Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno 1.0

deno.land

Post reply on HN
Print view View original

561–570 of 598 posts

Re: Deno 1.0

#561

Post by jkrems »

otoburb wrote: post #557
lame88 wrote: post #550

I briefly looked over this project when this link first popped up and didnt think much of it, but then i was surprised to see this huge surge in votes. I dont do much in the javascript and related world - can someone explain what in particular about this project has generated such interest? Even after reading the top comments, I feel like im missing the bigger pitcure.

>> I dont do much in the javascript and related world - can someone explain what in particular about this project has generated such interest? The majority of the interest lies in the fact that Ryan Dahl[1] was the original creator of Node.JS[2], which is currently a very popular Javascript runtime and web backend. Dahl released the initial version of Node.JS in 2009[3]. After a decade of experience working on Node.J…

> After a decade of experience working on Node.JS and growing the community, Dahl decided to create an alternative Javascript (and Typescript) runtime in mid/late 2018 called Deno which is now v1.0.

Just to nit-pick: Ryan Dahl had stepped away from node and the surrounding ecosystem in 2012. So for the vast majority of node's lifetime, he hasn't really been involved. Node in 2012 was a very different project.

(That doesn't take away from his observations or from the things that deno does differently. Just trying to reduce confusion.)

Re: Deno 1.0

#562

Post by diffrinse »

bgdam wrote: post #151
aazaa wrote: post #138

> ... Deno is (and always will be) a single executable file. Like a web browser, it knows how to fetch external code. In Deno, a single file can define arbitrarily complex behavior without any other tooling. > ... > Also like browsers, code is executed in a secure sandbox by default. Scripts cannot access the hard drive, open network connections, or make any other potentially malicious actions without permission. The…

See the thing about the sandbox is that it's only going to be effective for very simple programs. If you're building a real world application, especially a server application like in the example, you're probably going to want to listen on the network, do some db access and write logs. For that you'd have to open up network and file access pretty much right off the bat. That combined with the 'download random code fro…

Looking at the flags, one can envision future updates providing flags for scoping to directories, PIDs, domain/IP ranges

Re: Deno 1.0

#563

Post by e12e »

mrkurt wrote: post #231
tolmasky wrote: post #227

Earlier quoted context omitted.

You don’t like checking for security updates?

Lately I just merge GitHub's pull requests for that. ;) I don't like running "npm update" to try and get security updates, though. npm packages aren't very rigorous about PATCH level changes.

Well, at least you seem to be using cargo for the rust parts.

Since this stuff is breaking an new anyway, it would be nice to see dependency resolution and a reasonable way for historically reproducible builds (prod runs server 1.0.4 which is 5 years old, let's build that locally to do some bug fixing, using the same dependencies, gradually bringing it up to current 3.7.1...).

Sounds like the lifecycle management of deno projects will about as much fun as php before package management. And about as reliable.

Re: Deno 1.0

#564

Post by xevrem »

mekster wrote: post #548
Aldo_MX wrote: post #525

Earlier quoted context omitted.

My concern is what happens when popular-library.io goes down or gets hacked? Or how about attack vectors like DNS poisoning? or government-based firewalls? I know there's this[1], but somehow I still feel uneasy because the web is so fragile and ephemeral... At the very least I would like to have the standard library offline... [1] https://github.com/denoland/deno/blob/master/docs/linking_to...

> what happens when popular-library.io goes down or gets hacked? What is anyone going to do about it? Anything has a chance of getting hacked or goes down just when you need it, be it GitHub, npmjs.org... Blaming the tool for not having a protection against DNS poisoning is a bit far fetched.

ultimately i guess it is about how/if deno caches its imports. with node.js/npm you have the exact same problems, just the source & sink occur at different places (package installation)

Re: Deno 1.0

#565

Post by TechBro8615 »

Aldo_MX wrote: post #525
didip wrote: post #332

I like what Deno is selling. URL like import path is great, I don't know why people are dismissing it. It is easy to get up-and-running quickly. Looks like my personal law/rule is in effect again: The harsher HN critics are, the more successful the product will be. I have no doubt Deno will be successful.

