What the Hell Is a Deno? • Hacker News Board

Re: What the Hell Is a Deno?

#31

Post by irjustin » Thu, Jun 04, 2020, 3:39 AM UTC

ChristianBundy wrote: post #21

irjustin wrote: post #20

My gripe with npm was the lack of a lock file. - Yarn helped solve that, but because of its backwards compatibility to node_modules, you could not have different versions sitting side-by-side. - Node_modules could have a different version installed vs lock file and no one would know without looking. It seems Deno is able to solve the side-by-side versions and distributing the 'lock' to the file itself. The Deno team…

Does package-lock.json not fill this void? It's been a thing for a few years IIRC.

Partially, like the yarn.lock it only filled half the problem. The other half is being able to have multiple versions installed at the same time and freely, confidently referencing the version I want.

node_modules can only have one version and it's not hard to have version drift even while having a lock. The standard answer is to do the `rm -rf node_modules` & install. Often that fixes whatever problem creeped in.

Blowing away a package directory to solve problems for years should not be the answer.

Re: What the Hell Is a Deno?

#32

Post by applecrazy » Thu, Jun 04, 2020, 3:45 AM UTC

akdor1154 wrote: post #19

mrpopo wrote: post #5

> Both the browser and node.js use the same engine - the V8 engine. RIP every other engine, I guess?

> RIP every other engine, I guess? In practice, pretty much :(

React Native uses JavaScriptCore, the JS engine for WebKit, at runtime.

Re: What the Hell Is a Deno?

#33

Post by cellularmitosis » Thu, Jun 04, 2020, 3:52 AM UTC

hst-m wrote: post #4

rvz wrote: post #2

Node => Deno => Done. One can simply say, 'Deno is like Node but done right'.

'node'.split('').sort().join('')

its also a nice illustration of little endian vs big endian.

Re: What the Hell Is a Deno?

#34

Post by rahulete » Thu, Jun 04, 2020, 3:54 AM UTC

danenania wrote: post #6

Deno definitely looks interesting! All the examples I’ve seen so far are using the ‘deno’ command to run .ts or .js scripts. Can it also package standalone binaries like go/rust—-to make a cli tool, for instance? If so, how do permissions work in that scenario? Does the user need to grant permissions on every invocation or is there some way to whitelist a script/binary?

Packaging to standalone executable is being worked on https://github.com/denoland/deno/issues/986

Re: What the Hell Is a Deno?

#35

Post by fastball » Thu, Jun 04, 2020, 3:56 AM UTC

thawaway1837 wrote: post #27

The security stuff for NodeJS is really frustrating. If anything, NodeJS is more secure than something like the JVM or C++. If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In fact, in Node, I can actually read the source code and see what the package is, running is doing. In nearly every other environment, you may simply have access to a binary, w…

Yeah, I feel like Deno will reduce dependency usage, and people will hurrah and say "look, using URIs as deps actually worked to make things easier!", when in reality the reason dependency hell freezes over is because Deno actually has an STL.

Re: What the Hell Is a Deno?

#36

Post by Matthias247 » Thu, Jun 04, 2020, 3:59 AM UTC

CalmStorm wrote: post #18

Deno's sandbox security is somewhat similar to Mandatory Access Control (MAC) implemented by SELinux and AppArmor. But it looks like not as fine-grained as MAC. In the example: deno run --allow-net myWebserver.ts With SELinux, one can specify the port range and network interface that the application is allowed to access. It also provides audit log that can be examined by the admin. Maybe there is no need to reinvent…

From the docs at https://deno.land/manual/getting_started/permissions:

> --allow-net=\ Allow network access. You can specify an optional, comma separated list of domains to provide a whitelist of allowed domains.

So it seems to allow for a bit more fine-grained configs than just opening up everything.

Re: What the Hell Is a Deno?

#37

Post by jfkebwjsbx » Thu, Jun 04, 2020, 4:04 AM UTC

thawaway1837 wrote: post #27

The security stuff for NodeJS is really frustrating. If anything, NodeJS is more secure than something like the JVM or C++. If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In fact, in Node, I can actually read the source code and see what the package is, running is doing. In nearly every other environment, you may simply have access to a binary, w…

Because in those languages:

. dependencies are carefully considered by users

. dependencies are not added recursively

. dependencies try to be dependency-free themselves to assist with the previous point

. dependencies are not blindly nor automatically updated

. dependencies solve important domain problems, they are not trivial one-line-functions

. dependencies are typically developed and tested by a known team or company, which you trust, not just someone random

. binaries can be signed

. support contracts are a thing

. etc etc etc...

Re: What the Hell Is a Deno?

#38

Post by leeoniya » Thu, Jun 04, 2020, 4:06 AM UTC

do permissions in deno propagate to all dependencies recursively? like, if i grant filesystem access to a top-level script, did all its imports just inherit that permission, too?

if so, i can see this type of system being mostly worthless.

Re: What the Hell Is a Deno?

#39

Post by boromi » Thu, Jun 04, 2020, 4:10 AM UTC

Is the goal to have this also work for electron executables?

Re: What the Hell Is a Deno?

#40

Post by battery_cowboy » Thu, Jun 04, 2020, 4:10 AM UTC

> This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts

FYI, I read the whole article without JS fine, thanks for making the site work without it even if it says it doesn't.