4 ms·
You're right. Many things can be handled by packages, abstracting them away from the developer. Of course, that's assuming the developer thinks far enough ahea
by Kalium 7y ago
You're right. Many things can be handled by packages, abstracting them away from the developer.
Of course, that's assuming the developer thinks far enough ahead to remember that they need authentication, decide how they want to handle it, figure out what they want for a CSP, and so on. Other things cannot be so readily handled. Authorization, for example, isn't a concern that can be bundled into a pre-fab function. It's something application-specific that has to be re-evaluated with every single web request and is going to be subject to unique business requirements.
Frameworks tend to handle these issues by setting out a set of conventions to adhere to, within which many of these concerns are handled for you to the extent possible. It's far from perfect, but it does a lot to reduce the chances of someone forgetting (for example) that forms need anti-CSRF tokens because their form-generation function doesn't do it for them or automatically work with the form-accepting and validating functions.
Or, to use example I've seen, the logging package's ignorance of what might be sensitive in the strings its been handed turns into secrets being sent to the centralized logging system and exposed to far more people than they should be. The developer didn't think about what might be in what they were logging, the package assumed that the developer did, and the result could have been avoided by a more integrated whole.
A culture of libraries instead of frameworks can mean that each project may have to make all the decisions a framework does all over again. Is everyone going to get it right every time?
- bcrosby95 7y ago> The developer didn't think about what might be in what they were logging, the package assumed that the developer did, and the result could have been avoided by a more integrated whole Umm, is there any all in one web framework that protects against this to any level of guarantee?
- Kalium 7y agoIt's been my experience that Rails logging can and will do things like censor password fields when passed objects. So, yes, it is possible for logging (and serialization) systems to defend against this kind of thing.
- bcrosby95 7y agoIn my experience these password logging events tend to be at a lower level than object serialization. They're usually at the raw request level.
- harperlee 7y agoSeveral purported cons of clojure according to this conversation, including yours, are more a critique of using a niche language with a small community than really about the language. Addressing that explicitly can clarify the debate. Also, clojure is a special beast in the sense that can leverage a big community easily (java). This is not covered in your web framework example, but you can use clojure in frameworks (e.g. you use unity through arcadia, as a framework)