Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Now: realtime Node.js deployments

zeit.co

Post reply on HN
Print view View original

71–80 of 121 posts

Re: Now: realtime Node.js deployments

#71

Post by cphoover »

scriby wrote: post #65

I used to use a project called now on npm that was abandoned a few years ago ( https://github.com/Flotype/now ). I was curious how this new project was using the same name on npm as the previous now that I had used. Looking at the npm release history, versions <= 0.8.1 are the old project, and the new project picked up at 0.9.0 (should have been 1.0.0 I guess). This is consistent with npm's statements about package n…

> but there's just something weird about reusing package names for totally different projects...

Not only is it weird but it is inherently insecure.

Even NPM's solution:

> "If a package with known dependents is completely unpublished, we’ll replace that package with a placeholder package that prevents immediate adoption of that name. It will still be possible to get the name of an abandoned package by contacting npm support."

seems susceptible to social engineering. All it takes is for one heavily depended upon package to become compromised by a malicious actor, and the entire dependency graph is poisoned.

I'm not sure of a great solution, but it really makes you question the soundness of the NPM ecosystem.

Re: Now: realtime Node.js deployments

#72

Post by alanh »

_greim_ wrote: post #54
alanh wrote: post #26

Earlier quoted context omitted.

> Every time you run `now` it's as if you had installed from scratch (including semver invalidations like ^ or ~). The focus is on reproducibility. This is very confusing to me as these seem to be contradictory statements. Installing "from scratch" (I take this to mean, as if node_modules is an empty folder) is not a reproducible action, as all it takes is one sub-dependency releasing a new version to change your ins…

I think it's "reproducible" in the sense that it starts from scratch every time, rather than sometimes starting from scratch, and other times starting with a pre-populated node_modules. If you want actual versioning reproducibility, you'll need to put an npm-shrinkwrap.json in your root.

I see. They shouldn’t use the word “reproducible” then, because something is either reproducible or it’s not.

If they just mean, “We ignore everything but your package.json to generate a deploy,” say that, don’t mis-use the word “reproducible.”

(Heroku, for example, has put a lot of effort into making deploying to their platform actually, truly, really-the-same-years-into-the-future reproducible. `npm install`, especially without shrinkwrap -- and `now` doesn't seem to be using shrinkwrap -- will never get there.)

I’m still not 100% if I get what they are doing or not.

After all, I need some sort of index.js or dist/foo.js in my package, and if they aren’t using git or anything, then isn’t this by definition happening based on transient local state (my local files at `now`-time)?

Re: Now: realtime Node.js deployments

#73

Post by alanh »

zuck9 wrote: post #33

This has a great landing page.

No, it doesn’t. Elements of it are great. The design screams “We’re programmers too,” which is great. But as the comments on this page attest, this landing page does a simply horrible job of introducing what `now` actually does.

Re: Now: realtime Node.js deployments

#74

Post by mmaunder »

Had to read three pages and still haven't quite confirmed that this is node.js hosting. But based on the pricing page, I guess it is. Can you please just say that? Just say "It's node hosting and the deployment system is fast." You literally just stole some of my life.

Re: Now: realtime Node.js deployments

#76

Post by alanh »

Rauchg wrote: post #3

CEO of https://zeit.co here! Happy to answer any questions throughout the day :)

Something that’s bothering me is: Is there any way to deploy via `now` with secrets? You know: API keys or the like? `_src` is always public in the free plan and I don’t see any documentation around providing environment variables.

Re: Now: realtime Node.js deployments

#78

Post by koolba »

Does this support native modules and is it running on Linux 64?

If so it'd be an interesting "hack" to have it run arbitrary code. You could have the default "npm run" script download a python/ruby/golang/foobar runtime and kick start an app on the expected port.

Re: Now: realtime Node.js deployments

#80

Post by kleebeesh »

creullin wrote: post #34
seibelj wrote: post #15

Red Hat Openshift has a solid free tier, free SSL, git push deployments, node / ruby / python / java / php / etc., mysql / postgres, redis. Why would I use this over that? https://www.openshift.com/

Also, Openshift is only supporting Node O.10 right now...

Not quite. I'm currently using version 5.7 on openshift. You can define the node version in the .openshift/markers/NODEJS_VERSION file.

Docs here: https://blog.openshift.com/any-version-of-nodejs-you-want-in...

Post reply on HN