Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno 1.0

deno.land

Post reply on HN
Print view View original

401–410 of 598 posts

Re: Deno 1.0

#401

Post by bryanrasmussen »

ecares wrote: post #397
bryanrasmussen wrote: post #391

The import from url feature is drawing a lot of initial skepticism - but I think once you look closer at it there are even more things to be wary of. The initial thing is the fear "whoa, that is hella insecure!" which, I agree NPM is basically the same problem... although, with NPM - Git system, you can 1. fork a version and use that version (which you can do with this, just host different url) or two you can freeze…

Well is has a huge security hole that ry wont fix https://github.com/denoland/deno/issues/1063

I would like to write a long damn with an exclamation point at the end but the margins of my screen are insufficient to hold it.

Re: Deno 1.0

#404

Post by ecares »

crabmusket wrote: post #403
ecares wrote: post #402

Well, there is a known MITM vuln in Deno by design and the team refuses to fix it soooooo REF: https://github.com/denoland/deno/issues/1063

Lockfiles should be used for production code, as per https://deno.land/manual/linking_to_external_code/integrity_...

That is not enough at all and there are other attacks! I can't belive in 2020 some people still need to be explained why not enforcing https is a terrible thing!

For instance, will a lockfile prevent someone from eavesdropping on the download of a modules through http? If so, please kindly tell me how!

Re: Deno 1.0

#405

Post by regularfry »

half-kh-hacker wrote: post #268
bgdam wrote: post #151

Earlier quoted context omitted.

See the thing about the sandbox is that it's only going to be effective for very simple programs. If you're building a real world application, especially a server application like in the example, you're probably going to want to listen on the network, do some db access and write logs. For that you'd have to open up network and file access pretty much right off the bat. That combined with the 'download random code fro…

Both the network and disk access permissions are granular, which means you can allow-write only to your logs folder, and allow net access only to your DB's address.

So it's reimplemented chmod and iptables?

Re: Deno 1.0

#406

Post by ecares »

Vinnl wrote: post #384
pimterry wrote: post #376

Earlier quoted context omitted.

> I thought a lot about it, and it seems as secure as node_modules, because anybody can publish to npm anyway npm installs aren't the same as installing from a random URL, because: * NPM (the org) guarantees that published versions of packages are immutable, and will never change in future. This is definitely not true for a random URL. * NPM (the tool) stores a hash of the package in your package-lock.json, and insta…

My assumption would be that new men in the middle will arise, but this time, you can pick which one to use.

btw: https://github.com/denoland/deno/issues/1063

they know there is a bad mitm vector and won't fix it

Re: Deno 1.0

#407

Post by christophilus »

turblety wrote: post #175
jfkebwjsbx wrote: post #170

Earlier quoted context omitted.

Don't ever think of trying a compiled language like C++ or Rust, then :)

I won't :P But in seriousness, Go compiles like lightening for me. But yeah, I think everyone has their own needs when they choose their tools. I choose Node for its speed at development and runtime.

Dunno why you’re downvoted. I’m in the same camp. Compilation speed is an important factor in choosing a language.

Re: Deno 1.0

#408

Post by giorgioz »

I have two questions: 1) How to port a node package to deno? 2) How to keep both a node and deno packages in the same repo?

Clearly without packages we are not going to use deno. Also I don't want to switch from well-proven packages like express/koa to an new unknown http server just because it supports deno.

Re: Deno 1.0

#409

Post by Tade0 »

nojvek wrote: post #393

> TSC must be ported to Rust. If you're interested in collaborating on this problem, please get in touch. This is a massive undertaking. TSC is a moving target. I occasionally contribute to it. It’s a fairly complex project. Even the checker + binder (which is the core of TS) is pretty complex. One idea that comes to mind is to work with Typescript team that they are only using a subset of JS such that tsc can be com…

I wonder how possible it would be to just use this:

https://github.com/swc-project/swc

It's still not feature-complete, but there aren't any alternatives written in Rust that I know of.

Re: Deno 1.0

#410

Post by K0nserv »

chrischen wrote: post #343
megavolcano wrote: post #245

Earlier quoted context omitted.

Why are you _regularly_ clearing lock files? If you're bypassing lock files you're going to have the exact same issue with npm or yarn or any other package manager that downloads from the internet.

Dunno about OP but I pin versions in package.json because it allows me to control the versions and upgrade major versions only when explicit and necessary, and rely only on the lock file to keep it the same between commit time and the production build.

That doesn’t actually work and gives you a false sense of reproducibility and stability. Sure your top level dependencies might not change without explicit changes to package.json but every time you run npm install without a lock file all transitive dependencies are re-resolved and can change.

Always commit your lock files people

Post reply on HN