Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno 1.0

deno.land

Post reply on HN
Print view View original

531–540 of 598 posts

Re: Deno 1.0

#531

Post by ecares »

haack wrote: post #526
ecares wrote: post #505

Earlier quoted context omitted.

Let me tell it another way: browsers have been benefiting from decades of innovation to mitigate the security issues of execution of JavaScript. CORS headers is the latest of theses innovations. Deno allow you to fetch code as a browser would without providing you with any of the safety browsers can have. Mostly because it would not make sense to have a runtime doing that. Deno is not a browser but takes the risks of…

> Should you review the code of all imported modules? This is virtually impossible. I wouldn't be surprised if this was exactly the direction that Deno was trying to move towards. Fewer direct dependencies with some amount of transitive trust. I.e. "[Deno] has a set of reviewed (audited) standard modules" > Windows CP without SP 2 and Internet explorer bellow 6 I get the point you're trying to make with this hyperbol…

At this point, there is clearly a vuln in a tool that brands itself as secure and in opposition with another project.

The marketing around Deno has been made toward that and it makes no sense to reach 1.0.0 with such a big security issue unhandled.

Also, this part is even more frightening https://github.com/denoland/deno/issues/1064#issuecomment-43....

At this point, it is clear that Deno is lying for marketing reason by calling itself secure.

Of course Ryan deserves empathy, so does Bert. But in the meanwhile during their talks at major conferences, they have trolled a lot another project. The maintainer of that other project now get weekly/daily pings from deno supporters trolling them.

Deno's culture seems big around trolling atm, a CoC could have fixed it, the th (B)DFL has decided another way.

Re: Deno 1.0

#533

Post by Vinnl »

goofballlogic wrote: post #530

Main thing that would prevent me investing in this stack is that the runtime has been designed with typescript in mind. In a few years if the typescript thing blows over, you're left with a runtime and conventions skewed toward statically-typed programming patterns.

As someone who works with TypeScript extensively, TypeScript patterns are basically Javascript patterns - although perhaps with slightly fewer runtime type checks.

Re: Deno 1.0

#535

Post by progx »

fsloth wrote: post #377
bgdam wrote: post #111

The dependency management is highly questionable for me. Apart from the security concerns raised by others, I have huge concerns about availability. In it's current form, I'd never run Deno on production, because dependencies have to be loaded remotely. I understand they are fetched once and cached, but that will not help me if I'm spinning up additional servers on demand. What if the website of one of the packages I…

Why can't you download all the packages you use actually with your source code? That's how software has been built for decades... I'm a desktop developer so I understand I'm the dinosaur in the room but I've never understood why you would not cache all the component packages next to your own source code. Since this is straighforward to do I presume there is some tradeoff I've not thought about. Is it security? Do you…

So build your own npm?

Re: Deno 1.0

#536

Post by softawre »

fsloth wrote: post #377
bgdam wrote: post #111

The dependency management is highly questionable for me. Apart from the security concerns raised by others, I have huge concerns about availability. In it's current form, I'd never run Deno on production, because dependencies have to be loaded remotely. I understand they are fetched once and cached, but that will not help me if I'm spinning up additional servers on demand. What if the website of one of the packages I…

Why can't you download all the packages you use actually with your source code? That's how software has been built for decades... I'm a desktop developer so I understand I'm the dinosaur in the room but I've never understood why you would not cache all the component packages next to your own source code. Since this is straighforward to do I presume there is some tradeoff I've not thought about. Is it security? Do you…

You're right. We call this "vendoring" your dependencies. And it's a good way to do things.

Re: Deno 1.0

#537

Post by haack »

ecares wrote: post #531
haack wrote: post #526

Earlier quoted context omitted.

> Should you review the code of all imported modules? This is virtually impossible. I wouldn't be surprised if this was exactly the direction that Deno was trying to move towards. Fewer direct dependencies with some amount of transitive trust. I.e. "[Deno] has a set of reviewed (audited) standard modules" > Windows CP without SP 2 and Internet explorer bellow 6 I get the point you're trying to make with this hyperbol…

At this point, there is clearly a vuln in a tool that brands itself as secure and in opposition with another project. The marketing around Deno has been made toward that and it makes no sense to reach 1.0.0 with such a big security issue unhandled. Also, this part is even more frightening https://github.com/denoland/deno/issues/1064#issuecomment-43... . At this point, it is clear that Deno is lying for marketing reas…

It seems like this is not simply about the decision of whether to allow http by default and security of dependencies.

I'm not familiar with the surrounding politics and don't particularly want to be involved, but I appreciate the explanation.

Re: Deno 1.0

#538

Post by regularfry »

tuukkah wrote: post #413
regularfry wrote: post #405

Earlier quoted context omitted.

So it's reimplemented chmod and iptables?

Typically, chmod and iptables are not used to restrict applications. Applications are restricted by virtual machines, containers, sandboxes, AppArmor profiles, SELinux policies…

There's a fairly long history of giving applications their own uid to run under which puts chmod and chown in control of filesystem operations the app is allowed to perform. "Typically" maybe not, but it's hardly unusual.

iptables + namespaces gives you the rest.

Re: Deno 1.0

#540

Post by dilandau »

Based on the number of votes, hns audience must skew overwhelmingly JavaScript/web developer. I guess that explains quite a bit.

Web developer fascination with NIH and tooling has produced a fragmented, unstable ecosystem. But I guess one more thing won't hurt them. They seem to have unnaturally high tolerance for pain.

Post reply on HN