Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Next.js version 15.2.3 has been released to address a security vulnerability

nextjs.org

Post reply on HN
Print view View original

211–220 of 220 posts

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#211

Post by shepherdjerred »

sureIy wrote: post #165
shepherdjerred wrote: post #104

Earlier quoted context omitted.

What do you get out of Next.js over vanilla React? I've never understood why that ecosystem is so popular. Anyway though, Astro is lovely, especially for static site generation.

Not everyone wants to build a website from scratch. Most people hate build systems.

Building a React app "from scratch" with Vite is this complicated:

import { defineConfig } from 'vite'

import react from '@vitejs/plugin-react'

export default defineConfig({

  plugins: [react()],
})

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#212

Post by TheCoelacanth »

mattmanser wrote: post #127
whoknowsidont wrote: post #40

Earlier quoted context omitted.

You said it was easy to refute yet you merely stated a mis-framed, contrarian perspective. If you're going to try to be pedantic, do it right? >Next.js would be a terrible choice for any app that has any non-trivial compute Most web apps only need trivial compute. If you're including back-office, source systems in the word "web app" well that's your sticking point, not mine.

How is it pedantic? What is your understanding of that word? Why do I have to laboriously explain a fairly simple concept? Here you go: Javascript is a non-compiled language. It is slow, orders of mangitufes slower than other languages such as Go, Rust, C#, Java, etc. Quick note, you might not understand orders of magnitude. It means 10^n times, so 1 order of magnitude slower is 10x slower, 2 orders of magnitude is 1…

Most web apps are IO bound, not CPU. JS is just as fast at IO as any other language.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#213

Post by ianschmitz »

greysteil wrote: post #83

Can we take a moment to appreciate how good the disclosure and coordination process on this were? * Reported to the maintainers privately * Patch published and CVE issued before wider disclosure * Automated fix PRs created within minutes of public disclosure (and for folks doing proactive updates, before) The above is _really_ excellent. Compare that to Log4j, which no CVE and no patch at the time it became public kn…

It took over two weeks to triage on Vercel’s side after disclosure. How is that “good”?

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#214

Post by braebo »

cromka wrote: post #99
no_wizard wrote: post #86

Earlier quoted context omitted.

Seems indicative of the companies priorities especially as of late. This has always been an issue with Vercel. I highly recommend people stay way from their stuff.

What's the next best alternative? Astro?

SvelteKit hands down.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#215

Post by braebo »

whoknowsidont wrote: post #93
dimgl wrote: post #81

Earlier quoted context omitted.

> React added a lot of complexity to the front end, I keep hearing this but I disagree completely. Does no one remember Angular.js? Backbone? Ember.js? Even my favorite framework, Knockout, had lots of complexity. SSR has been misused widely for years and we’re now starting to see the effects of that. But there ARE great use cases for SSR. And frontend dev is the easiest it’s ever been. Run Vite Create and you have a…

Nope. Commenters here love to just state "X is over complicated!!!" when React is about the least complicated UI system across any medium there is.

You clearly haven’t used Svelte. React is the most convoluted pile of bad abstractions of all of the big frameworks.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#216

Post by ibash »

jonny_eh wrote: post #123
ibash wrote: post #114

Earlier quoted context omitted.

Why shouldn’t middleware be responsible for access control?

That should be the server. Your Nextjs app should have zero access to business data without at least an auth token. And if you're relying on middleware for auth, it'll be responsible for providing that auth token to the rest of the app. And if you bypass middleware, then there's no auth token, and no vulnerability. This is only a vulnerability if you have pages you don't want to render for some people, regardless of…

Middleware runs server side doesn't it? tbh I haven't used nextjs middleware. But in many frameworks have used middleware that provides overarching access control.

For example having all routes under `/admin/*` automatically return an error if the user is not an admin, and then the individual routes don't need to be concerns with access control.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#217

Post by tomashertus »

c-hendricks wrote: post #210
tomashertus wrote: post #205

Earlier quoted context omitted.

Javascript was never build for those use-cases. It should have stayed on the browser.

JavaScript has handled the concept of middleware for decades.

For a decade, since the intro of NodeJS

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#218

Post by whoknowsidont »

braebo wrote: post #215
whoknowsidont wrote: post #93

Earlier quoted context omitted.

Nope. Commenters here love to just state "X is over complicated!!!" when React is about the least complicated UI system across any medium there is.

You clearly haven’t used Svelte. React is the most convoluted pile of bad abstractions of all of the big frameworks.

I most definitely have. Thanks for your worthless interjection though.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#219

Post by c-hendricks »

tomashertus wrote: post #217
c-hendricks wrote: post #210

Earlier quoted context omitted.

JavaScript has handled the concept of middleware for decades.

For a decade, since the intro of NodeJS

Sorry to inform you but you're off by about 6 years, nodejs was released about 16 years ago, and express has had middleware for 14 of those years.

Re: Next.js version 15.2.3 has been released to address a security vulnerability

#220

Post by tomashertus »

c-hendricks wrote: post #219
tomashertus wrote: post #217

Earlier quoted context omitted.

For a decade, since the intro of NodeJS

Sorry to inform you but you're off by about 6 years, nodejs was released about 16 years ago, and express has had middleware for 14 of those years.

Time flies... Thanks for the correction, buddy.
Post reply on HN