5 ms·

I'm not so familiar with web development and don't quite understand where this fits in. I know I can run JS in my browser. I know I can run JS on a web server u

by rsp1984 6y ago

I'm not so familiar with web development and don't quite understand where this fits in. I know I can run JS in my browser. I know I can run JS on a web server using node.js. I know I can compile Typescript to JS. So how does Deno fit in and what is the added value? Not trying to be negative, just curious.

divbzero 6y ago
Deno is designed to be a replacement for Node.js on the server. The introduction to the Deno Manual [1] provides a comparison. [1]: https://deno.land/manual@v1.9.0/introduction https://deno.land/manual@v1.9.0/introduction
stevieoop 6y ago
deno supports typescript out of the box whereas to run typescript in nodejs you need to transpile down to javscript first. deno also has some security features enabled by default like not allowing network communication unless you explicitly enable it. so that prevents malicious packages from making network requests that you might not have noticed. thats a great feature because tons of javascript projects/tools dont need to send http requests so if your tool doednt require that then you can be confident that any dependency you use is not secretly spying on you.
sod 6y ago
* Running a linter without granting it write or net access * Running a build tool with only file access to the source files * Trying a cli script without granting it access to everything by just showing the help In times where a linter has 10000 dependencies, I'm in desperate need of sandboxing. People on hackernews are easy to judge companies when they leak customer data. But what if we the developers are actually the problem by executing megabytes of foreign code just with faith.
zamadatix 6y ago
Deno is by the original creator of Node.js and seeks to fix/change a few things about Node he regretted while adding first class support for a few things that were new since then like TS. It's also more security minded from the get-go. Not just in a "written in a memory safe language" way but it has a permissions system and strong built in ways to inspect/audit dependencies. So it's not aiming to be revolutionarily different from Node, rather a second shot at Node.
jppope 6y ago
Deno is meant to be an improvement on the nodejs ecosystem. Ryan Dahl took everything that he learned from node and improved upon it with Deno. There are a series of features like native typescript support, having single executable, url imports, etc that are all very pleasant improvements. The idea is that it will make for a better developer experience.
k__ 6y ago
It's a Node.js alternative. Deno glue code around V8 is written in Rust. It tries to be as close to the browser API as possible, using ES-Modules instead of CommonJS and doesn't require a package manager. Also, it compiles TypeScript automatically.
- oscargrouch 6y ago
  > Deno glue code around V8 is written in Rust. The C++ V8 api is very reasonable to be used in a safe way. So i dont see this as a good point unless of course for people that wan to write some parts that need to be optimized in Rust. Don't deal with NodeJs that much, but is a lot of node functionality in C++ modules? and if so they are presenting a lot of security bugs in a way that Rust might see appealing? Because by not having direct access to the V8 api in its native language might limit you, the "glue coder", in the things you really can do.
  - tym0 6y ago
    > Deno glue code around V8 is written in Rust. Maybe this is not the best way of putting it. They use Rust for all the system bits including networking, so it's not like they just wrote some JS to V8/C++ glue code in Rust.
    - oscargrouch 6y ago
      Ok, but even if there's more Rust code in it, i think the expectations of the parent poster are unreal, as for safety, only if V8 VM were rewritten in Rust, and giving its a JIT VM sensitive portions of code would need to be in 'unsafe{}' anyway, so how much safer would it turn out to be even than? Anyway in security terms it will probably turn out negligible as the percentage of code in safe Rust are probably low compared to the whole thing. Than in memory usage, if it replicates Eletron,it would turned out almost the same, giving is not the C++ core the one that is most memory hungry.. is mostly the renderer process with WebKit and V8 executing big portions of javascript code in memory. Giving if such a branch existed, it would use typescript which in turn is the same V8/javascript pipeline that is memory hungry. So, addressing to the parent poster, i don't think it would change much in terms of security or memory pressure if compared to Electron. Sometimes i think Rust give some people high expectations, that it would be very hard to actually replicate in real life experiences, giving software is much more complex and as in Deno, requires other core parts that cannot be realistically rewritten in Rust, and even if they could, while we can see how software written in Rust can be safer, it still needs to prove the claim for bigger, sensitive pieces of software that requires a lot of "unsafe" techniques to work like JIT's and OS's and therefore might not feel that much of a difference giving the size and complexity of the project.
paxys 6y ago
