Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to make websites that will require lots of your time and energy

blog.jim-nielsen.com

Post reply on HN
Print view View original

201–210 of 247 posts

Re: How to make websites that will require lots of your time and energy

#201

Post by victorbjorklund »

bravesoul2 wrote: post #87
victorbjorklund wrote: post #60

Earlier quoted context omitted.

So don't run npm updates because sure then you have the security risks that you have some old code and that is five years old and hasn't been worked on for five years and you also have you missing out on new functions and optimizations. However if you have a five-year-old project that you handwritten everything by yourself you probably have a lot of security issues there too assuming that you are using complicated fu…

Yes run updates of course. The question is how much of a headache you want. You can: Use Next.js (frequently changing lots of transitive deps, suffers from Node ecosystem churn too) Roll your own framework OR (FANFARE....) Use simpler arguably more professional tools. That 10 year old .NET MVC site. Guess what. Still works. Still secure.

guess it depends on def of framework. I would say using .net mvc is a framework.

Re: How to make websites that will require lots of your time and energy

#202

Post by rizky05 »

skinkestek wrote: post #115
superasn wrote: post #38

Always use ORMs and then spend the next year debugging N+1 queries, bloated joins, and mysterious performance issues that only show up in prod. Migrations randomly fail, schema changes are a nightmare, and your team forgets how SQL works. ORMs promise to abstract the database but end up being just another layer you have to fight when things go wrong.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

[dead]

Re: How to make websites that will require lots of your time and energy

#203

Post by krawcu »

sherburt3 wrote: post #184
skinkestek wrote: post #115

Earlier quoted context omitted.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

At least when I see raw sql I know me and the author are on a level playing field. I would rather deal with a directory full of sql statement that get run than some mysterious build tool that generates sql on the fly and thinks its smarter than me. For example, I'm working on a project right now where I have to do a database migration. The project uses c# entity framework, I made a migration to create a table, realiz…

i think you should just create another migration with alter table that adds that column

Re: How to make websites that will require lots of your time and energy

#204

Post by indigo945 »

sherburt3 wrote: post #184
skinkestek wrote: post #115

Earlier quoted context omitted.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

At least when I see raw sql I know me and the author are on a level playing field. I would rather deal with a directory full of sql statement that get run than some mysterious build tool that generates sql on the fly and thinks its smarter than me. For example, I'm working on a project right now where I have to do a database migration. The project uses c# entity framework, I made a migration to create a table, realiz…

You can use EF by writing the migrations yourself ("database first"). Also, whatever problem you have there seems to be easily fixed either by a better understanding of how EF's code generation works, or by more aggressive use of version control.

Re: How to make websites that will require lots of your time and energy

#205

Post by edem »

skinkestek wrote: post #115
superasn wrote: post #38

Always use ORMs and then spend the next year debugging N+1 queries, bloated joins, and mysterious performance issues that only show up in prod. Migrations randomly fail, schema changes are a nightmare, and your team forgets how SQL works. ORMs promise to abstract the database but end up being just another layer you have to fight when things go wrong.

People love to rant about ORMs. But as someone who writes both raw SQL and uses ORMs regularly, I treat a business project that doesn’t use an ORM as a bit of a red flag. Here’s what I often see in those setups (sometimes just one or two, but usually at least one): - SQL queries strung together with user-controllable variables — wide open to SQL injection. (Not even surprised anymore when form fields go straight into…

all of this is solved by an sql query builder DSL

Re: How to make websites that will require lots of your time and energy

#206

Post by porridgeraisin »

epolanski wrote: post #37
kome wrote: post #6

Earlier quoted context omitted.

> but there's solutions that are hard to ignore such as the need for reusable fragments/components on different pages which already make a cry for dependencies. honestly ctrl+c, ctrl+v of hand written html. and i'm cool as a cucumber.

Been there, done that. You implement just a header navigation change, now you're copy pasting across 12 different files. But wait, now you want to add an active state to your navigation links, and you're manually changing the `class="active"` in 12 different files... I could go on, it doesn't scale beyond triviality, albeit LLMs do help speeding up.

  $ man sed
Or for more complex things

  $ vim
    :cfdo

Re: How to make websites that will require lots of your time and energy

#207

Post by epolanski »

johnisgood wrote: post #68
epolanski wrote: post #37

Earlier quoted context omitted.

Been there, done that. You implement just a header navigation change, now you're copy pasting across 12 different files. But wait, now you want to add an active state to your navigation links, and you're manually changing the `class="active"` in 12 different files... I could go on, it doesn't scale beyond triviality, albeit LLMs do help speeding up.

That is why you can include a header.html, nav.html, and footer.html if you so wish! There are many ways to do this. :P Depends on your use case.

And then you need a dependency to glue them together...And now you want to provide data..And now you want to put content in children.

And you went from a simple nginx extension to again full blown software.

Re: How to make websites that will require lots of your time and energy

#208

Post by Too »

adampwells wrote: post #186
kaptainscarlet wrote: post #148

Earlier quoted context omitted.

People who avoid ORMs endup writing their own worse ORM*. ORMs are perfect if you know how and when to uses them. They encapsulate a lot of the mind numbing work that comes with raw sql such as writing inserts for a 50 column database.

I find that Claude writes boilerplate SQL very well, and is effectively an 'ORM' for me - I just get plain SQL for CRUD. Complex queries I write myself anyway, so Claude fills the 'ORM' gap for me, leaving an easily understood project.

Writing is just half the job. Now try migrations, or even something as fundamental as ”find references” on a column name. No, grep is not sufficient, most tables have fields called ”id” or ”name”.

Re: How to make websites that will require lots of your time and energy

#209

Post by Too »

sethammons wrote: post #112
Scarblac wrote: post #62

Earlier quoted context omitted.

I always see this sentiment here but I just havent experienced any of it in 14 years with the Django ORM.

My life is this in django. Querysets have been passed around everywhere and we've grown to 50 teams. Now, faced with ever slower dev velocity due to intertwined logic, and reduced system performance with often wildly non performant data access patterns, we have spent two years trying to untangle our knot of data access, leading to a six month push requiring disruption to 80% of team's roadmaps to refactor to get the…

> 50 teams

At that scale any tool will break down without good architecture, ORM or not.

Re: How to make websites that will require lots of your time and energy

#210

Post by nottorp »

victorbjorklund wrote: post #199
nottorp wrote: post #121

Earlier quoted context omitted.

> and that code is now five years old and you haven't touched it for five years, you might have some security vulnerabilities too Security vulnerabilities grow in unattended code then? Or they were there from the second the code was written but with some luck someone noticed them and fixed them? Old code isn't necessarily insecure just because it's old...

Doesnt matter if you count them from the second the code is written or when they are discovered. The same issue is in code written by someone else or yourself.

The point is that freshly updated code has the same chance of being buggy.

You want me to believe that in the npm "ecosystem" they have LTS branches that only get security updates? For anything besides maybe a few large libraries with companies behind them?

Post reply on HN