Deno.js in production • Hacker News Board

Re: Deno.js in production

#31

Post by DrFell » Tue, May 10, 2022, 7:04 PM UTC

jonny_eh wrote: post #12

3np wrote: post #2

> Node.js is too easy to get started. This means that the pool of available programmers is not the highest quality. Runtimes like Go or Deno are still havens for the ‘connoisseur’ programmer. wat (Deno seems worth checking out though!)

"Too easy to get started" is just gate keeping.

Reverse gate keeping, yeah. You built a fence around your safe zone, and locked yourself in.

Re: Deno.js in production

#32

Post by dimitrios1 » Tue, May 10, 2022, 7:07 PM UTC

systemvoltage wrote: post #13

BeefWellington wrote: post #8

Earlier quoted context omitted.

There's quite a bit wrong with this idea that "It's using SSL [therefore it's safe]", assuming your meaning there. The most obvious case: someone compromises the installation script on the actual real deno server. Right now the webserver there is returning an HTTP/307 to an HTTP/302 to the "current" installation script file. Any compromise of the webserver makes this very dangerous. Contrast that with proper signed p…

I think this is a fair criticism and deserves attention. Whenever anything shiny comes around, we are too enamored by it to not allow any criticism. Is there a reason Deno is not packaged as a repo in official apt, deb, yum, etc repositories?

And in this hypothetical scenario, how does that protect against the aforementioned attack? If one of deno's hosting sites can be attacked to upload a malicious script, one of the package registries can also be attacked and upload a malicious package.

Re: Deno.js in production

#33

Post by llanowarelves » Tue, May 10, 2022, 7:13 PM UTC

krautsourced wrote: post #24

unwind wrote: post #21

> ‘Deno’ (like ‘Node’ but backwards) Yeah, no. I wonder if more people just assume that to be true, heh. I kind of was expecting it, weirdly enough. Hint: "node" is "edon" backwards. Not sure if that name is taken for something Javascripty ... * goes to check * yeah, I found [1] which seems to be 4 years old, tagline "Run browser JS in the terminal". [1] https://github.com/dbkaplun/edon

Deno is No|de swapped. So no, not backwards. But... how would one call it?

Transposed

Re: Deno.js in production

#34

Post by throwawaymaths » Tue, May 10, 2022, 7:16 PM UTC

krautsourced wrote: post #24

unwind wrote: post #21

> ‘Deno’ (like ‘Node’ but backwards) Yeah, no. I wonder if more people just assume that to be true, heh. I kind of was expecting it, weirdly enough. Hint: "node" is "edon" backwards. Not sure if that name is taken for something Javascripty ... * goes to check * yeah, I found [1] which seems to be 4 years old, tagline "Run browser JS in the terminal". [1] https://github.com/dbkaplun/edon

Deno is No|de swapped. So no, not backwards. But... how would one call it?

Backwards (in Japanese)

Re: Deno.js in production

#35

Post by smrtinsert » Tue, May 10, 2022, 7:18 PM UTC

krautsourced wrote: post #24

unwind wrote: post #21

> ‘Deno’ (like ‘Node’ but backwards) Yeah, no. I wonder if more people just assume that to be true, heh. I kind of was expecting it, weirdly enough. Hint: "node" is "edon" backwards. Not sure if that name is taken for something Javascripty ... * goes to check * yeah, I found [1] which seems to be 4 years old, tagline "Run browser JS in the terminal". [1] https://github.com/dbkaplun/edon

Deno is No|de swapped. So no, not backwards. But... how would one call it?

Shifted

Re: Deno.js in production

#36

Post by benatkin » Tue, May 10, 2022, 7:21 PM UTC

krautsourced wrote: post #24

unwind wrote: post #21

> ‘Deno’ (like ‘Node’ but backwards) Yeah, no. I wonder if more people just assume that to be true, heh. I kind of was expecting it, weirdly enough. Hint: "node" is "edon" backwards. Not sure if that name is taken for something Javascripty ... * goes to check * yeah, I found [1] which seems to be 4 years old, tagline "Run browser JS in the terminal". [1] https://github.com/dbkaplun/edon

Deno is No|de swapped. So no, not backwards. But... how would one call it?

It's also backwards, but by two character groups, or if you prefer, consonant-vowel groups.

Re: Deno.js in production

#37

Post by cercatrova » Tue, May 10, 2022, 7:22 PM UTC

RussianCow wrote: post #15

threatofrain wrote: post #11

Earlier quoted context omitted.

This means at the level of their ability to draw in candidates, Deno interest is signal to their hiring pipeline of more quality. The consequence is their hiring pool is also that much smaller. One might say the same thing about Java v Go.

> The consequence is their hiring pool is also that much smaller. In the current market, unless you're a big company that gets flooded with applications on a daily basis, why would you ever reduce your hiring pool arbitrarily? If you're a 13-person startup with good funding, you want all the candidates you can possibly get. Excluding potentially great engineers because they've never worked with Deno doesn't make any…

It does make sense, because you filter out the non enthusiasts, a proxy for great programmers. When Rust was still nascent, the people interested in it were likely to be of a higher quality bar than any regular old Javascript dev. That's not to say that JS is bad necessarily, just that enthusiasts correlate to great programming skills.

Re: Deno.js in production

#38

Post by __ryan__ » Tue, May 10, 2022, 7:22 PM UTC

BeefWellington wrote: post #8

winrid wrote: post #5

Earlier quoted context omitted.

It's using SSL, what's the real world concern here? Other than someone might get copy-paste happy and someday install something they don't want.

There's quite a bit wrong with this idea that "It's using SSL [therefore it's safe]", assuming your meaning there. The most obvious case: someone compromises the installation script on the actual real deno server. Right now the webserver there is returning an HTTP/307 to an HTTP/302 to the "current" installation script file. Any compromise of the webserver makes this very dangerous. Contrast that with proper signed p…

This makes sense. But how do I as a basic user make sure the signature is correct and definitely from Deno? Couldn’t a hacker sign it with their own signature?

Re: Deno.js in production

#39

Post by benatkin » Tue, May 10, 2022, 7:25 PM UTC

In the security model section it doesn't mention workers. In Deno, workers can be given different permissions. The article suggests having different permissions per file. I think it might be nice to have both but if I could only have one I would want separate permissions per worker. Files aren't always split along the same lines that permissions should be split. I would like to be able to control permissions by url prefix though - so some library doesn't do more than I want it to. It might mean setting up a worker if I want to make sure it doesn't indirectly use more dependencies.

Re: Deno.js in production

#40

Post by film42 » Tue, May 10, 2022, 7:25 PM UTC

unwind wrote: post #21

> ‘Deno’ (like ‘Node’ but backwards) Yeah, no. I wonder if more people just assume that to be true, heh. I kind of was expecting it, weirdly enough. Hint: "node" is "edon" backwards. Not sure if that name is taken for something Javascripty ... * goes to check * yeah, I found [1] which seems to be 4 years old, tagline "Run browser JS in the terminal". [1] https://github.com/dbkaplun/edon

"node".split("").sort.join("")