How to make websites that will require lots of your time and energy

Post by listenallyall » Mon, Jul 28, 2025, 9:58 PM UTC

sam_lowry_ wrote: post #131

skinkestek wrote: post #115

Earlier quoted context omitted.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

In Java, the sweet spot is JDBCTemplate. Projects based on JDBCTemplate succeed effortlessly while teams muddle through JPA projects. It is not that JPA is inherently bad, it's just that such projects lack strong technical leadership.

Post by listenallyall » Mon, Jul 28, 2025, 10:08 PM UTC

ormsaregreat wrote: post #108

Scarblac wrote: post #62

Earlier quoted context omitted.

I always see this sentiment here but I just havent experienced any of it in 14 years with the Django ORM.

Hitting the database should be avoided in a web application, and use keys as much as possible. All heavy objects should be previously cached in disk.

Post by listenallyall » Mon, Jul 28, 2025, 10:13 PM UTC

Tade0 wrote: post #55

superasn wrote: post #38

Always use ORMs and then spend the next year debugging N+1 queries, bloated joins, and mysterious performance issues that only show up in prod. Migrations randomly fail, schema changes are a nightmare, and your team forgets how SQL works. ORMs promise to abstract the database but end up being just another layer you have to fight when things go wrong.

A couple of years ago I had an opportunity to fill a fullstack role for the first time in several years. First thing I noticed was that I couldn't roll an SQL statement by hand even though I had a distinct memory of being able to do so in the past. I went with an ORM and eventually regretted it because it caused insurmountable performance issues. And that, to me, is the definition of a senior engineer: someone who re…

Post by reactordev » Mon, Jul 28, 2025, 10:41 PM UTC

tetha wrote: post #119

skinkestek wrote: post #115

Earlier quoted context omitted.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

I'd say, pure SQL gives you a higher performance ceiling and a lower performance and security floor. It's one of these features / design decisions that require diligence and discipline to use well. Which usually does not scale well beyond small team sizes. Personally, from the database-ops side, I know how to read quite a few ORMs by now and what queries they result in. I'd rather point out a missing annotation in so…

Post by bravesoul2 » Mon, Jul 28, 2025, 10:51 PM UTC

jimnotgym wrote: post #157

threetonesun wrote: post #141

Earlier quoted context omitted.

10 year old .NET is running on a Windows server that, I hope, you've done some security updates on. Having worked on most web facing stacks out there that might have been the worst one you could have picked as a "future proof" deployment, unless you're comparing them all as something you release once and then never touch again.

But did running Windows Update ever break the website?