ecares

10 things I regret about Deno talk incoming

Node is still there

this one is actually a bad pattern to avoid.

Tolmo | multiple roles | San Francisco, Ca, USA | ONSITE | Full time I am hiring for multiple roles in cybersecurity x AI [1]

We have security research and fullstack engineer (platform, product).

We are hiring in SF in office only at this point.

Candidating is one form away[2]

[1] https://tolmo.com/about/careers/ [2] https://jobs.ashbyhq.com/tolmo/form/website-generic

They really don't. I was recently approached by a journalist working on a piece on that exact topic.

Tolmo | multiple roles | San Francisco, Ca, USA | ONSITE | Full time

I am hiring for multiple roles in cybersecurity x AI [1]

We have security research and fullstack engineer (platform, product).

We are hiring in SF in office only at this point.

Candidating is one form away[2]

[1] https://tolmo.com/about/careers/ [2] https://jobs.ashbyhq.com/tolmo/form/website-generic

I am tired of "built in Rust" as an argument, you are spot on, it should not matter. But you are shooting right at Rust culture here haha

Did you find that some data model patterns were easier to detect for some LLM ? I am curious on how training might have made some agents better at graph navigation for instance?

cool, now, when will emacs get a good text editor?

It has wayyyyy better nodejs compatibility (day 1 goal)

Opened it, saw I needed to wrap my routes with api(), closed it - sounds like a solution for a problem PaaS has solved 10 years ago.

Deno is just a marketing company dressed as a software startup

> Deno is written in Rust, which allows them to move faster and more safely. Contributing to and extending Deno is a breeze. You can add Rust crates to the runtime and use them from JS.

Most of Deno's code is actually V8 in C++

Github actually has this feature (only for open source and enterprise IIRC) when there is a SARIF output

It took a friend and I 2 days last year to build a compatibility layer that allowed to run all the tests of Deno on Node.

Ryan: let's use web standards Also Ryan: let's use TSX lol

PRs on doc are always appreciated.

> Could you not just build a URL loader and cache for importing in Node.js? Could sandboxing not just be a flag in Node.js? Do you really need TypeScript built in?

There are open PRs on node for the first two parts ^^ It's 100% doable.

If I write faulty code, the generated test will make sure I keep the code faulty right?

So, you mean the people who were supposed to make the best choices to fix server-side JavaScript with the ultimate knowledge of what's best just realized that some of their pre-made opinions are actually not-silver bullet?

Shocking

At this point, there is clearly a vuln in a tool that brands itself as secure and in opposition with another project.

The marketing around Deno has been made toward that and it makes no sense to reach 1.0.0 with such a big security issue unhandled.

Also, this part is even more frightening https://github.com/denoland/deno/issues/1064#issuecomment-43....

At this point, it is clear that Deno is lying for marketing reason by calling itself secure.

Of course Ryan deserves empathy, so does Bert. But in the meanwhile during their talks at major conferences, they have trolled a lot another project. The maintainer of that other project now get weekly/daily pings from deno supporters trolling them.

Deno's culture seems big around trolling atm, a CoC could have fixed it, the th (B)DFL has decided another way.

you could use a flag to re-enable http :)

Let me tell it another way:

browsers have been benefiting from decades of innovation to mitigate the security issues of execution of JavaScript.

CORS headers is the latest of theses innovations. Deno allow you to fetch code as a browser would without providing you with any of the safety browsers can have. Mostly because it would not make sense to have a runtime doing that.

Deno is not a browser but takes the risks of a browser. Running Deno install is as safe as browsing the internet using Windows CP without SP 2 and Internet explorer bellow 6.

Also, importing a module in https does not mean this module won't import anything using http. Should you review the code of all imported modules? This is virtually impossible.

Deno must disable http by defaulkt and provide a flag to re-enable it. This is factually a security issue in Deno.

there are a lot of issues with using a non secure protocol to do anything over the internet, actually someone summarized the issue on the Deno issue tracker.

According to them, confidentiality is also a risk. also someone could also send you garbage that would polute the memory of deno until it explode.

Well, diasabling http by default is basically "Internet 101" here.

I don't want to write an full lecture on how many attacks are possible when people don't use https. It has been commmon knowledge for way more than a decade

Oh, I did not get what you meant ^^ well, there are still other issues than integrity with not using https.

>Can checksums/hashes be specified directly in the source file?

That would defeat their point actually :D malicious attacker could inject any script by hacking on the network and replace modules that are downloaded through http

> Would you say linux is insecure because a user can download an arbitrary shell script and run it?

Linux is not branded as a "Secure thing" right? Here Deno is building marketing on something inacurate.

well, most of Deno marketing is that it is safe by default. In 2020, not enforcing a secure protocol to share source code is a no go at all. I really don't get your point here defending something that has not made any sence since the end of last decade.

Knowingly leaving this kind of things in the codebase totally invalidate Deno being secure. There is not possible discussion in 2020 about https not having to be enforced. People thinking otherwise should not be allowed near a computer for their own good.

btw: https://github.com/denoland/deno/issues/1063

they know there is a bad mitm vector and won't fix it