Live data from Hacker News

Deno, a secure TypeScript runtime using V8 and Go

github.com

31–40 of 42 posts

Re: Deno, a secure TypeScript runtime using V8 and Go

#31
post #25

I guess the idea is to use URL's for importing packages. And have an extra security layer in the runtime. I've done some concept/prototype for this but in the browser, and the main complaint is that it takes a few extra ms the first time you run the program. But as this is meant for servers and not impatient users, the extra startup time should not be a big issue.

Importing URLs is how ES modules work afaik

Re: Deno, a secure TypeScript runtime using V8 and Go

#32
post #26

Binary size 55 meg, compared to Node's 30. Is this an artifact of Go's "dynamic linking considered harmful" approach or does it have some additional functionality I'm missing?

> Go's "dynamic linking considered harmful" approach

If anything this is only partially true: "Package plugin implements loading and symbol resolution of Go plugins."

https://golang.org/pkg/plugin

Re: Deno, a secure TypeScript runtime using V8 and Go

#33
post #5

Is this to add a scripting language to Go, like Lua is to Redis? It's a little unclear.

It would seem that the goal is to be modernized node that defaults to Typescript instead of Javascript and uses vgo-style package management instead of npm (or similar).

Re: Deno, a secure TypeScript runtime using V8 and Go

#34
post #20

Earlier quoted context omitted.

> Surely there are many other exploitation factors such as running up the CPU...the primary use case would be ideal to help me understand. You're probably running untrusted JavaScript in your browser right now. The difference between the V8 in Node and the V8 in your browser is that one is heavily locked down and the other can do essentially whatever the OS lets it. If you have untrusted code to run, you can eliminat…

but that's a problem that's more easily solvable further up the stack with VMs or containers. Everyone keeps saying this, let containers handle cpu/heap but I keep asking myself, is it really optimal?

I mean, it certainly depends. But relying on your interpreter to manage CPU scheduling and memory use is almost certainly less ideal than letting your OS/hypervisor do that for you.

Re: Deno, a secure TypeScript runtime using V8 and Go

#36
post #31
post #25

I guess the idea is to use URL's for importing packages. And have an extra security layer in the runtime. I've done some concept/prototype for this but in the browser, and the main complaint is that it takes a few extra ms the first time you run the program. But as this is meant for servers and not impatient users, the extra startup time should not be a big issue.

Importing URLs is how ES modules work afaik

Right, the pluggable Loader spec [1] can keeps getting kicked down the road, and the Browsers haven't agreed yet on Node-style or non-URL-based loading. To the Browsers, URLs "just work" and is how they've always done things, and figuring out Node-like package boundaries or mapping package names to URLs hasn't seemed like a priority to them yet.

[1] https://github.com/whatwg/loader

Re: Deno, a secure TypeScript runtime using V8 and Go

#38

Earlier quoted context omitted.

I thought the whole point of Show HN was for the creator to post their own project so that we can then talk to them about it. It doesn't make sense to create Show HN for any ol project.

Is that the case? I thought it might have been, but then took a gander at the "Show" tab and noticed other people were clearly submitting stuff with the [Show HN] prefix when they weren't the original author. Apologies if I screwed up. Definitely not trying to take credit for Ryan's work.

Yep, that's definitely the case. It's not the end of the world, but, generally, don't use "Show HN" to highlight work that isn't yours.

Re: Deno, a secure TypeScript runtime using V8 and Go

#40

What is this? A Node.js runtime equivalent for TypeScript? But written in Go and V8? Is it single threaded, non-blocking IO? Or will it more closely aligned with Go coroutines? i.e. do I have to deal with callbacks and/or async/await?

Looks like it's aiming to be async/await compliant but dunno how that is implemented.
Post reply on HN