I noticed Dominic mentioned he is "between roles" in the README; I suppose that implies he left Vercel? Does it mean he is leaving the Svelte team too?
I left Vercel a few weeks ago and I left the Svelte team earlier this year.
Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
61–70 of 74 posts
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#62Earlier quoted context omitted.
Oh yes, because LLMs are known for good security practices.
I did not want to embarrass the author but the LLM showed that this library is absolutely full of major security holes. And yes, it's an LLM that pointed them out. So, are you saying the security holes don't exist because an LLM found them?
Please can you create a Github issue with the security holes you've found? That would be greatly appreciated. I've given it a sweep and found nothing.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#63You need to drop your source code into some LLMs and ask for a security review - there's lots of holes.
You should get the LLM to create a couple dozen issues on github automatically and let the author review it!! /s
Let the LLM review the issues and resolve the issues.
LLM all around, hail Skynet.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#64I noticed Dominic mentioned he is "between roles" in the README; I suppose that implies he left Vercel? Does it mean he is leaving the Svelte team too?
I left Vercel a few weeks ago and I left the Svelte team earlier this year.
Thank you for all your contributions! Svelte 5 is a blast.
If you don't mind me asking, why did you leave? What do you plan on working on going forward?
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#65Earlier quoted context omitted.
I love JSX and hate HTML template syntax, so there's at least one person. What I like about JSX is that you can reuse all of the control flow primitives from JS. You have if, for, map, filter, flatMap, etc. if you want a new combinator, just write a function as you would for any other type of data transformation. I consider this one of the biggest advantages of React compared to the approach of having separate templa…
For me it is the opposite. I dislike having imperative constructs pollute my otherwise declarative markup. To each their own I guess.
Don't you still have imperative constructs if you use Svelte? It's not like any web framework can remove the need to render things conditionally.
If you have `{#if cond}`, that's imperative programming, not declarative, it's just imperative programming using a different syntax.
Using a different syntax for a conditional/loop depending on the type of the data is odd when you think about it. Why should vnodes use one syntax and every other data type use another syntax?
I will grant that the C ?: ternary operator syntax is ugly. If C had had expression based if/else like Rust then maybe people wouldn't mind JSX so much.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#66Earlier quoted context omitted.
For me it is the opposite. I dislike having imperative constructs pollute my otherwise declarative markup. To each their own I guess.
Don't you still have imperative constructs if you use Svelte? It's not like any web framework can remove the need to render things conditionally. If you have `{#if cond}`, that's imperative programming, not declarative, it's just imperative programming using a different syntax. Using a different syntax for a conditional/loop depending on the type of the data is odd when you think about it. Why should vnodes use one s…
Absolutely, and that's one of the reasons that, as much as I was enthusiastic about svelte, it still didn't quite hit the spot. Close but not quite there yet.
It's neither html nor js. Still a bit confusing.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#67Earlier quoted context omitted.
I left Vercel a few weeks ago and I left the Svelte team earlier this year.
Thank you for all your contributions! Svelte 5 is a blast. If you don't mind me asking, why did you leave? What do you plan on working on going forward?
It was a good time for change, I was working on Svelte 5 non-stop for two years! I'll be announcing my new role nearer the time :)
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#68Earlier quoted context omitted.
I did not want to embarrass the author but the LLM showed that this library is absolutely full of major security holes. And yes, it's an LLM that pointed them out. So, are you saying the security holes don't exist because an LLM found them?
Please can you create a Github issue with the security holes you've found? That would be greatly appreciated. I've given it a sweep and found nothing.
Make a minimal zip of the the source code only (cut out anything not source code) drop it into ChatGPT and say "analyse this code for security flaws".
Then ask it for more.
Then do the same this with Google AI studio - drop the zipfile in and ask it to analyse for security flaws.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#69Earlier quoted context omitted.
I did not want to embarrass the author but the LLM showed that this library is absolutely full of major security holes. And yes, it's an LLM that pointed them out. So, are you saying the security holes don't exist because an LLM found them?
Please can you create a Github issue with the security holes you've found? That would be greatly appreciated. I've given it a sweep and found nothing.
Sibling's proposed approach is a recipe for false positives.
Consider Claude Code's new /security-review prompt or just use the prompt starting from "Objective" after giving the context (see the Git shell commands) to Claude Opus 4.1.
https://raw.githubusercontent.com/anthropics/claude-code-sec...
Definitely Opus 4.1 though, not lesser.
Re: Ripple – A TypeScript UI framework that takes the best of React, Solid, Svelte
#70If you want something that is similar but looks better and more mature, check out Mint (mint-lang.com - I'm the author)
This looks really well thought out