Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The React2Shell Story

lachlan.nz

Post reply on HN
Print view View original

11–20 of 50 posts

Re: The React2Shell Story

#11

Post by halflife »

owebmaster wrote: post #10
Rauchg wrote: post #3

R2S was a painful one, but Lachlan was a dream of a security researcher to partner with. Not just from a responsible disclosure POV, but things like hopping on multiple calls with Meta and our team to help us validate remediations. Thank you Lachlan for helping make the internet safer (and great job on figuring out this 'labyrinth' of a vulnerability)

[flagged]

React was ruined from the moment they abandoned class components and introduced hooks. Vercel is just continuing the trend of hype against common sense.

Re: The React2Shell Story

#13

Post by ervine »

halflife wrote: post #11
owebmaster wrote: post #10

Earlier quoted context omitted.

[flagged]

React was ruined from the moment they abandoned class components and introduced hooks. Vercel is just continuing the trend of hype against common sense.

I just don't understand this take, every time I hear it I wonder if people just haven't spent the time to adjust their mental model.

Hooks are IMO the best thing that happened to react.

Re: The React2Shell Story

#14

Post by NewLogic »

I'm still yet to be convinced React Server Components are anything but a disaster to the developer experience. Mixing backend and frontend without a clear boundary is terrible for any codebase beyond a handful of contributors.

Re: The React2Shell Story

#15

Post by owebmaster »

halflife wrote: post #8

Whoda thunkit that - blurring the lines between client code and server code - creating a brand new protocol for communication between trusted and untrusted actors - and with all of that allow the protocol to serialize code and not just primitives Would be a tremendously stupid idea. And for what? To lock developers further into the react ecosystem. What a shitshow react continues to be.

> And for what? To lock developers further into the react ecosystem.

It was a clear bait and switch scam, that is still going on.

Re: The React2Shell Story

#16

Post by pjmlp »

halflife wrote: post #11
owebmaster wrote: post #10

Earlier quoted context omitted.

[flagged]

React was ruined from the moment they abandoned class components and introduced hooks. Vercel is just continuing the trend of hype against common sense.

Spot on, incredible how OOP hate can mess up a framework.

Vercel, the only thing they have going for the app model mess, are the partnerships with SaaS vendors that make them the must go tooling.

However this will eventually come to an end.

Re: The React2Shell Story

#17

Post by vessenes »

Boy I loved this write up, and really loved Sylvie’s, which gives a peek into the economic side of this white hat hacking — prepping, safety, wondering who you trust, preparing to claim as many bug bounties as possible.

I was struck by the very sensible economic filter: “who is vulnerable that has a bug bounty program?” Incredibly good reminder that you should have a bug bounty program; otherwise, nobody might call you. Until, you know, you’ve been compromised.

Re: The React2Shell Story

#18

Post by pjmlp »

ervine wrote: post #13
halflife wrote: post #11

Earlier quoted context omitted.

React was ruined from the moment they abandoned class components and introduced hooks. Vercel is just continuing the trend of hype against common sense.

I just don't understand this take, every time I hear it I wonder if people just haven't spent the time to adjust their mental model. Hooks are IMO the best thing that happened to react.

I have spent more time than I wished for on React debugging tools, and useXXXX spaghetti calls.

Re: The React2Shell Story

#19

Post by pjmlp »

NewLogic wrote: post #14

I'm still yet to be convinced React Server Components are anything but a disaster to the developer experience. Mixing backend and frontend without a clear boundary is terrible for any codebase beyond a handful of contributors.

But it is so cool!

I really don't understand why people complain about Spring or ASP.NET annotations, and then go running to Next.js with its useXXX and import magic.

Re: The React2Shell Story

#20

Post by nkrisc »

I wish this site respected prefers-reduced-motion. The dots on the background give me motion sickness while trying to read. Thank goodness for Firefox reader mode.
Post reply on HN