Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno 1.0

deno.land

Post reply on HN
Print view View original

271–280 of 598 posts

Re: Deno 1.0

#271

Post by teleclimber »

bgdam wrote: post #151
aazaa wrote: post #138

> ... Deno is (and always will be) a single executable file. Like a web browser, it knows how to fetch external code. In Deno, a single file can define arbitrarily complex behavior without any other tooling. > ... > Also like browsers, code is executed in a secure sandbox by default. Scripts cannot access the hard drive, open network connections, or make any other potentially malicious actions without permission. The…

See the thing about the sandbox is that it's only going to be effective for very simple programs. If you're building a real world application, especially a server application like in the example, you're probably going to want to listen on the network, do some db access and write logs. For that you'd have to open up network and file access pretty much right off the bat. That combined with the 'download random code fro…

> For that you'd have to open up network and file access pretty much right off the bat.

For the network access I have an issue[0] open that asks to separate permissions to listen on the network from permission to dial. Also, along the way I want to have the ability to let the OS pick the port as an option.

Permissions are meant to work by whitelisting. So you wouldn't open access to the whole system just to talk to your DB, or to operate on some files.

[0] https://github.com/denoland/deno/issues/2705

Re: Deno 1.0

#272

Post by msndlensn »

russellbeattie wrote: post #263

I think Deno is fine, and I think the project is interesting, but I also think those who want to use Typescript should do so, and stop pretending they're doing anything with Javascript. If I wanted deal with repetitive code like "function add(x: number, y: number): number {...}" I'd just use Java. There's reasons I love JavaScript, and not dealing with types is one of them. When is Typescript going to have its own ve…

> If I wanted deal with repetitive code like "function add(x: number, y: number): number {...}" I'd just use Java.

I don’t even like TS, but it’s pretty clear I can discount your opinion because you don’t even know what you’re talking about.

Re: Deno 1.0

#274

Post by gpm »

Is there some deterministic way of measuring JS execution time?

Explanation for why I want that:

I've started making an game RTS game - think starcraft but you can program your units.

Currently I'm trying to decide what language to expose to players. The two main requirements are that it's secure (I'll be running player A's code on player B's computer) and that it has a deterministic method of counting execution time (so that player A and player B's computer can both make the same decision on whether or not a script took too much time).

I'd appreciate any hints towards other languages I should look at as well.

Re: Deno 1.0

#275

Post by dnissley »

russellbeattie wrote: post #263

I think Deno is fine, and I think the project is interesting, but I also think those who want to use Typescript should do so, and stop pretending they're doing anything with Javascript. If I wanted deal with repetitive code like "function add(x: number, y: number): number {...}" I'd just use Java. There's reasons I love JavaScript, and not dealing with types is one of them. When is Typescript going to have its own ve…

> Grabbing everything I need, and then being able to zip it up as needed to save or share is convenient and easy

Isn't there a risk of cross platform incompatibility with some of the packages that compile on install?

Re: Deno 1.0

#276

Post by dralley »

VWWHFSfQ wrote: post #223
aazaa wrote: post #138

> ... Deno is (and always will be) a single executable file. Like a web browser, it knows how to fetch external code. In Deno, a single file can define arbitrarily complex behavior without any other tooling. > ... > Also like browsers, code is executed in a secure sandbox by default. Scripts cannot access the hard drive, open network connections, or make any other potentially malicious actions without permission. The…

I guess I'm wondering why Deno is targeting V8 instead of Servo? Maybe I'm mistaken, but Servo [0] and Stylo [1] are both production-ready browser scripting and styling engines implemented in Rust. [0] https://servo.org/ [1] https://wiki.mozilla.org/Quantum/Stylo

>Servo [0] and Stylo [1] are both production-ready browser scripting and styling engines implemented in Rust.

Servo is absolutely not production ready. A couple of particular pieces of Servo, such as Stylo and WebRender, can be considered production-ready, but no so much the project as a whole.

Re: Deno 1.0

#277

Post by tolmasky »

austincheney wrote: post #267
tolmasky wrote: post #236

Earlier quoted context omitted.

Forget 10000000 packages. Many languages often make use of 10s of packages. If I have several projects, each with around 10 packages, and no automated way to just check if all my projects ’ respective dependencies have security updates that could be applied, it seems to go against the stated security goal. Separately I’m not sure what is enforcing this “small dependency graph” aside from making it hard to import thin…

> and no automated way to just check if all my projects’ respective dependencies have security updates Dependency management is a major cornerstone of any infosec program. There is more to that than just auto-installing a new dependency version. > I’m not sure what is enforcing this “small dependency graph” Because a large dependency graph is slow, insecure, and fragile.

> Dependency management is a major cornerstone of any infosec program. There is more to that than just auto-installing a new dependency version.

We seem to agree? I said check. It’s very useful to have something tell you what’s out of date and what the updates are.

> Because a large dependency graph is slow, insecure, and fragile.

I asked “what”, not “why”. What is enforcing this idea you have of how Deno will be used? I feel like you want it to not be used with lots of dependencies, thus aren’t accounting for how to handle them. However, just because that’s the desired way to use it doesn’t mean it will be used that way. Lots of dependencies may end up still becoming the norm, at which point you’ll wish you would have more clearly defined how it should be done instead of letting the first third party solution win (as ended up happening with npm).

Re: Deno 1.0

#278

Post by pawalt »

littlestymaar wrote: post #186
bgdam wrote: post #127

Earlier quoted context omitted.

Ah, in this case, I would then have to commit my dependencies into my VCS to maintain reproducible builds. I'm not sure I like that solution very much either. I've seen node_modules in multiple GBs, and I'm sure Deno's dependency sizes are going to be similar.

True, but that's what people using Go have been doing for years without complaining much, so I guess it works fine for most workload. And before npm fixed things after the left-pad incident, the npm builds where not reproducible either (as demonstrated by the said left-pad incident).

This hasn't been a thing in Go for a long time. Go dep and now go modules fix this.

Re: Deno 1.0

#279

Post by FunnyLookinHat »

gpm wrote: post #274

Is there some deterministic way of measuring JS execution time? Explanation for why I want that: I've started making an game RTS game - think starcraft but you can program your units. Currently I'm trying to decide what language to expose to players. The two main requirements are that it's secure (I'll be running player A's code on player B's computer) and that it has a deterministic method of counting execution time…

Lua is frequently used for interactions with game engines and programming basic logic. Maybe see if there's a Lua engine in whatever language your game engine will be written with?

Re: Deno 1.0

#280

Post by wintorez »

petercooper wrote: post #33

If you're getting into Deno and want to keep up with new stuff from the ecosystem on a regular basis, we're now publishing https://denoweekly.com/ .. issue 2 just went out minutes after the 1.0 release. I've been doing JavaScript Weekly for 487 issues now, so this is not a flash in the pan or anything :-D Of course, Deno has an official Twitter account as well at https://twitter.com/deno_land :-)

Good to see you here!
Post reply on HN