4 ms·

I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.

by hedayet 10mo ago

jsheard 10mo ago
Does Facebook actually use RSC? I thought it was mainly pushed by the Nextjs/Vercel side of the React team.
- samdoesnothing 10mo ago
  No they don't. I think Meta is just big enough that they don't really care what is happening with React anymore haha.
- acemarke 10mo ago
  No, but it's primarily because Meta has their own server infrastructure already. RSCs are essentially the React team trying to generalize the data fetching patterns from Meta's infrastructure into React itself so they can be used more broadly. I wrote an extensive post and did a conference talk earlier this year recapping the overall development history and intent of RSCs, as best as I understand it from a mostly-external perspective: - https://blog.isquaredsoftware.com/2025/06/react-community-2025/ https://blog.isquaredsoftware.com/2025/06/react-community-20... - https://blog.isquaredsoftware.com/2025/06/presentations-react-community-2025/ https://blog.isquaredsoftware.com/2025/06/presentations-reac...
  - brazukadev 10mo ago
    So contrary to all other changes, this one was not done for Facebook to use. What was the reason behind RSC then?
    - cluckindan 10mo ago
      Market capture?
      - brazukadev 10mo ago
        That seems to be the case. They killed React for that.
    - acemarke 10mo ago
      Like I said above and in the post: it was an attempt to generalize the data fetching patterns developed inside of Meta and make them available to all React devs. If you watch the various talks and articles done by the React team for the last 8 years, the general themes are around trying to improve page loading and data fetching experience. Former React team member Dan Abramov did a whole series of posts earlier this year with differently-focused explanations of how to grok RSCs: "customizable Backend for Frontend", "avoiding unnecessary roundtrips", etc: - https://overreacted.io https://overreacted.io Conceptually, the one-liner Dan came up with that I liked is "extending React's component model to the server". It's still parent components passing props to child components, "just" spread across multiple computers.
      - brazukadev 10mo ago
        Yeah the "just" is doing a lot of things, nobody asked for a react server but it turns out it could be the base for a $10B cloud company. Classical open source rugpull.
tacker2000 10mo ago
This is about React Server Components, a subset/feature of React that can optionally be installed and used. Apps that use React without server components are not affected.

I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.

by hedayet 10mo ago

I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.

jsheard 10mo ago

Does Facebook actually use RSC? I thought it was mainly pushed by the Nextjs/Vercel side of the React team.

samdoesnothing 10mo ago
No they don't. I think Meta is just big enough that they don't really care what is happening with React anymore haha.
acemarke 10mo ago
No, but it's primarily because Meta has their own server infrastructure already. RSCs are essentially the React team trying to generalize the data fetching patterns from Meta's infrastructure into React itself so they can be used more broadly. I wrote an extensive post and did a conference talk earlier this year recapping the overall development history and intent of RSCs, as best as I understand it from a mostly-external perspective: - https://blog.isquaredsoftware.com/2025/06/react-community-2025/ https://blog.isquaredsoftware.com/2025/06/react-community-20... - https://blog.isquaredsoftware.com/2025/06/presentations-react-community-2025/ https://blog.isquaredsoftware.com/2025/06/presentations-reac...
- brazukadev 10mo ago
  So contrary to all other changes, this one was not done for Facebook to use. What was the reason behind RSC then?
  - cluckindan 10mo ago
    Market capture?
    - brazukadev 10mo ago
      That seems to be the case. They killed React for that.
  - acemarke 10mo ago
    Like I said above and in the post: it was an attempt to generalize the data fetching patterns developed inside of Meta and make them available to all React devs. If you watch the various talks and articles done by the React team for the last 8 years, the general themes are around trying to improve page loading and data fetching experience. Former React team member Dan Abramov did a whole series of posts earlier this year with differently-focused explanations of how to grok RSCs: "customizable Backend for Frontend", "avoiding unnecessary roundtrips", etc: - https://overreacted.io https://overreacted.io Conceptually, the one-liner Dan came up with that I liked is "extending React's component model to the server". It's still parent components passing props to child components, "just" spread across multiple computers.
    - brazukadev 10mo ago
      Yeah the "just" is doing a lot of things, nobody asked for a react server but it turns out it could be the base for a $10B cloud company. Classical open source rugpull.

tacker2000 10mo ago

This is about React Server Components, a subset/feature of React that can optionally be installed and used. Apps that use React without server components are not affected.