not clear at all that users should expect the type of blatant security problems that were discovered here.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#226How's this different from Koa?
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#227I am so confused why the 'good old days' of php is a good example of how to do application development. Every php framework got away from that for really good mesure, including not having your logic in the server document root.
Every php framework got away from that for really good mesure, including not having your logic in the server document root.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#228Earlier quoted context omitted.
> I wouldn’t store any of my customers’ data on an insecure internal service! I know that’s mad! I'm completely sure that you're right. You know that would be irresponsible and reckless with lots of very sensitive data. With that said, how sure can you be of every other person writing a simple, small, business app for just a handful of their coworkers? I've encountered some people doing exactly what you've described…
At some point you will be outcompeted by businesses where they don't sweat stuff like this.
One of the key functions of GDPR and CCPA and PIPEDA is to make many businesses consider what kind of liability might be attached to things they might otherwise opt to not sweat.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#229Earlier quoted context omitted.
You would've thought OP posting to HN should've considered security backlash. Unfortunately, damage is done for me too.
This was fixed literally the minute it was commented here. Securing any project is always a long-term and continuous effort. This project is brand new, I posted the repo publicly this morning. I frankly think this subthread is an overreaction. I don’t get the hate.
I saw your comments fixing it - which is pretty awesome by the way (& I hope you've taken on board the other comments regarding securing it even further).
Due to PHP experience, this would've been something that I ensured was implemented properly from the outset. I know this to be true, because I've dabbled in the very space you're working in now, and it was one of the very first things I ensured: that no file could be served except from direct descendants. (I rethought my project and tossed the code)
For something like this you need to be absolutely sure about security. Have a look at the annals of PHP security issues - and most likely you'll see a lot of similarities that you'll need to make sure you address.
I'm sorry if you read hate in my words: definitely was NOT intended! I have nothing against you as a co-habitor of this wonderful planet! To me, the bug highlights that a few design considerations may have been overlooked.
Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown
#230Earlier quoted context omitted.
You would've thought OP posting to HN should've considered security backlash. Unfortunately, damage is done for me too.
This was fixed literally the minute it was commented here. Securing any project is always a long-term and continuous effort. This project is brand new, I posted the repo publicly this morning. I frankly think this subthread is an overreaction. I don’t get the hate.
But after reading the thread following your fix it seemed that the fix wasn't done properly. That, more than the security issue itself, kind of ruined my confidence as well, sorry to say.