3 ms·

I've been semi-interested in Deno since it was announced and followed some discussions but I've never considered moving from Node to Deno. Can you elaborate on

I've been semi-interested in Deno since it was announced and followed some discussions but I've never considered moving from Node to Deno. Can you elaborate on what Deno does that makes it more secure than NPM here? I'm guessing it doesn't rely on a centralised repo of any kind?

schemescape 5y ago
1. Deno comes with a standard library that has been audited by the Deno maintainers 2. The Deno runtime runs with limited permissions by default, so you have to allow access to file system locations or network hosts explicitly Now, the repository part is arguably not as big of an improvement (if at all). There’s a central repository for third party modules. One nice aspect is it just mirrors code, so you can see what you’re getting before downloading (and, in NPM’s case, running install scripts, if you forgot —-ignore-scripts). Deno also suggests using CDNs, but they often just host NPM modules that have been transformed into ES modules. That seems worse than NPM, in my opinion.
Mikeb85 5y ago
It's not necessarily more or less secure. You load libraries by simply linking ES Modules from your local files or the internet; there's no central repo, you link the exact URL. So it's as secure or insecure as your source. Some people say it's insecure because, well, if you get your modules from a compromised site it is. However recent events have shown there's also plenty of danger with centralized repos as well. The advantage to Deno's approach is it encourages using CDNs, which allow that code to load quicker especially if you're using edge functions or something like CloudFlare workers. It also requires you to be super explicit about where the code's coming from. The negative is that many people will download code from dodgy websites then complain later.
- jhgb 5y ago
  And you can always self-host, right?
  - Mikeb85 5y ago
    Yes. While Deno Deploy runs on the edge and they seem to encourage a very modern "serverless" workflow, you can also just put it on a server just like Node, self-host, whatever.

schemescape 5y ago

1. Deno comes with a standard library that has been audited by the Deno maintainers 2. The Deno runtime runs with limited permissions by default, so you have to allow access to file system locations or network hosts explicitly Now, the repository part is arguably not as big of an improvement (if at all). There’s a central repository for third party modules. One nice aspect is it just mirrors code, so you can see what you’re getting before downloading (and, in NPM’s case, running install scripts, if you forgot —-ignore-scripts). Deno also suggests using CDNs, but they often just host NPM modules that have been transformed into ES modules. That seems worse than NPM, in my opinion.

Mikeb85 5y ago

It's not necessarily more or less secure. You load libraries by simply linking ES Modules from your local files or the internet; there's no central repo, you link the exact URL. So it's as secure or insecure as your source. Some people say it's insecure because, well, if you get your modules from a compromised site it is. However recent events have shown there's also plenty of danger with centralized repos as well. The advantage to Deno's approach is it encourages using CDNs, which allow that code to load quicker especially if you're using edge functions or something like CloudFlare workers. It also requires you to be super explicit about where the code's coming from. The negative is that many people will download code from dodgy websites then complain later.

jhgb 5y ago
And you can always self-host, right?
- Mikeb85 5y ago
  Yes. While Deno Deploy runs on the edge and they seem to encourage a very modern "serverless" workflow, you can also just put it on a server just like Node, self-host, whatever.