Hacker News Reader

Comment by owebmaster | Hacker News Reader

The irony of a company using Nextjs for a chat app and React for a terminal UI talking about reducing attack surface.

React is actually pretty good for any kind of reactive interface, and it's small. Something under 3k lines of code, and it's well battle tested at this point.

You might have a dislike of react and that's fine, but it's not adding any significant attack surface to a project.

Nextjs on the other hand...

We're only 10 months out from React2Shell. That is not nearly enough time to say "battle-tested".

Just the ReactFiberWorkLoop.js has 5k+ lines of code. React is one or two orders of magnitude bigger than you are thinking. And that's not counting Nextjs.

No that's including all the comments, types, dev only checks etc. I'm talking about what you get when using the production build.

I had a quick look around and it's actually ~1000 lines apparently, in React 19.

Actually why stop at that. The minified build apparently has just one line!

I don't feel like that's a good faith reply. I'm making the claim that react's production build core is surprisingly small and shouldn't be considered a security risk (or attack surface as someone above phrased it).

Do you dispute that? If so, why?

Your claim that the "react core" is small isn't correct. React+ReactDOM is >130kb, the minimum needed to run a react component. To create TUIs, Ink ships even more.

You should add the entire JS runtime you have to ship along React to that attack surface.

Wait until you hear about the attack surface you're exposed to when running Linux!

> React is actually pretty good for any kind of reactive interface,

It’s a different interface and the axiomatic layers are not the same.

React expects a tree of nodes that will map to the UI and build on that to add reactivity. And that’s what the major GUI platforms do offer (QT, the web dom, Android, iOS,…).

The terminal is a grid of characters modfied by the cursor concept. It is also modal (although most TUI uses one mode). What the cursor can do, and how the grid is rendered is terminal dependent (even though most current ones try to follow xterm-256color).

Using React on top of that is a technical bad idea.

Reply on news.ycombinator.com