Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno 1.0

deno.land

Post reply on HN
Print view View original

501–510 of 598 posts

Re: Deno 1.0

#501

Post by ric2b »

fiddlerwoaroof wrote: post #159
fermienrico wrote: post #124

Earlier quoted context omitted.

I think the primary way to manage dependencies should be in a local DIR and optionally, a URL can be specified. The default in Deno is questionable choice. Just don't fuck with what works. Default should be safest followed by developers optionally enabling less safe behaviors.

Using a universally unique identifier like a URL is a good idea: this way, https://foo.com/foo and https://bar.com/foo are distinct and anyone who can register their own name gets a namespace, without relying on yet another centralized map of names->resources. After all, the whole point of a URL is that it unambiguously identifies resources in a system-independent way.

It could be a good idea if they were immutable, like IPFS links.

Re: Deno 1.0

#502

Post by Aeolun »

a_humean wrote: post #432
Tade0 wrote: post #409

Earlier quoted context omitted.

I wonder how possible it would be to just use this: https://github.com/swc-project/swc It's still not feature-complete, but there aren't any alternatives written in Rust that I know of.

SWC does not do any typechecking. It is equivalent to babel.

Someone is working on it: https://github.com/swc-project/swc/issues/571

Re: Deno 1.0

#503

Post by ric2b »

akamaozu wrote: post #351
ryanseys wrote: post #141

Earlier quoted context omitted.

It's different because it doesn't rely on require() which is non-standard JavaScript.

setTimeout is non-standard JavaScript too but I bet your code base has multiple instances of its usage.

Is it? It's on every browser I know.

Re: Deno 1.0

#505

Post by ecares »

DarkWiiPlayer wrote: post #499
ecares wrote: post #442

Earlier quoted context omitted.

> Would you say linux is insecure because a user can download an arbitrary shell script and run it? Linux is not branded as a "Secure thing" right? Here Deno is building marketing on something inacurate.

Most people describe Linux as a much safer OS even though windows puts more restrictions on running code from the internet (to the extent of marking downloaded files as potentially dangerous and asking if you really want to execute them). I would totally understand if HTTP(not s) was used by default at any point, but by writing a URI starting with ` http://` into the file, the programmer is actively telling the progr…

Let me tell it another way:

browsers have been benefiting from decades of innovation to mitigate the security issues of execution of JavaScript.

CORS headers is the latest of theses innovations. Deno allow you to fetch code as a browser would without providing you with any of the safety browsers can have. Mostly because it would not make sense to have a runtime doing that.

Deno is not a browser but takes the risks of a browser. Running Deno install is as safe as browsing the internet using Windows CP without SP 2 and Internet explorer bellow 6.

Also, importing a module in https does not mean this module won't import anything using http. Should you review the code of all imported modules? This is virtually impossible.

Deno must disable http by defaulkt and provide a flag to re-enable it. This is factually a security issue in Deno.

Re: Deno 1.0

#506

Post by mahmoudimus »

devit wrote: post #500

What is the reason for making a JavaScript runtime based on browser APIs that cannot also be a browser? Or in other words, wouldn't it have been easier and better to make an optionally headless version of the Servo browser with additional native APIs and some enhancements like being able to run JavaScript directly in addition to HTML? The choice made means that Deno can't be used, at least directly, to make desktop a…

This is a very interesting idea - basically the new JVM is a headless browser. Fascinating to think Of the possibilities.

Re: Deno 1.0

#507

Post by [deleted] »

Rotareti wrote: post #448
thebradbain wrote: post #94

Earlier quoted context omitted.

Unlike node, recommended deno practice is to check-in your dependencies to the VCS. > Production software should always bundle its dependencies. In Deno this is done by checking the $DENO_DIR into your source control system, and specifying that path as the $DENO_DIR environmental variable at runtime. https://deno.land/manual/linking_to_external_code

du -hs node_modules 1.7G node_modules

[deleted]

Re: Deno 1.0

#508

Post by seemslegit »

Some people for the last decade: wouldn't it be great if node had a comprehensive, idiomatically coherent, thoroughly typed standard library ? Look, typescript is right here !

No-one, at all, for the love of jeebus: Do another node-like thing, but make it in rust on top of C++ (or is the other way around ?), somewhat similar but generally incompatible, have a whole different set of APIs, a bunch of new tools and yet another package/module system.

Re: Deno 1.0

#510

Post by mahmoudimus »

ignoramous wrote: post #90
firloop wrote: post #10

For the uninitiated, worth noting that one of the names on this post, Ryan Dahl, was the original node.js developer.

Also for the uninitiated, fly.io is migrating to deno for their Serverless functions: https://news.ycombinator.com/item?id=22621926

Precisely the use case that Deno should be used for. Serverless functions are a great use case for Deno right now.
Post reply on HN