Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

51–60 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#51

Post by asadlionpk »

joshstrange wrote: post #21
asadlionpk wrote: post #19

Earlier quoted context omitted.

Exactly this. One of the aims to start this project was to reduce one more friction when testing an idea. Project configurations and set up is a big time suck.

Thank you for creating this! I often find I had an idea and then spend 1-2 hours doing NOTHING towards the idea trying to future-proof what I'm writing to the max. That is a trait of mine I need to work on by itself but "zero" should help let convince me to "just try it with zero before you setup TypeScript/Angular/Vue/React/Cordova/Express/etc...". I saw your other comment about making it Apache/PHP level easy and a…

Thanks! I will def move .ts up the list. It should be easy to add.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#52

Post by adrusi »

q3k wrote: post #31
untog wrote: post #28

Earlier quoted context omitted.

...why? I get that file-system based routing means you know the location of a source file on disk, but if anyone can access that file you've already lost. And auto-dependency resolution also doesn't seem any larger a security concern, all it's doing is skipping an "npm install" command.

Because if you ever have a broken upload system that allows you to drop a JS file somewhere accessible by the file system routing, you have remote code execution. Additionally, you now have to write guards in every non-endpoint JS file so that it doesn't get executed just by a misplaced HTTP request. And as for automatic dependency resolution, this means you're not even aware of what transitive dependencies you're pu…

Make your application directory read-only to the user running the application, as it ought to be anyway.

Automatic dependency resolution however... Fantastic for experimentation, but that's a dealbreaker for production. Maybe it would be OK if it actually wrote the package-lock.json to the application directory, I'd have to think about that.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#55

Post by jermaustin1 »

asadlionpk wrote: post #42
sjroot wrote: post #39

Earlier quoted context omitted.

Check my reply to this comment. The underscore idea was one of the first things to come to mind too, but I think having a specific file makes it clear to others who might not understand Zero internals.

You are right. A .zeroignore file seems like a good idea.

Would that not count as a configuration file though?

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#57

Post by beefhash »

jayar95 wrote: post #44
q3k wrote: post #26

> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…

If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option

> If security is a concern

At the risk of being presumptuous... When is security ever not a concern?

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#58

Post by reidjs »

beefhash wrote: post #57
jayar95 wrote: post #44

Earlier quoted context omitted.

If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

Student projects

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#59

Post by lsiunsuex »

reidjs wrote: post #58
beefhash wrote: post #57

Earlier quoted context omitted.

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

Student projects

Conversely though - doesn't that lead to bad habits?

If security is taught at the student level, by the time they get to junior developer they'll have an understanding of it / do it automatically.

Post reply on HN