Deno.js in production
medium.com
Deno.js in production
1–10 of 100 posts
Re: Deno.js in production
#2> Node.js is too easy to get started. This means that the pool of available programmers is not the highest quality. Runtimes like Go or Deno are still havens for the ‘connoisseur’ programmer.
wat
(Deno seems worth checking out though!)
Re: Deno.js in production
#3I'm surprised the included library wasn't front of mind. Perhaps it is implied by comparing to golang.
Re: Deno.js in production
#4It is disappointing to see this message as the basics of what the software is on their site (https://deno.land/):
Deno is a simple, modern and secure runtime for JavaScript, TypeScript, and WebAssembly that uses V8 and is built in Rust.
curl -fsSL https://deno.land/install.sh | sh
Yes, the page offers a link to the "Releases" page at their github repository. However, anyone familiar with any kind of UX will understand immediately that this is effectively burying the link and subtly makes the statement that you don't really want to bother with that other way of doing things. They also don't provide a gzipped/bzipped tarball for the linux install but a zip file instead, adding an additional barrier/dependency.
I understand this is an area where security is losing the tug of war to ease of distribution/access but it pains me to see it on any project, let alone the potentially good ones.
Re: Deno.js in production
#5It is disappointing to see this message as the basics of what the software is on their site ( https://deno.land/ ): Deno is a simple, modern and secure runtime for JavaScript, TypeScript, and WebAssembly that uses V8 and is built in Rust. Only to have that immediately followed by really poor practice of suggesting this as the installation method: curl -fsSL https://deno.land/install.sh | sh This is not strictly relat…
It's using SSL, what's the real world concern here? Other than someone might get copy-paste happy and someday install something they don't want.
Re: Deno.js in production
#6It is disappointing to see this message as the basics of what the software is on their site ( https://deno.land/ ): Deno is a simple, modern and secure runtime for JavaScript, TypeScript, and WebAssembly that uses V8 and is built in Rust. Only to have that immediately followed by really poor practice of suggesting this as the installation method: curl -fsSL https://deno.land/install.sh | sh This is not strictly relat…
You're about to run their software on your computer-- what's the difference with that and running their install script?
Re: Deno.js in production
#7The security model is a big one for me. If they could extend the permissions system to work for individual dependencies, they could solve one of the biggest security issues facing developers right now. Especially if policies could also be applied to node packages.
Are there any plans to move in this direction? It seems like if you can do it for the full app, you should hypothetically have the capability to make it library-specific. Or perhaps there are non-obvious blockers that make it too hard?
If there are plans to do this, isn't it better to do it sooner rather than later? Better to get library authors in the habit of specifying permissions/policies now while the ecosystem is still small. If you wait too long, it will be a ton of work to retrofit all the existing libs.
Re: Deno.js in production
#8It is disappointing to see this message as the basics of what the software is on their site ( https://deno.land/ ): Deno is a simple, modern and secure runtime for JavaScript, TypeScript, and WebAssembly that uses V8 and is built in Rust. Only to have that immediately followed by really poor practice of suggesting this as the installation method: curl -fsSL https://deno.land/install.sh | sh This is not strictly relat…
It's using SSL, what's the real world concern here? Other than someone might get copy-paste happy and someday install something they don't want.
There's quite a bit wrong with this idea that "It's using SSL [therefore it's safe]", assuming your meaning there.
The most obvious case: someone compromises the installation script on the actual real deno server. Right now the webserver there is returning an HTTP/307 to an HTTP/302 to the "current" installation script file. Any compromise of the webserver makes this very dangerous.
Contrast that with proper signed packages, code signed sources, etc. There it requires compromise of the developer's systems and signing keys, which at least can be a far harder thing to attack if they're doing things securely.
Re: Deno.js in production
#9> Node.js is too easy to get started. This means that the pool of available programmers is not the highest quality. Runtimes like Go or Deno are still havens for the ‘connoisseur’ programmer. wat (Deno seems worth checking out though!)
I've been playing with Deno lately and I can assure the author, I'm no connoisseur
Re: Deno.js in production
#10It is disappointing to see this message as the basics of what the software is on their site ( https://deno.land/ ): Deno is a simple, modern and secure runtime for JavaScript, TypeScript, and WebAssembly that uses V8 and is built in Rust. Only to have that immediately followed by really poor practice of suggesting this as the installation method: curl -fsSL https://deno.land/install.sh | sh This is not strictly relat…
You're about to run their software on your computer-- what's the difference with that and running their install script?
How do you guarantee that their install script is non-malicous and was actually provided by them?
There's a reason why code signing exists as a security measure.