3 ms·
I've felt exactly that while testing Vite (https://github.com/vitejs/vite https://github.com/vitejs/vite) this morning from Evan You, author of VueJS. Standard
by BiteCode_dev 6y ago
I've felt exactly that while testing Vite (https://github.com/vitejs/vite https://github.com/vitejs/vite) this morning from Evan You, author of VueJS.
Standard install, nothing to configure, instant hot reload + modern code and tooling yet no perceivable latency for anything.
It felt like suddenly I could enjoy front end dev.
So I get the appeal of Deno.
But I know this ability to put arbitrary URLs as dependancies in the code are going to be terribly missused and abused.
I can see all the tutorials that will start including them, the bad architecture decisions that will spread them accross all files, the interns that will use localhost there, the typo and domain squatting or black SEO, the rise of people just telling you to put an URL from their site (the same that tell you to curl that bash script), the split from npm, the hardship of scanning/mapping/updating dependancies, the mismatch betwen running and installing bitting you, the undebuggable tickets because of proxies/antivirus/firewalls, the cloud hosting potential for failures, some twisted scenario leading to a DoS...
I know it will cause horrible technical debt down the road.
My spider dev sense is tickling and I'm not going to touch this tech for 5 years, until I either see my prediction unfold, and be completly disproved by its success (but I doubt it, I've been really good in the last 10 years at spotting bad technical choices).
There is a reason we have been using separation of concerns since the down of time. Declaring dependencies, installing them and importing them are 3 different concerns. They should not mix.
- miohtama 6y agoI am not expert on Deno. But what other frameworks and browsers are doing is to include a hash in the URL. E.g. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... Should not Deno to force the same behaviour to ensure there is less attack surface thru dependencies? I see Deno is taking security seriously.
- BiteCode_dev 6y agoSure, this will remove one problem: type/domain squatting. All the other ones remain. I can't wait for Stackoverflow spamming to get the scammers answer with a legit solution + url + hash at the top of Google search when typing the name of the package. Before that, you'd install from npm. But now, any URL is fair game. I'll get the pop corn.
- rpeden 6y agoFor the importing from URLs issue you mentioned, it would be good to ask Golang developers they’ve encountered the kind of technical debt you’re concerned about. I’ve done some Go development, but not enough to really call myself a Go developer so I don’t think I’m qualified to comment one way or the other. For what it’s worth, I stuck to a policy of only importing from GitHub and forking a repo if I really wanted be sure it would never disappear. If I were doing it today I’d probably expand my list acceptable import sources to include GitLab and Bitbucket as well.