5 ms·
> What important truth do very few people agree with you on? Seems like answering with SSR would fail a Thiel interview for two reasons: 1. It's not important
by nvm0n2 3y ago
> What important truth do very few people agree with you on?
Seems like answering with SSR would fail a Thiel interview for two reasons:
1. It's not important (in the grand scheme of things)
2. It's not a view that very few people hold. SSR was the standard way to do things for a couple of decades up until frameworks like React, and React itself now implements SSR, doesn't it?
Thiel uses this question to try and determine if someone is or can be a free thinker, someone who can discern something to be true even in the face of significant social opposition. That's valuable if you're an investor looking for overlooked opportunities, or an entrepreneur trying to find an edge in a highly competitive market. But there is no taboo or significant social opposition to SSR webapps, and bluntly, no edge to be found there.
- deleted 3y ago[deleted]
- lultimouomo 3y ago> 1. It's not important (in the grand scheme of things) > 2. It's not a view that very few people hold. And yet it makes the author feel a contrarian free thinker. It turns out, it's the prototypical Thiel truth!
- greenie_beans 3y agoimo it's a prototypical anti-truth because it's not that contrarian even though the speaker thinks it is.
- otikik 3y agoIt’s still the way to do things today. Most web apps today don’t need React and Co.
- water9 3y agoSRS is more secure because it doesn’t send down any links a role can’t see including even the link to get-based access from the account. It’s hard to attack a surface that is small.
- zmxz 3y agoSSR has nothing to do with roles being sent and what a user can see. It's as related as Jupiter is to a brick.
- water9 3y agoIt has to do with the size of the attack surface. in order for things to be client side driven gui elements need to be loaded for different role types. Those elements are often exposed If not directly then by showing which APIs are used to Authorize access to admin areas. That’s the whole point of rendering on the client. To load some Little div you might have an API call that when access by different role types will respond differently. With Server side rendering you never see the different API points for each role type As they get their own.
- zmxz 3y agoWhy would the elements HAVE to be loaded for different roles? You're talking as if every single client-side app approaches authorization and authentication the same way and that's just not true. There's no attack surface here at all, the only issue with most client-side apps and interaction with server comes from CORS and devs copypasting solutions from SO to get rid of the warning, thus creating the attack surface. The choices related to displaying appropriate elements based on current user's role that's tied to entire logic of the app has literally zero to do with security.
- water9 3y agoBecause the whole point of client, side rendering is to not have session management on the server side so that it uses less bandwidth on the server provider.. that’s why you have JWTs and stuff like that. Architecturally when you have a session management system, where state is able to be maintained per user usually up by the same thread on the same physical server. that’s going to be more secure than a horizontally structured infinitely scalable system. But there’s always trade-off between security and usability/performance
- felipeccastro 3y agoThere is often opposition - if the company I work for asks "what should we build the next app on?", React is the default answer that doesn't need convincing anyone, while SSR is much harder to sell (even when it makes complete sense).
- viraptor 3y agoThey're both wrong answers though. A better answer is: what will the app do, what are the requirements, target devices, etc.?