5 ms·

> sveltekit provides some kind of thin layer on top of express It doesn't use express, but something named polka [1], which is much less mature. Bugs in polka

> sveltekit provides some kind of thin layer on top of express It doesn't use express, but something named polka [1], which is much less mature. Bugs in polka have caused downtime and remote DOS vulnerabilities in my sveltekit app multiple times. [1] https://github.com/lukeed/polka https://github.com/lukeed/polka

zffr 5y ago
Well actually SvelteKit has a concept of “adapters” which can bundle your app for different targets (ex: netlify, vercel, or node). If you target running your app on a node server, polka might be the default but it is trivial to replace with express
- lovasoa 5y ago
  No, the "node" adapter only allows using polka. Unless you develop your own adapter, you are stuck with it.
  - zffr 5y ago
    Check out the docs: https://github.com/sveltejs/kit/tree/master/packages/adapter-node https://github.com/sveltejs/kit/tree/master/packages/adapter... They even show you how to set up an express server
    - lovasoa 5y ago
      You are right, I didn't know that it exported a raw handler you could use from another server.
- andrew_ 5y ago
  The issue lies more with the fact that most users will use what's shipped as default. You see that habit in every large framework out there. And that's why it's important to ship reliable, stable defaults.
  - slantyyz 5y ago
    If the Svelte subreddit is any indicator, a lot of Sveltekit devs don't use the Sveltekit back end. Most like to use serverless and 3rd party services for things like authentication and data storage.
andrew_ 5y ago
lukeed has several extremely popular npm packages/libs which share a lot in common: - their twitter following is used to boost newly released packages - they were released as alternatives to existing packages/libs with the flashy promise of being smaller, less complicated, faster - negative feedback is rebuffed as "an attack" - they're all very green - they lack features and stability of the more mature packages they aim to supplant - once released and popular, they cease getting frequent updates Now, yes this is a generalization. It doesn't apply to all of their packages, and not at the same point in time. But there is a pattern there. Some quick diving into the author's Github account, and their more popular repos shows the pattern. It's also clear that this was a choice made by a Svelte contributor to use their own package for "official" support in Svelte Kit. When it comes to polka itself, I just don't get why a maturing framework like Svelte would choose something whose only real advantage lies in micro-benchmarking porn [1]. Speculation aside, I'm surprised the Svelte team didn't look at that choice through a lens of higher scrutiny. Koa would have been an infinitely better choice in my personal opinion, and there are several community-driven setups [2][3] for it. [1] https://github.com/lukeed/polka#benchmarks https://github.com/lukeed/polka#benchmarks [2] https://github.com/kaladivo/svelte-kit-koa-boilerplate https://github.com/kaladivo/svelte-kit-koa-boilerplate [3] https://blog.logrocket.com/sapper-svelte-tutorial-2021/ https://blog.logrocket.com/sapper-svelte-tutorial-2021/

zffr 5y ago

Well actually SvelteKit has a concept of “adapters” which can bundle your app for different targets (ex: netlify, vercel, or node). If you target running your app on a node server, polka might be the default but it is trivial to replace with express

lovasoa 5y ago
No, the "node" adapter only allows using polka. Unless you develop your own adapter, you are stuck with it.
- zffr 5y ago
  Check out the docs: https://github.com/sveltejs/kit/tree/master/packages/adapter-node https://github.com/sveltejs/kit/tree/master/packages/adapter... They even show you how to set up an express server
  - lovasoa 5y ago
    You are right, I didn't know that it exported a raw handler you could use from another server.
andrew_ 5y ago
The issue lies more with the fact that most users will use what's shipped as default. You see that habit in every large framework out there. And that's why it's important to ship reliable, stable defaults.
- slantyyz 5y ago
  If the Svelte subreddit is any indicator, a lot of Sveltekit devs don't use the Sveltekit back end. Most like to use serverless and 3rd party services for things like authentication and data storage.

andrew_ 5y ago

lukeed has several extremely popular npm packages/libs which share a lot in common: - their twitter following is used to boost newly released packages - they were released as alternatives to existing packages/libs with the flashy promise of being smaller, less complicated, faster - negative feedback is rebuffed as "an attack" - they're all very green - they lack features and stability of the more mature packages they aim to supplant - once released and popular, they cease getting frequent updates Now, yes this is a generalization. It doesn't apply to all of their packages, and not at the same point in time. But there is a pattern there. Some quick diving into the author's Github account, and their more popular repos shows the pattern. It's also clear that this was a choice made by a Svelte contributor to use their own package for "official" support in Svelte Kit. When it comes to polka itself, I just don't get why a maturing framework like Svelte would choose something whose only real advantage lies in micro-benchmarking porn [1]. Speculation aside, I'm surprised the Svelte team didn't look at that choice through a lens of higher scrutiny. Koa would have been an infinitely better choice in my personal opinion, and there are several community-driven setups [2][3] for it. [1] https://github.com/lukeed/polka#benchmarks https://github.com/lukeed/polka#benchmarks [2] https://github.com/kaladivo/svelte-kit-koa-boilerplate https://github.com/kaladivo/svelte-kit-koa-boilerplate [3] https://blog.logrocket.com/sapper-svelte-tutorial-2021/ https://blog.logrocket.com/sapper-svelte-tutorial-2021/