4 ms·

If you have npm installed then simply doing npx serve is very easy

kevincox 5y ago
Of course this requires internet access. It is also arguably less secure as it is downloading code from the internet and means that you are trusting the latest code from a handful of people https://www.npmjs.com/package/serve https://www.npmjs.com/package/serve
- eyelidlessness 5y ago
  Worth noting, because it’s non-obvious but does address some of the concern around npx, that it resolves to any locally available version using standard Node module resolution, then falls back to downloading from NPM. And in the next version it will warn before downloading.
- jmull 5y ago
  > ...arguably less secure as it is downloading code from the internet... Don't essentially all the options involve code downloaded from the internet? And you have to trust the source that it isn't malware or too buggy or insecure? Are you making a case that the maintainers of this package aren't trustworthy? Or maybe the operators of npmjs.com? I'm just not understanding the claim this is less secure than various other options.
  - filleduchaos 5y ago
    It feels somewhat disingenuous to rephrase "is downloading" as "downloaded" as though they mean the same thing.
    - jmull 5y ago
      How does when you happen to download something affect how secure it is? By default -- presumably the most common case by far -- "npx serve" will download the most recent stable build. But why should that be less secure than some previous version? New vulnerabilities could have been introduced. But, of course, old ones could have been resolved. If you generally trust the source to be working in good faith and have an adequate level of competence, I would expect a given package/tool tends to become more secure over time, so taking the latest is a generally good strategy (not perfect of course) compared to running a version that is out-of-date to an arbitrary degree. Of course, if you don't generally trust the source to be working in good faith or have an adequate level of competence, then you should not use the package/tool no matter when it was built or when you downloaded it. I'm not seeing the logic here.
- antihero 5y ago
  I mean as a JS developer I am already kind of desensitized to taking my life in my hands when I do pretty much anything.
TheRealPomax 5y ago
it's also very insecure, because you have no guarantee that the version of `serve` that gets pulled down has been vetted and is verified exploit-free, unless you tell npx exactly which version should be used, at which point things start become less easy and more "having to remember which versions are safe".
- closeparen 5y ago
  Which software do you run that is vetted and verified exploit-free?
  - TheRealPomax 5y ago
    What a lovely strawman counter-argument you're attempting. Shall we instead focus on installing with SHA verification based on CVE? Let's do that, that sounds pretty sensible instead of just throwing around yet another thinly disguised "letting the perfect be the enemy of good".
    - closeparen 5y ago
      You brought up this incredible standard, "vetted and verified exploit free." I would like to know how it is achieved.
- antihero 5y ago
  I'd love to audit every bit of code that runs on my machine but I also do not have a billion hours. Perhaps this is worse in JS land (it is) but this is a different problem to solve.

Of course this requires internet access. It is also arguably less secure as it is downloading code from the internet and means that you are trusting the latest code from a handful of people https://www.npmjs.com/package/serve https://www.npmjs.com/package/serve

eyelidlessness 5y ago
Worth noting, because it’s non-obvious but does address some of the concern around npx, that it resolves to any locally available version using standard Node module resolution, then falls back to downloading from NPM. And in the next version it will warn before downloading.
jmull 5y ago
> ...arguably less secure as it is downloading code from the internet... Don't essentially all the options involve code downloaded from the internet? And you have to trust the source that it isn't malware or too buggy or insecure? Are you making a case that the maintainers of this package aren't trustworthy? Or maybe the operators of npmjs.com? I'm just not understanding the claim this is less secure than various other options.
- filleduchaos 5y ago
  It feels somewhat disingenuous to rephrase "is downloading" as "downloaded" as though they mean the same thing.
  - jmull 5y ago
    How does when you happen to download something affect how secure it is? By default -- presumably the most common case by far -- "npx serve" will download the most recent stable build. But why should that be less secure than some previous version? New vulnerabilities could have been introduced. But, of course, old ones could have been resolved. If you generally trust the source to be working in good faith and have an adequate level of competence, I would expect a given package/tool tends to become more secure over time, so taking the latest is a generally good strategy (not perfect of course) compared to running a version that is out-of-date to an arbitrary degree. Of course, if you don't generally trust the source to be working in good faith or have an adequate level of competence, then you should not use the package/tool no matter when it was built or when you downloaded it. I'm not seeing the logic here.
antihero 5y ago
I mean as a JS developer I am already kind of desensitized to taking my life in my hands when I do pretty much anything.

TheRealPomax 5y ago

it's also very insecure, because you have no guarantee that the version of `serve` that gets pulled down has been vetted and is verified exploit-free, unless you tell npx exactly which version should be used, at which point things start become less easy and more "having to remember which versions are safe".

closeparen 5y ago
Which software do you run that is vetted and verified exploit-free?
- TheRealPomax 5y ago
  What a lovely strawman counter-argument you're attempting. Shall we instead focus on installing with SHA verification based on CVE? Let's do that, that sounds pretty sensible instead of just throwing around yet another thinly disguised "letting the perfect be the enemy of good".
  - closeparen 5y ago
    You brought up this incredible standard, "vetted and verified exploit free." I would like to know how it is achieved.
antihero 5y ago
I'd love to audit every bit of code that runs on my machine but I also do not have a billion hours. Perhaps this is worse in JS land (it is) but this is a different problem to solve.