In the simplest terms, it is meant to be a replacement for Node.js.
HugoDaniel 6y ago
Deno has a couple of very good selling points, the main one is that it allows to use JS web browser API's in the CLI, this includes things that range from the Fetch API[1], up to WebGPU even! all in the command line interface. Besides this, it uses the same module system as the browsers do. The JS module system is in my opinion very well designed and intuitive. No need for AMD or CommonJS or Node require's. Other good things about Deno is that it includes a lot of goodies by default. In that single binary you get in your command line interface: - A very very decent and fast bundler (bundling in JS is a mess, the Deno is straightforward and needs no config and no hacks, which, surprisingly is unique in the JS bundling scene) - Testing library - TypeScript support (for those that like it) - Documentation generator - Linter - Syntax modifier (like prettier) - Official VS Code plugin Unlike Node, it uses Rust to bridge the gap between the JS engine and the OS, and leverages on a lot of very cool Rust libraries.
- ROARosen 6y ago
  I personally really like the `Deno compile` feature which outputs your code into a self-contained .exe which executes your script no need for separate tools.
  - ketzo 6y ago
    Woah, is that a thing? Very cool.
  - beaker52 6y ago
    If you want to do this with node, pkg exists. https://github.com/vercel/pkg https://github.com/vercel/pkg
croes 6y ago
It's main selling point is security. With Deno you can provide permission to scripts using flags. Deno offers a sandbox security layer through permissions. List of the flags: --allow-env allow environment access. --allow-hrtime allow high resolution time measurement. --allow-net=<allow-net> allow network access. --allow-plugin allow loading plugins. --allow-read=<allow-read> allow file system read access. --allow-run allow running subprocesses. --allow-write=<allow-write> allow file system write access. --allow-all allow all permissions (same as -A)
- kybernetikos 6y ago
  What I dislike is that you provide these permissions for the whole process. I'd like it to be more that you can constrain and pass the permissions down to libraries like capabilities.
  - beaker52 6y ago
    I agree. I hear a lot made of Deno's "security" but process flags don't really make me feel much more secure when I've had to enable most of them anyway. At that point they just start getting in the way and giving me a false sense of security.
    - pocketgrok 6y ago
      My understanding is that the current security flags model isn't really meant to be the final solution. They wanted to ensure that the browser security model isn't simply dropped like it is in Node, but to improve it further they'll probably need outside help.
anthonygore 6y ago
I made a video on Deno which gives a quick summary of its key features: https://devtrends.io/videos/deno https://devtrends.io/videos/deno
tarruda 6y ago
> So how does Deno fit in and what is the added value? I also had that question in my mind until I tried deno a couple of weeks ago. There are a few great things I've discovered that IMO makes it a great alternative to node.js: - Deno + std library has a lot of batteries included. Have you tried creating a web browser project with node.js recently? Just adding a few basic dependecies to compile and bundle your code will leave you with node_modules having hundreds of other dependencies. With recent cases of malware slipping into npm dependencies tree, I'm a bit fearful of starting a new project and infecting my computer (not too crazy imagining that one of the developers of those hundreds of deps will be careless with their SSH keys). "deno bundle" basically solves that for me. - I can't think of a reason why I would not use typescript these days. Not having to install tsc or create a tsconfig.json is a killer feature for me. Not to mention compiling ts with Deno feels really fast (maybe because they don't have to load the whole typescript compiler into the JS VM on every run?). - As a consequence of Deno's fast startup + tsc support + great standard library + automatic dependency download, I've found a vastly superior alternative to python for writing quick and dirty scripts for automating various tasks. So for me Deno is not just for writing servers, it is also for using typescript as a script language for automating my desktop and server workflows. These are just a few things that stand out for me, there's certainty more to Deno than it may initially appear.
kaba0 6y ago
Similarly, how does both Node.js and Deno compare to GraalJS? I've been reading about it and find the idea absolutely genius, but I'm sure it doesn't have nearly as much of a userbase as these.
- fiiv 6y ago
  They're kind of different things. Graal is an attempt to create a polyglot environment. For example, using Python and Javascript in the same environment. For example you might be working on an application where the web server managed by the web team is written in Node and your data scientist team uses Python scripts to deal with the data, but they need to run in the same environment. Graal lets you re-use that environment for both. Node and Deno are dedicated runtimes to run Javascript using the V8 engine. Both provide a standard library of additional functionality to make them worthwhile beyond just browser code.

