Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

181–190 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#181

Post by tacker2000 »

FirmwareBurner wrote: post #30
ilrwbwrkhv wrote: post #26

Earlier quoted context omitted.

I mean their whole product is geared towards bad developers. And I don't say that loosely. I literally mean bad developers. Developers who do not understand what a product is and how learning something slightly more difficult such as servers and things of that nature that actually can make for a better product.

What product alternative to Nextjs would you say is targeted towards "good developers"?

Just a simple PHP backend (Laravel or symfony) with React or Vue as the frontend is probably less headache and less costly than this Next.js montrosity.

In a recent project i used Inertia as a layer to communicate between Laravel and React and I must say, its a breeze. No more frontend API endpoints needed.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#182

Post by tacker2000 »

ryoshu wrote: post #37
ramoz wrote: post #32

VC influence in the web space has been a fascinating thing. I hope Next's downfall sends a signal to the quality lib maintainers and changes direction (e.g. Remix and a f'd up router, TanStack w/ Start). SSR frameworks make me vomit.

SSR is fine. We used to call it "PHP" or "Ruby" or "Java." People need to stop reinventing things, but feature development outweighs maturity when you have funding.

There is a big difference here.

The stuff you mention was “born” at the backend and was then used to render frontend html at the very beginning then css, then JS etc…, but going from a frontend framework like React to the backend is an entirely different beast.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#183

Post by mary-ext »

dimal wrote: post #176
arnaudsm wrote: post #160

Earlier quoted context omitted.

Most bad tech decisions of Next.js are motivated by their business model, notably the middleware system to promote edge functions. If you're looking for something simpler that's closer to Next's original premice, Remix.js is awesome and much lighter.

Hmm. I haven’t used Remix but I’ve avoided it for exactly the same reason, that I might become a victim of their latest business model. They got their start way back with React-Router. At the time, their business was React Training. They’d train people how to use React. React Router had this curious tendency to change its API drastically with each release. Stuff you depended on would suddenly go away, and you’d be to…

I've decided that if I ever had a need to write React apps I would stick to react-router 6.0.0 specifically.

I think they did good with v6 despite drastically changing it, but the v7+ smells like trouble.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#184

Post by arandomusername »

whoknowsidont wrote: post #173
arandomusername wrote: post #153

Earlier quoted context omitted.

Isn't next.js the "source system" (or whatever that means) in most cases, since most apps are just next.js + database? I don't use next.js but my understanding is it does both backend and frontend. You will never bypass middleware on my services because they actually always run. If you can't rely on your middleware then you are using the wrong tech. I haven't heard any good reason as to why not have auth in your midd…

>Isn't next.js the "source system" Absolutely not. You are pulling from something else. If you need authorization to view a page that means it's more than likely not going to be SSG or ISR, so both the Next.JS application and the source system should be doing authorization checks. >If you can't rely on your middleware then you are using the wrong tech. "If you can't rely on server less functions to run" I mean, I can…

> I mean, I can't help you there if that's your expectation that serverless functions will always run correctly.

Crashing, failing I/O, are expected. What's not expected is logic code being ignored. I can't take you serious when you think it's acceptable to just skip past parts of your code.

If you think bypassing middlewares is acceptable you are completely deluded. But I guess that's needed to pay $150/TB for bandwidth.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#185

Post by azemetre »

blovescoffee wrote: post #147
impulser_ wrote: post #119

If anyone is looking for a good alternate to NextJS, try looking into Tanstack Start. It's currently Beta but it will probably be the best way to build full stack React apps when it hits 1.0 so it might be worth looking into for future apps. You just add a plugin into Vite and gain SSR, streaming, server functions, API routes with minimal configuration. You basically just add a ssr.tsx and client.tsx file into your e…

What makes it a good alternative? The fact it’s in beta would be a non starter for my org but it’s possible once it’s out of beta it would be worth looking at.

Is Vercel any different in this regard? they’ve often broke APIs between releases too. The fact that a company that raised $500million is on par with a small team of volunteers is more damning not less.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#186

Post by unplug8224 »

blovescoffee wrote: post #147
impulser_ wrote: post #119

If anyone is looking for a good alternate to NextJS, try looking into Tanstack Start. It's currently Beta but it will probably be the best way to build full stack React apps when it hits 1.0 so it might be worth looking into for future apps. You just add a plugin into Vite and gain SSR, streaming, server functions, API routes with minimal configuration. You basically just add a ssr.tsx and client.tsx file into your e…

What makes it a good alternative? The fact it’s in beta would be a non starter for my org but it’s possible once it’s out of beta it would be worth looking at.

The maintainer also renamed their most popular package (react-query, which was ubiquitous and highly regarded) to fit their eponymous Tanstack branding, meaning if you didn't hear about it somewhere else you would just stop being notified of updates.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#187

Post by SahAssar »

root_axis wrote: post #143
cromka wrote: post #99

Earlier quoted context omitted.

What's the next best alternative? Astro?

Express?

Express is not a next.js alternative. It covers a small part of the server-side parts but none of the templating, client, etc.

Besides the standard parts IIRC next.js has stuff for image & font optimization and more.

I really dislike next.js, but saying express is an alternative for most next.js apps is not true.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#188

Post by KingInTheFnord »

dminik wrote: post #155

Tbh the entire middleware system in Next is awful and everyone would be better off if it was scrapped and reimplemented from scratch. For starters, there's no official way to chain multiple middlewares. If you want to do multiple things, you either stuff it all into a single function or you have to implement the chaining logic yourself. Worse, the main functions (next, redirect, rewrite, ...) are static members on an…

This is my biggest complaint about nextjs. The middleware implementation is horrific.

No way to communicate information from middleware to requests means people encode JSON objects into text and add it as a header to be accessed from requests using headers(). They put session/auth info in there.

I would never recommend the framework to anyone on this basis alone.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#189

Post by ashishb »

tshaddox wrote: post #69
ashishb wrote: post #39

Next.js is based on a fundamentally flawed premise that one can write code that runs in the browser as well as the backend. The security posture for the code running in the browser is very different from the code running on a trusted backend. A separation of concerns allows one to have two codebases, one frontend (untrustworthy but limited access) and one backend (trustworthy but a lot of access).

This vulnerability has nothing to do with isomorphic code, right? Next middleware only runs on the server (or on “the edge,” which is still a server even if it’s running in a browser-esque environment).

How many frontend (full stack) guys even understand the difference?

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#190

Post by ashishb »

mgraczyk wrote: post #59
ashishb wrote: post #53

Earlier quoted context omitted.

How many startups/small companies that uses next.js do any static verification?

I don't know, but I am just pointing out that the problems here are really about execution, not vision. There's no reason we can't properly enforce security boundaries in the browser, we already do it between the website's code and the local machine. These ideas have been around a long time and predate the internet. See for example Liskov's work on Thor: https://dl.acm.org/doi/pdf/10.1145/233269.233346

If a vision has not been executed despite so many people trying may be something is wrong with it?
Post reply on HN