Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the Hell Is a Deno?

breadth.substack.com

Post reply on HN
Print view View original

51–60 of 151 posts

Re: What the Hell Is a Deno?

#51

Post by com2kid »

dvt wrote: post #13

> Javascript is great. But... in saying that it has a few quirks and can work in some unexpected ways. Typescript has just as many[1] (in fact more, as it's a superset) quirks than Javascript. I like using it (and it makes JS type-safe-ish), but it's not really some kind of paradigm shift. Not sure how I feel about import maps. They are quite literally the same thing as package.json. In fact, converting between the t…

In regards to that first link, discriminated unions are awesome in general, it is a pattern that occurs all over the place in real world code and having compiler support for it is very nice.

Re: What the Hell Is a Deno?

#52

Post by poink »

toohotatopic wrote: post #45
thawaway1837 wrote: post #27

The security stuff for NodeJS is really frustrating. If anything, NodeJS is more secure than something like the JVM or C++. If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In fact, in Node, I can actually read the source code and see what the package is, running is doing. In nearly every other environment, you may simply have access to a binary, w…

> If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In the JVM you can use the security Manager [1] and limit file access and access to similarly sensitive areas. If you want you can fully guarantee that nothing is accessed randomly. Of course that builds on the JVM not having a zero-day bug. [1] https://en.wikipedia.org/wiki/Java_security

There are all kinds of things NPM users can do to mitigate security problems. The only interesting question is what the default is.

Re: What the Hell Is a Deno?

#53

Post by dang »

AtlasBarfed wrote: post #7

The author already inflicted one of the worst "worse is better" victories I can think of in the history of computing. Now he's fighting his own monstrosity.

Please don't cross into personal attack in HN comments. I grant you that this is borderline, but it's still dipping a toe into those black waters.

Re: What the Hell Is a Deno?

#54

Post by jakobloekke »

com2kid wrote: post #47
lol636363 wrote: post #46

Earlier quoted context omitted.

This is 100% true especially stupid libraries that are someone's class project. And JavaScript developers are so used to dependency hell that one of my developer imported 3rd party package for date formatting.

JS's built in date formatting/handling is terrible and often do what needs to be one. MomentJS may be a giant import, but it works an it works really well.

It’s the closest thing we have to a useful standard library. Date handling in js without a library is a code smell.

Re: What the Hell Is a Deno?

#55

Post by jessaustin »

CalmStorm wrote: post #18

Deno's sandbox security is somewhat similar to Mandatory Access Control (MAC) implemented by SELinux and AppArmor. But it looks like not as fine-grained as MAC. In the example: deno run --allow-net myWebserver.ts With SELinux, one can specify the port range and network interface that the application is allowed to access. It also provides audit log that can be examined by the admin. Maybe there is no need to reinvent…

Am I wrong in thinking that this example specifically does not protect against the threat posed immediately preceding it? As in, one is running a script that foolishly imports a nefarious package that uploads tasty environmental variables to an evil server, which it can do when network access is not controlled. Well, what if myWebserver.ts imports that package? A more fine-grained approach that limited network access by source file might be valuable.

Re: What the Hell Is a Deno?

#56

Post by memexy »

Deno is on my list of tools to play with. It's sandboxing capabilities are the main selling point for me because it will allow executing semi-trusted/un-trusted code on private data sets. If I know that the code can't access the network or do anything fancy with the file system then I can treat the untrusted code as a pure function and know that the output will only depend on the input. This is a very desirable property and I'm looking forward to the type of code and data sharing it will enable.

Re: What the Hell Is a Deno?

#57

Post by lol636363 »

jakobloekke wrote: post #54
com2kid wrote: post #47

Earlier quoted context omitted.

JS's built in date formatting/handling is terrible and often do what needs to be one. MomentJS may be a giant import, but it works an it works really well.

It’s the closest thing we have to a useful standard library. Date handling in js without a library is a code smell.

I am confused, are you using MomentJS for fancy output like 3 days ago etc or for simple output like 5/31/2020? I can see how it is useful in former case but seems overkill in later case.

Re: What the Hell Is a Deno?

#58

Post by randombytes6869 »

Deno is the Java-fication of JS. I'm sure there will be Node-like tide of "JS is better than Java now that we have X" even though Deno brings JS closer than ever to Java. Despite being cynical, I don't think its a bad thing. Java does a lot of things right.

Deno -> Java

Runtime security options -> Security Manager.

URL based packages with simple HTTP-> Maven works same way.

Bigger standard library -> Java's is huge.

Types -> Java, yes.

Single executable -> Fatjars.

All the features mentioned in this article have been in Java over a decade. Its relieving to see a JS runtime that finally gives in to enterprise niceties. Us Java devs like to crap on JS for reasons besides being "boomers". The features Deno brings were all real reasons to use Java instead of JS up until this point.

Now if they would only fix threading, I would consider Deno/JS a real contender for backend dev

Re: What the Hell Is a Deno?

#59

Post by memexy »

etaioinshrdlu wrote: post #43
leeoniya wrote: post #38

do permissions in deno propagate to all dependencies recursively? like, if i grant filesystem access to a top-level script, did all its imports just inherit that permission, too? if so, i can see this type of system being mostly worthless.

Yes... it would actually be quiet amazing to have different libraries in different sandboxes with defined communication channels. The browser actually does something quite a bit like this with iframes. Iframes are sandboxed and can only communicate through postMessage. There's more to it but at a simple level it looks like this. Chrome nowadays even runs iframes in a separate process! Finally... https://www.chromium.…

You could implement this by fine grained imports and subprocess execution. Node.js actually has a very nice sub-process communication API: https://nodejs.org/api/child_process.html#child_process_subp....

At some point I remember writing some gpg wrappers with Node.js and I remember the subprocess API being one of the more pleasant ones to work with. In the case of more stringent Deno process sandboxing, the parent process would spawn another Deno process with a smaller set of capabilities.

Re: What the Hell Is a Deno?

#60

Post by galaxyLogic »

fastball wrote: post #35
thawaway1837 wrote: post #27

The security stuff for NodeJS is really frustrating. If anything, NodeJS is more secure than something like the JVM or C++. If I include a 3rd party package in the JVM, I have absolutely no guarantee that it will work well, much like in Node. In fact, in Node, I can actually read the source code and see what the package is, running is doing. In nearly every other environment, you may simply have access to a binary, w…

Yeah, I feel like Deno will reduce dependency usage, and people will hurrah and say "look, using URIs as deps actually worked to make things easier!", when in reality the reason dependency hell freezes over is because Deno actually has an STL.

I agree. lack of standard library in Node.js means everybody has to re-invent the wheel, or find on on npm.

I believe there was a time when C++ did not yet have a standard library. But now it does. JavaScript should have a standard library, not "Deno".

Post reply on HN