divbzero 6y ago

Deno is designed to be a replacement for Node.js on the server. The introduction to the Deno Manual [1] provides a comparison. [1]: https://deno.land/manual@v1.9.0/introduction https://deno.land/manual@v1.9.0/introduction

stevieoop 6y ago

deno supports typescript out of the box whereas to run typescript in nodejs you need to transpile down to javscript first. deno also has some security features enabled by default like not allowing network communication unless you explicitly enable it. so that prevents malicious packages from making network requests that you might not have noticed. thats a great feature because tons of javascript projects/tools dont need to send http requests so if your tool doednt require that then you can be confident that any dependency you use is not secretly spying on you.

sod 6y ago

* Running a linter without granting it write or net access * Running a build tool with only file access to the source files * Trying a cli script without granting it access to everything by just showing the help In times where a linter has 10000 dependencies, I'm in desperate need of sandboxing. People on hackernews are easy to judge companies when they leak customer data. But what if we the developers are actually the problem by executing megabytes of foreign code just with faith.

zamadatix 6y ago

Deno is by the original creator of Node.js and seeks to fix/change a few things about Node he regretted while adding first class support for a few things that were new since then like TS. It's also more security minded from the get-go. Not just in a "written in a memory safe language" way but it has a permissions system and strong built in ways to inspect/audit dependencies. So it's not aiming to be revolutionarily different from Node, rather a second shot at Node.

jppope 6y ago

Deno is meant to be an improvement on the nodejs ecosystem. Ryan Dahl took everything that he learned from node and improved upon it with Deno. There are a series of features like native typescript support, having single executable, url imports, etc that are all very pleasant improvements. The idea is that it will make for a better developer experience.

k__ 6y ago

It's a Node.js alternative. Deno glue code around V8 is written in Rust. It tries to be as close to the browser API as possible, using ES-Modules instead of CommonJS and doesn't require a package manager. Also, it compiles TypeScript automatically.

oscargrouch 6y ago
> Deno glue code around V8 is written in Rust. The C++ V8 api is very reasonable to be used in a safe way. So i dont see this as a good point unless of course for people that wan to write some parts that need to be optimized in Rust. Don't deal with NodeJs that much, but is a lot of node functionality in C++ modules? and if so they are presenting a lot of security bugs in a way that Rust might see appealing? Because by not having direct access to the V8 api in its native language might limit you, the "glue coder", in the things you really can do.
- tym0 6y ago
  > Deno glue code around V8 is written in Rust. Maybe this is not the best way of putting it. They use Rust for all the system bits including networking, so it's not like they just wrote some JS to V8/C++ glue code in Rust.
  - oscargrouch 6y ago
    Ok, but even if there's more Rust code in it, i think the expectations of the parent poster are unreal, as for safety, only if V8 VM were rewritten in Rust, and giving its a JIT VM sensitive portions of code would need to be in 'unsafe{}' anyway, so how much safer would it turn out to be even than? Anyway in security terms it will probably turn out negligible as the percentage of code in safe Rust are probably low compared to the whole thing. Than in memory usage, if it replicates Eletron,it would turned out almost the same, giving is not the C++ core the one that is most memory hungry.. is mostly the renderer process with WebKit and V8 executing big portions of javascript code in memory. Giving if such a branch existed, it would use typescript which in turn is the same V8/javascript pipeline that is memory hungry. So, addressing to the parent poster, i don't think it would change much in terms of security or memory pressure if compared to Electron. Sometimes i think Rust give some people high expectations, that it would be very hard to actually replicate in real life experiences, giving software is much more complex and as in Deno, requires other core parts that cannot be realistically rewritten in Rust, and even if they could, while we can see how software written in Rust can be safer, it still needs to prove the claim for bigger, sensitive pieces of software that requires a lot of "unsafe" techniques to work like JIT's and OS's and therefore might not feel that much of a difference giving the size and complexity of the project.

paxys 6y ago

In the simplest terms, it is meant to be a replacement for Node.js.

