Pika/web: Web Apps Without the Bundler • Hacker News Board

Re: Pika/web: Web Apps Without the Bundler

#81

Post by curry-castaway » Wed, Mar 20, 2019, 4:06 PM UTC

z3t4 wrote: post #74

ownagefool wrote: post #72

Earlier quoted context omitted.

If you care about security, you should evaluate your dependencies. This preferably means reading the code you're pulling in but it's unrealistic that we're going to read 2000 constantly changing dependencies for every deploy, so you need to establish trust some how. Reputation of maintainers, dep CVE scanning, SAST and protective monitoring can all add additional assurance, but they won't protect you from a random hi…

I used to have all npm modules in source control (SCM), until npm introduced tree shaking. I'm using ZFS which have both de-duplication and compression, so I gain very little by tree shaking. I wish there was a way to disable tree shaking in npm, it's really the source of all evil. Anyway, I reviewed all code diffs after each npm update, very little changed, eg. it wasn't that much work. But it's now impossible as np…

I committed my dependencies until recently too, and I've been trying to figure out a better alternative. Are you doing something else now rather than committing dependencies? (Right now I'm just using a hodgepodge of npm scripts to lock things down.)

Re: Pika/web: Web Apps Without the Bundler

#82

Post by __oh_es » Wed, Mar 20, 2019, 4:29 PM UTC

jaabe wrote: post #75

ownagefool wrote: post #73

Earlier quoted context omitted.

I disagree that it's the job of a random ops person to ensure that a developers dependencies are sane. Putting the onus on the developer to do a good job with regards to secure development practices is an essential part of a wider system.

Oh I agree with that completely, but it’s very easy for developers to get away with shitty practices in a lot of shops.

Agree with you but this goes the other way too - Ops not allowing security patching or upgrading of systems because "they work".

Re: Pika/web: Web Apps Without the Bundler

#83

Post by fiatjaf » Wed, Mar 20, 2019, 6:04 PM UTC

Webpack is a big mess that always has some bug and shortcoming a new major breaking release upcoming, because it tries to do so much.

Browserify does one thing and does it very well.

I still would like to not have to use any of these, however.

Re: Pika/web: Web Apps Without the Bundler

#84

Post by rhizome » Wed, Mar 20, 2019, 7:05 PM UTC

omnimus wrote: post #76

rhizome wrote: post #61

Earlier quoted context omitted.

That never really works out in practice So glad this was such dominant practice and advice for the last 10 years. I wonder for how many of those influential practictioners have known it's more of a lazy include than clever cache reuse. Cargo culting writ larger than most.

It really depends. I think CDNs are still great if you are making smaller content website with few libs for things like lightboxes, sliders etc. It works out better than bundling. There is much less complexity without build process. Many websites don't need too much JS and devs tend to overengineer them nowdays. If you are talking about products with lot of dependencies then of course but don't forget that bundler si…

I'm speaking to the jquery example. 99% of howtos have instructed people to pull from CDN because everybody (probably) already has it. It has been conventional wisdom for a long, long time.

I just checked, and googling "jquery cdn faster" brings up plenty of examples.

Re: Pika/web: Web Apps Without the Bundler

#85

Post by Torgo » Thu, Mar 21, 2019, 2:45 PM UTC

yardstick wrote: post #65

curry-castaway wrote: post #64

Earlier quoted context omitted.

> The real question is: do you -really- need an external lib with 20 dependencies just to show a freakin’ loading spinner? Remaking the wheel is bad but so is never making truly simple things yourself, or just not using them. So the problem is the sheer number of dependencies? What is a reasonable upper limit? Yes, javascript should continue to standardize commonly used features, but avoiding dependencies doesn't see…

From a security perspective, minimising dependencies is preferred. I have to review at least monthly all our dependencies for published vulnerabilities and new versions. We don’t allow automatic upgrading of packages/dependencies due to the risk of malicious code making it in (see https://www.npmjs.com/advisories for examples). Yeah there are companies that will help manage your vulnerability process but it’s still a…

>I have to review at least monthly all our dependencies for published vulnerabilities and new versions.

Off-topic, but can you write about how you manage this without tons of manual work?