Htmx Is a Erlang • Hacker News Board

eddd-ddde wrote: post #2

The whole "htmx is the most dangerous thing to exist" is so funny to me. Someone that does not understand sanitisation boundaries has no business working on web development. This is how you end up with html in your database, people just render whatever piece of data because it "just works" in frameworks like react (I've seen it myself in production).

Replace htmx with alpine js and I think the twitterers have some point. Eh, probably even with htmx.

It is true that the average WordPress developer might not care about XSS, and to refute one specific point: I have seen third-party returning HTML, plenty of them.

Deliberately acting on the contents response instead of directly executing code from said party forces you to think about XSS.

But it's not specific to htmx of course, it would be the same when using innerHTML or something while using a field in a JSON API response.

It's true that frameworks like React have safer defaults than Vanilla JS in that regard.

Re: Htmx Is a Erlang

#15

Post by lacrimacida » Tue, Dec 12, 2023, 8:58 PM UTC

herrkanin wrote: post #10

felixgallo wrote: post #7

Earlier quoted context omitted.

there is no way any competently written back end system takes 5-7 seconds for any reason whatsoever. A middling back end system with median complexity is doing 10-100K requests per second per server and is near-perfectly horizontally scalable.

Not everyone has the luxury to work with competently written backend systems.

Not everyone has the luxury to work with competently written front end systems.

Re: Htmx Is a Erlang

#16

Post by ch4s3 » Tue, Dec 12, 2023, 9:03 PM UTC

felixgallo wrote: post #7

coolhand2120 wrote: post #5

Reading that entire thing was a struggle. Really feels like _everyone_ is wrong here. Yes the current state of FE development is overly dogmatic and cultish. But it always has been. On the other hand the frameworks and build systems are solving actual problems, they're not there for looks. 5-7 second skeleton loaders are there because backend systems are slow, not because of the front end application. You can say "oh…

there is no way any competently written back end system takes 5-7 seconds for any reason whatsoever. A middling back end system with median complexity is doing 10-100K requests per second per server and is near-perfectly horizontally scalable.

> there is no way any competently written back end system takes 5-7 seconds for any reason whatsoever.

I'd argue that even a well written system that allows arbitrary date ranges and filtering of data can easily run past that limit. You just can always know ahead of time what some client might request and some strategies for making normal queries fast can make some queries slower. Its tradeoffs all the way down.

Re: Htmx Is a Erlang

#17

Post by davedx » Tue, Dec 12, 2023, 9:03 PM UTC

It's powerful to have your front-end library automagically run code returned by your API, sure.

But you can't hand-wave the security concerns of that away by ridiculing the people trying to discuss them.

There is a fundamental difference between your server returning data versus returning code. If you don't want to accept that, fine, it's your project, or career, whatever. But if you conduct extensive ad hominems against people (I'm not a fan of "Devrels" but jeez, that part of this post felt like blatant character assassination) instead of just debating the facts then you're a douche and no better than the people you're disparaging.

I think HTMX is an interesting project that I'll probably give a try at some point. But breathless cultish hype of it has already turned me off. I don't even know if React got this much attention!?

Re: Htmx Is a Erlang

#18

Post by weego » Tue, Dec 12, 2023, 9:04 PM UTC

herrkanin wrote: post #10

felixgallo wrote: post #7

Earlier quoted context omitted.

there is no way any competently written back end system takes 5-7 seconds for any reason whatsoever. A middling back end system with median complexity is doing 10-100K requests per second per server and is near-perfectly horizontally scalable.

Not everyone has the luxury to work with competently written backend systems.

The entire Internet apparently did for years because frontend JS monoliths only appeared halfway though my career.

Re: Htmx Is a Erlang

#19

Post by aidenn0 » Tue, Dec 12, 2023, 9:10 PM UTC

davedx wrote: post #17

It's powerful to have your front-end library automagically run code returned by your API, sure. But you can't hand-wave the security concerns of that away by ridiculing the people trying to discuss them. There is a fundamental difference between your server returning data versus returning code. If you don't want to accept that, fine, it's your project, or career, whatever. But if you conduct extensive ad hominems aga…

Your server already returns code if you are running javascript on your frontend.

Your server already returns arbitrary html (which can include executable code) unless you are running a fully static backend.

HTMX moves where the trust boundary is a bit, but it doesn't change that it exists at all.

Re: Htmx Is a Erlang

#20

Post by aidenn0 » Tue, Dec 12, 2023, 9:11 PM UTC

jlundberg wrote: post #4

This read has a surprising amount of depth and funny style. Recommended if you enjoy conversations about web security.

YMMV: I agreed with the points, but found the depth to be rather minimal and the style to be completely off-putting.