4 ms·

First off, love svelte, the team is really doing a good job focusing on developer ergonomics. That said, I’m not surprised to see a list of CVEs impacting deva

First off, love svelte, the team is really doing a good job focusing on developer ergonomics. That said, I’m not surprised to see a list of CVEs impacting devalue. After running into some (seemingly arbitrary) limitations, I skimmed the code and it definitely felt like there was some sketchiness to it, given how it handles user inputs. If I were nefarious or a security researcher it would definitely be a focal point for me.

no_wizard 9mo ago
I want to ask simply for curiosity. Knowing you felt this way about that code, and I'm assuming knew that it had some level of relative importance to Svelte as a whole, how did that inform your decision making, if at all?
- appplication 9mo ago
  My decision making to use svelte? TBH I looked at source only well after I was far enough along development to be committed to it as a framework. That said, I don’t have any regrets, it’s a pleasure to use svelte and I trust the team’s direction. This particular app is already locked down to internal/trusted users. For something more public or security critical it may warrant a deeper dive and more consideration.
- hsbauauvhabzb 9mo ago
  It’s probably comparable to other js frameworks, and auditing every package before you use them will leave you in analysis paralysis. I have a low opinion of software in general, but svelte isn’t a particular standout in that aspect.
  - dwattttt 9mo ago
    The phrase is typically analysis paralysis, but the image of a team of analysts frozen in fear is quite evocative.
    - hsbauauvhabzb 9mo ago
      Autocorrected on my iPhone, but sometimes the best thing analysts could do is nothing ;)
- estimator7292 9mo ago
  Here's the one true answer to fit all use cases: every framework and language, every single last one of them, has some horrifying code buried somewhere. If you dig down into any piece of software far enough you'll find something insane and sketchy.
iamrobertismo 9mo ago
Yeah I have never been a fan of the devalue part of svelte.

no_wizard 9mo ago

I want to ask simply for curiosity. Knowing you felt this way about that code, and I'm assuming knew that it had some level of relative importance to Svelte as a whole, how did that inform your decision making, if at all?

appplication 9mo ago
My decision making to use svelte? TBH I looked at source only well after I was far enough along development to be committed to it as a framework. That said, I don’t have any regrets, it’s a pleasure to use svelte and I trust the team’s direction. This particular app is already locked down to internal/trusted users. For something more public or security critical it may warrant a deeper dive and more consideration.
hsbauauvhabzb 9mo ago
It’s probably comparable to other js frameworks, and auditing every package before you use them will leave you in analysis paralysis. I have a low opinion of software in general, but svelte isn’t a particular standout in that aspect.
- dwattttt 9mo ago
  The phrase is typically analysis paralysis, but the image of a team of analysts frozen in fear is quite evocative.
  - hsbauauvhabzb 9mo ago
    Autocorrected on my iPhone, but sometimes the best thing analysts could do is nothing ;)
estimator7292 9mo ago
Here's the one true answer to fit all use cases: every framework and language, every single last one of them, has some horrifying code buried somewhere. If you dig down into any piece of software far enough you'll find something insane and sketchy.

iamrobertismo 9mo ago

Yeah I have never been a fan of the devalue part of svelte.