5 ms·

Mentions security and then completely glosses over security in the section on "yeah, we load random modules from URLs but it's okay because most Deno registries

Mentions security and then completely glosses over security in the section on "yeah, we load random modules from URLs but it's okay because most Deno registries are immutable and we cache files"

afiori 5y ago
there is not really a difference between a url to a registry and a npm package name. the different approach would be yarn's saving zipped versions of packages, I don't know if deno supports it
- greggman3 5y ago
  There is one difference. I know npm keeps published versions. I don't know that random URL keeps versions. Caching locally doesn't help. I expect my code to work for others. Of course using any source is nice. node also allows this, just put a git URL as your dependency.
  - afiori 5y ago
    URLs to a registry keep published versions if the registry keeps published versions. Your argument is that npm is more trustworthy than another random registry, this is likely true but also a matter of opinion.
    - dmitriid 5y ago
      > URLs to a registry keep published versions if the registry keeps published versions. Yes. Have you've ever heard of running your own registry? It' quite easy to do and most companies do it prcisely because they want to a) keep published versions and b) prevent things like colors/fake.js Literally no one who promotes Deno has yet shown how to do the same with Deno beyond "yeah, you check in all your node_modules dependencies into Git".
- dmitriid 5y ago
  > there is not really a difference between a url to a registry and a npm package name. There is. For starters, I can run my company's registry and make sure all npm packages are downloaded from there since resolution mechanism for npm/yarn is well known. How do I tell deno to download <random-url> from my own registry? Looking at how deno "solves" this I can't stop laughing [1] --- start quote --- In Deno there is no concept of a package manager as external modules are imported directly into local modules. This raises the question of how to manage remote dependencies without a package manager. In big projects with many dependencies it will become cumbersome and time consuming to update modules if they are all imported individually into individual modules. The standard practice for solving this problem in Deno is to create a deps.ts file. All required remote dependencies are referenced in this file and the required methods and classes are re-exported. The dependent local modules then reference the deps.ts rather than the remote dependencies... With all dependencies centralized in deps.ts, managing these becomes easier. --- end quote --- Are you for real? [1] https://deno.land/manual/examples/manage_dependencies https://deno.land/manual/examples/manage_dependencies
lucacasonato 5y ago
And we have lock files to verify integrity. This is no different to module loading in Node. If you don’t trust your registry, you should not be loading code from it!
- dmitriid 5y ago
  > And we have lock files to verify integrity. Where do you et these lockfiles files from? > This is no different to module loading in Node. This is very much different from module loading in Node: https://news.ycombinator.com/item?id=29871936 https://news.ycombinator.com/item?id=29871936 > If you don’t trust your registry, you should not be loading code from it! So you immediately pinpointed the difference: with Node I can run my own registry and easily set up npm/yarn to never load packages from anywhere else. Deno loads code from random urls.
  - vorticalbox 5y ago
    > Where do you et these lockfiles files from? I don't know about any lock files but the `version` it locked via the import url E.G import R from 'https://deno.land/x/rambda@v7.0.1 https://deno.land/x/rambda@v7.0.1'
    - dmitriid 5y ago
      This brings us back to the fact that Deno loads random files from random URLs with no way to change it. https://news.ycombinator.com/item?id=29871936 https://news.ycombinator.com/item?id=29871936
      - vorticalbox 5y ago
        sure but is that not how a browser works? for example to add bootstrap to a site you import like this <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstr..." integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script> which is exactly the same as deno's "loads random files from random URLs"
norman784 5y ago
If you care about security you will have setup your own node package registry with a curated/audited list of dependencies, then you need to point to the registry for the dependencies and maintain the registry. With deno it should be easier to do this, you setup your own cdn, just upload plain js files and point it from your import map[1], the browser will take care of download/cache them all. [1] https://wicg.github.io/import-maps/ https://wicg.github.io/import-maps/
- dmitriid 5y ago
  > If you care about security you will have setup your own node package registry with a curated/audited list of dependencies, then you need to point to the registry for the dependencies and maintain the registry. Exactly. And it's quite easy to do. > With deno it should be easier to do this, you setup your own cdn, just upload plain js files and point it from your import map I was waiting for the inevitable just. - Just set up your own CDN. - Just upload a plain js file there (where do I get those files from?) - Just point to dependencies using a feature that, quote "is not a W3C Standard nor is it on the W3C Standards Track" - And then the browser... record scratch who said anything about a browser?