HugoDaniel 6y ago

Deno has a couple of very good selling points, the main one is that it allows to use JS web browser API's in the CLI, this includes things that range from the Fetch API[1], up to WebGPU even! all in the command line interface. Besides this, it uses the same module system as the browsers do. The JS module system is in my opinion very well designed and intuitive. No need for AMD or CommonJS or Node require's. Other good things about Deno is that it includes a lot of goodies by default. In that single binary you get in your command line interface: - A very very decent and fast bundler (bundling in JS is a mess, the Deno is straightforward and needs no config and no hacks, which, surprisingly is unique in the JS bundling scene) - Testing library - TypeScript support (for those that like it) - Documentation generator - Linter - Syntax modifier (like prettier) - Official VS Code plugin Unlike Node, it uses Rust to bridge the gap between the JS engine and the OS, and leverages on a lot of very cool Rust libraries.

ROARosen 6y ago
I personally really like the `Deno compile` feature which outputs your code into a self-contained .exe which executes your script no need for separate tools.
- ketzo 6y ago
  Woah, is that a thing? Very cool.
- beaker52 6y ago
  If you want to do this with node, pkg exists. https://github.com/vercel/pkg https://github.com/vercel/pkg

croes 6y ago

It's main selling point is security. With Deno you can provide permission to scripts using flags. Deno offers a sandbox security layer through permissions. List of the flags: --allow-env allow environment access. --allow-hrtime allow high resolution time measurement. --allow-net=<allow-net> allow network access. --allow-plugin allow loading plugins. --allow-read=<allow-read> allow file system read access. --allow-run allow running subprocesses. --allow-write=<allow-write> allow file system write access. --allow-all allow all permissions (same as -A)

kybernetikos 6y ago
What I dislike is that you provide these permissions for the whole process. I'd like it to be more that you can constrain and pass the permissions down to libraries like capabilities.
- beaker52 6y ago
  I agree. I hear a lot made of Deno's "security" but process flags don't really make me feel much more secure when I've had to enable most of them anyway. At that point they just start getting in the way and giving me a false sense of security.
  - pocketgrok 6y ago
    My understanding is that the current security flags model isn't really meant to be the final solution. They wanted to ensure that the browser security model isn't simply dropped like it is in Node, but to improve it further they'll probably need outside help.

anthonygore 6y ago

I made a video on Deno which gives a quick summary of its key features: https://devtrends.io/videos/deno https://devtrends.io/videos/deno

tarruda 6y ago

> So how does Deno fit in and what is the added value? I also had that question in my mind until I tried deno a couple of weeks ago. There are a few great things I've discovered that IMO makes it a great alternative to node.js: - Deno + std library has a lot of batteries included. Have you tried creating a web browser project with node.js recently? Just adding a few basic dependecies to compile and bundle your code will leave you with node_modules having hundreds of other dependencies. With recent cases of malware slipping into npm dependencies tree, I'm a bit fearful of starting a new project and infecting my computer (not too crazy imagining that one of the developers of those hundreds of deps will be careless with their SSH keys). "deno bundle" basically solves that for me. - I can't think of a reason why I would not use typescript these days. Not having to install tsc or create a tsconfig.json is a killer feature for me. Not to mention compiling ts with Deno feels really fast (maybe because they don't have to load the whole typescript compiler into the JS VM on every run?). - As a consequence of Deno's fast startup + tsc support + great standard library + automatic dependency download, I've found a vastly superior alternative to python for writing quick and dirty scripts for automating various tasks. So for me Deno is not just for writing servers, it is also for using typescript as a script language for automating my desktop and server workflows. These are just a few things that stand out for me, there's certainty more to Deno than it may initially appear.

kaba0 6y ago

Similarly, how does both Node.js and Deno compare to GraalJS? I've been reading about it and find the idea absolutely genius, but I'm sure it doesn't have nearly as much of a userbase as these.

fiiv 6y ago
They're kind of different things. Graal is an attempt to create a polyglot environment. For example, using Python and Javascript in the same environment. For example you might be working on an application where the web server managed by the web team is written in Node and your data scientist team uses Python scripts to deal with the data, but they need to run in the same environment. Graal lets you re-use that environment for both. Node and Deno are dedicated runtimes to run Javascript using the V8 engine. Both provide a standard library of additional functionality to make them worthwhile beyond just browser code.