3 ms·

> The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs. I can see why they

> The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs. I can see why they chose that route. It's a huge maintenance burden. I can't imagine Google throwing in the towel when it comes to securing their browser's JS engine though.

int_19h 3y ago
That's assuming that you can fit everything within the needs of the browser sandbox. But server-side JS needs are broader than that.
- throwitaway1123 3y ago
  It's much easier to worry about locking down the few server-side modules which allow access to the underlying OS, than it is to have to worry about securing V8's JIT compiler. Node's module-based permission system literally just bans certain standard library modules from being imported (Deno's is more fine grained thankfully). That's a much smaller attack surface area to worry about compared to securing the underlying JS engine.
  - vmfunction 3y ago
    Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: #!/usr/bin/env -S deno run --allow-net Then one can just run ./test.ts if the script has +x permission. Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. It is a good idea to beware of the VC. So it is good idea to support project such as Hono (projects conform to modern web standard, and is runtime agnostic for JS).
    - throwitaway1123 3y ago
      > Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: I do this all the time. I used to use `npx tsx` in my hashbang line to run TS scripts with Node, but I've started using Deno more because of the permissions. Another great package for shell scripting with Deno is Dax, which is like the Deno version of Bun shell: https://github.com/dsherret/dax https://github.com/dsherret/dax > Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. This looks cool. I've always used the npm package Inquirer (which also works with Deno), but I'll have to compare Cliffy to that and see how it stacks up in comparison. > Hono (projects conform to modern web standard, and is runtime agnostic for JS) Hono is awesome. It's fast, very well typed, runs on all JS runtimes, and has zero dependencies.

int_19h 3y ago

That's assuming that you can fit everything within the needs of the browser sandbox. But server-side JS needs are broader than that.

throwitaway1123 3y ago
It's much easier to worry about locking down the few server-side modules which allow access to the underlying OS, than it is to have to worry about securing V8's JIT compiler. Node's module-based permission system literally just bans certain standard library modules from being imported (Deno's is more fine grained thankfully). That's a much smaller attack surface area to worry about compared to securing the underlying JS engine.
- vmfunction 3y ago
  Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: #!/usr/bin/env -S deno run --allow-net Then one can just run ./test.ts if the script has +x permission. Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. It is a good idea to beware of the VC. So it is good idea to support project such as Hono (projects conform to modern web standard, and is runtime agnostic for JS).
  - throwitaway1123 3y ago
    > Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: I do this all the time. I used to use `npx tsx` in my hashbang line to run TS scripts with Node, but I've started using Deno more because of the permissions. Another great package for shell scripting with Deno is Dax, which is like the Deno version of Bun shell: https://github.com/dsherret/dax https://github.com/dsherret/dax > Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. This looks cool. I've always used the npm package Inquirer (which also works with Deno), but I'll have to compare Cliffy to that and see how it stacks up in comparison. > Hono (projects conform to modern web standard, and is runtime agnostic for JS) Hono is awesome. It's fast, very well typed, runs on all JS runtimes, and has zero dependencies.