Mentions security and then completely glosses over security in the section on "yeah, we load random modules from URLs but it's okay because most Deno registries are immutable and we cache files"

afiori 5y ago

there is not really a difference between a url to a registry and a npm package name. the different approach would be yarn's saving zipped versions of packages, I don't know if deno supports it

greggman3 5y ago
There is one difference. I know npm keeps published versions. I don't know that random URL keeps versions. Caching locally doesn't help. I expect my code to work for others. Of course using any source is nice. node also allows this, just put a git URL as your dependency.
- afiori 5y ago
  URLs to a registry keep published versions if the registry keeps published versions. Your argument is that npm is more trustworthy than another random registry, this is likely true but also a matter of opinion.
  - dmitriid 5y ago
    > URLs to a registry keep published versions if the registry keeps published versions. Yes. Have you've ever heard of running your own registry? It' quite easy to do and most companies do it prcisely because they want to a) keep published versions and b) prevent things like colors/fake.js Literally no one who promotes Deno has yet shown how to do the same with Deno beyond "yeah, you check in all your node_modules dependencies into Git".
dmitriid 5y ago
> there is not really a difference between a url to a registry and a npm package name. There is. For starters, I can run my company's registry and make sure all npm packages are downloaded from there since resolution mechanism for npm/yarn is well known. How do I tell deno to download <random-url> from my own registry? Looking at how deno "solves" this I can't stop laughing [1] --- start quote --- In Deno there is no concept of a package manager as external modules are imported directly into local modules. This raises the question of how to manage remote dependencies without a package manager. In big projects with many dependencies it will become cumbersome and time consuming to update modules if they are all imported individually into individual modules. The standard practice for solving this problem in Deno is to create a deps.ts file. All required remote dependencies are referenced in this file and the required methods and classes are re-exported. The dependent local modules then reference the deps.ts rather than the remote dependencies... With all dependencies centralized in deps.ts, managing these becomes easier. --- end quote --- Are you for real? [1] https://deno.land/manual/examples/manage_dependencies https://deno.land/manual/examples/manage_dependencies

lucacasonato 5y ago

And we have lock files to verify integrity. This is no different to module loading in Node. If you don’t trust your registry, you should not be loading code from it!

dmitriid 5y ago
> And we have lock files to verify integrity. Where do you et these lockfiles files from? > This is no different to module loading in Node. This is very much different from module loading in Node: https://news.ycombinator.com/item?id=29871936 https://news.ycombinator.com/item?id=29871936 > If you don’t trust your registry, you should not be loading code from it! So you immediately pinpointed the difference: with Node I can run my own registry and easily set up npm/yarn to never load packages from anywhere else. Deno loads code from random urls.
- vorticalbox 5y ago
  > Where do you et these lockfiles files from? I don't know about any lock files but the `version` it locked via the import url E.G import R from 'https://deno.land/x/rambda@v7.0.1 https://deno.land/x/rambda@v7.0.1'
  - dmitriid 5y ago
    This brings us back to the fact that Deno loads random files from random URLs with no way to change it. https://news.ycombinator.com/item?id=29871936 https://news.ycombinator.com/item?id=29871936
    - vorticalbox 5y ago
      sure but is that not how a browser works? for example to add bootstrap to a site you import like this <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstr..." integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script> which is exactly the same as deno's "loads random files from random URLs"

norman784 5y ago

If you care about security you will have setup your own node package registry with a curated/audited list of dependencies, then you need to point to the registry for the dependencies and maintain the registry. With deno it should be easier to do this, you setup your own cdn, just upload plain js files and point it from your import map[1], the browser will take care of download/cache them all. [1] https://wicg.github.io/import-maps/ https://wicg.github.io/import-maps/

dmitriid 5y ago
> If you care about security you will have setup your own node package registry with a curated/audited list of dependencies, then you need to point to the registry for the dependencies and maintain the registry. Exactly. And it's quite easy to do. > With deno it should be easier to do this, you setup your own cdn, just upload plain js files and point it from your import map I was waiting for the inevitable just. - Just set up your own CDN. - Just upload a plain js file there (where do I get those files from?) - Just point to dependencies using a feature that, quote "is not a W3C Standard nor is it on the W3C Standards Track" - And then the browser... record scratch who said anything about a browser?