My concern is what happens when popular-library.io goes down or gets hacked? Or how about attack vectors like DNS poisoning? or government-based firewalls? I know there's this[1], but somehow I still feel uneasy because the web is so fragile and ephemeral... At the very least I would like to have the standard library offline... [1] https://github.com/denoland/deno/blob/master/docs/linking_to...

Do you also share these concerns about golang? Isn’t it basically the same system?

Re: Deno 1.0

#566

Post by mgolawala »

another-dave wrote: post #437
yoz-y wrote: post #416

Earlier quoted context omitted.

> What protection does NPM actually give you? Dependency version pinning comes to mind. The main difference between this and a random URL is that at least you know that if the module gets bought by a third party, your services or build system won't auto update to some rando's version of the package. IIRC there have been cases when a version was replaced as well. I think this could be fixed quite easily if one could a…

Yeah, basically sounds like they could implement it à la Content Security Policy in the browser and it would be well understood right off the bat. Or similar to node_modules, have some way to pull your dependency graph & host locally — At least for enterprise-y adoption I imagine that people will want to have _their_ copy of the code and choose when to update it even if in theory the remote code is locked down.

That is what I figured too. People are rightly concerned about the security implications of this new paradigm of including package dependencies.

These concerns and the conversation around them are good and healthy. Give it some time. People will experiment with what works and over time best practices will emerge for the set of trade offs that people are willing to make.

Re: Deno 1.0

#567

Post by ioncube »

swrobel wrote: post #520
appleflaxen wrote: post #463

This project looks really cool to me. I'm glad the link to the video is there, because my intuition about pronouncing the name was incorrect. It looks like it could be "deeno" OR "denno", and I was pushed to the former by the presence of the dinosaur graphic. Isn't that old fashioned dinosaur on the Flinstones pronounced deeno? Anywho... good name overall: short, no collisions (i think?), and no strong baseline assoc…

What video? Mind linking directly?

I think he meant Ryan Dahl's talk: Design Mistakes in Node https://www.youtube.com/watch?v=M3BM9TB-8yA

Re: Deno 1.0

#568

Post by lenkite »

gpm wrote: post #519
lenkite wrote: post #486

Earlier quoted context omitted.

Root certificate not trusted for https://denoweekly.com/ on both chrome and firefox.

Maybe they fixed this in the last 2 hours, but it works for me (firefox, linux).

Weird, it still says that "Cisco Umbrella Root CA" is not trusted. Maybe its only from certain countries.

Re: Deno 1.0

#569

Post by gpm »

lenkite wrote: post #568
gpm wrote: post #519

Earlier quoted context omitted.

Maybe they fixed this in the last 2 hours, but it works for me (firefox, linux).

Weird, it still says that "Cisco Umbrella Root CA" is not trusted. Maybe its only from certain countries.

I'm Canadian and in Canada for what it's worth. Clicking on the lock tells me that it was verified by lets encrypt. The root is "Digital Signature Trust Co." Common Name "DST Root CA X3".

Cisco sounds like a router might by running a MITM on you?

Edit: This looks to be confirmation that that root (or one by a very similar name) is used by a MITM tool:

https://docs.umbrella.com/deployment-umbrella/docs/rebrand-c...

Re: Deno 1.0

#570

Post by kminehart »

TechBro8615 wrote: post #565
Aldo_MX wrote: post #525

Earlier quoted context omitted.

My concern is what happens when popular-library.io goes down or gets hacked? Or how about attack vectors like DNS poisoning? or government-based firewalls? I know there's this[1], but somehow I still feel uneasy because the web is so fragile and ephemeral... At the very least I would like to have the standard library offline... [1] https://github.com/denoland/deno/blob/master/docs/linking_to...

Do you also share these concerns about golang? Isn’t it basically the same system?

Golang does have https://proxy.golang.org/, which is fairly recent, but yes this is absolutely a problem in Go.

See the "go-bindata" problem.

Post reply on HN