4 ms·
No, every interactive event doesn't need to have a network request in the loop. And you only need a tiny bit of client-side JS for a most of the plumbing. It i
by yawaramin 3mo ago
No, every interactive event doesn't need to have a network request in the loop. And you only need a tiny bit of client-side JS for a most of the plumbing.
It is quite pleasant to work with, because you don't have to worry about a constant stream of vulnerabilities or supply chain attacks. You just vendornthe script in your repo, add it as a <script> tag on the page, and you're done.
- deadbabe 3mo agoWho is worrying? If JavaScript is on the front end the supply chain attacks are really not your problem.
- traverseda 3mo agoWhat? It handles your password fields.
- cpburns2009 3mo agoThe supply chain attacks you need to worry about come from using npm.
- Rohansi 3mo agoNo, it's not specifically npm. All package managers enable remote code execution by design - you tell it to download code and then you run that code, likely without sandboxing, by using it. Most people are not inspecting the code before they download and run it. You will still see compromised packages making their way through npm even though they disabled install scripts.
- cpburns2009 3mo agoI agree. I just pointed out npm because it's the most prominent javascript one.
- Rohansi 3mo agoSupply chain attacks are not a JavaScript or npm exclusive risk. If you pull in any dependencies you have a supply chain risk.
- barrkel 3mo agoAs is well known, security is not a binary, it's a spectrum. It's why you add security in layers, and why it's generally a trade-off between risk and usability. Your mileage may vary, but I sleep better with my own projects not having any node_modules in their build tree.
- robertoandred 3mo agoHow is htmx invulnerable to vulnerabilities and attacks?
- stymaar 3mo agoIt's not invulnerable, I think gp just means that reducing your amount of dependencies reduces the attack surface.