4 ms·

Deno can directly import in TS/JS from URLs, really nice for small 'shell scripts', but has some considerable downsides for bigger projects: https://deno.com/b

Deno can directly import in TS/JS from URLs, really nice for small 'shell scripts', but has some considerable downsides for bigger projects: https://deno.com/blog/http-imports https://deno.com/blog/http-imports PS: also Godbolt's C/C++ compilers can directly #include from URLs, I guess they run their own custom C preprocessor over the code before passing it on to the compilers: https://www.godbolt.org/z/6aTKo4vbM https://www.godbolt.org/z/6aTKo4vbM

sureIy 2y ago
> Deno can directly import in TS/JS from URLs FWIW, that's a native JS feature (minus the TS part).
- iforgot22 2y ago
  Yeah, not sure what Deno has to do with this, other than they implemented the standard at https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import#module_specifier_resolution https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
  - sureIy 2y ago
    Deno is the only server that has done so though. Neither node nor bun support them.
junon 2y ago
The HTTP imports astound me. Having little control over how bundlers fetch code randomly screams vulnerability vector. How people are okay with it is wild to me.
- ibejoeb 2y ago
  You're right, of course, but there's little practical difference from doing `npm install` unless you're actually auditing the supply chain. It just automates a step.
  - christophilus 2y ago
    The difference is that you have a single file to audit with npm. With Deno, any file in your codebase might pull in a dependency.
    - iforgot22 2y ago
      That assumes someone is actually auditing the npm deps.
      - feross 2y ago
        It’s trivial to audit your dependencies with https://socket.dev https://socket.dev Disclosure: I’m the founder.
        iforgot22 2y ago
        Despite the ease of auditing services, there are notoriously a lot of devs using unaudited deps. Maybe they don't even think about it, unfortunately.
    - flohofwoe 2y ago
      Which isn't really a problem for simple one-file 'shell scripts'. For bigger projects, Deno already suggested to maintain all external imports in a central file.
- cbm-vic-20 2y ago
  They should have at least have something like HTML Subresource Integrity[0], including a hash so at least changes to what comes back from the import hasn't changed. [0] https://w3c.github.io/webappsec-subresource-integrity https://w3c.github.io/webappsec-subresource-integrity
  - junon 2y ago
    Yes, though it's not enforced when it should be.

sureIy 2y ago

> Deno can directly import in TS/JS from URLs FWIW, that's a native JS feature (minus the TS part).

iforgot22 2y ago
Yeah, not sure what Deno has to do with this, other than they implemented the standard at https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import#module_specifier_resolution https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- sureIy 2y ago
  Deno is the only server that has done so though. Neither node nor bun support them.

junon 2y ago

The HTTP imports astound me. Having little control over how bundlers fetch code randomly screams vulnerability vector. How people are okay with it is wild to me.

ibejoeb 2y ago
You're right, of course, but there's little practical difference from doing `npm install` unless you're actually auditing the supply chain. It just automates a step.
- christophilus 2y ago
  The difference is that you have a single file to audit with npm. With Deno, any file in your codebase might pull in a dependency.
  - iforgot22 2y ago
    That assumes someone is actually auditing the npm deps.
    - feross 2y ago
      It’s trivial to audit your dependencies with https://socket.dev https://socket.dev Disclosure: I’m the founder.
      - iforgot22 2y ago
        Despite the ease of auditing services, there are notoriously a lot of devs using unaudited deps. Maybe they don't even think about it, unfortunately.
  - flohofwoe 2y ago
    Which isn't really a problem for simple one-file 'shell scripts'. For bigger projects, Deno already suggested to maintain all external imports in a central file.
cbm-vic-20 2y ago
They should have at least have something like HTML Subresource Integrity[0], including a hash so at least changes to what comes back from the import hasn't changed. [0] https://w3c.github.io/webappsec-subresource-integrity https://w3c.github.io/webappsec-subresource-integrity
- junon 2y ago
  Yes, though it's not enforced when it should be.