4 ms·

Ok, so let's start with. No. For a number of reasons. "Web Scale deployments" like Linked-in and Pay-Pal aren't actually what most people call Enterprise. The

by drakaal 13y ago

Ok, so let's start with. No. For a number of reasons. "Web Scale deployments" like Linked-in and Pay-Pal aren't actually what most people call Enterprise. The line blurs a bit, but because they are Massive Scale Single Task solutions they aren't what the industry defines as enterprise. Second. Node is use primarily in two places, Private Cloud. (like pay pal and linked in) where you want to run on hardware as a commodity, but don't want the overhead of a true VPS, instead you run in an "Engine" which is hardware independent. That's great if you are Huge. But it makes less sense in traditional enterprise... Which is why we come to number 3.... Third. Node isn't secure enough for Enterprise. Enterprise runs on well tested, secure, solutions, with strong support, because... You can't get hacked, you can't deal with your developer quitting, and you can't deal with the solution is no longer supported. This piece is marketing hype, not "white paper fact" or even "Case study support" Yes I expect lots of downvotes, happens every time I say something bad about node. But the truth of it is that Node is for Hackers, not for production. It is tech born from a poorly conceived language, running in an engine that was designed for clients not servers, and unless you have a team of security guys, and a strong proxy, and a bunch of other things, it is not "production safe".

briantakita 13y ago
Node is "production safe". The many deployments and success stories override your fud. It's time for you to move on and bash a newer, emerging, "unproven" technology. In the mean time, have fun with cobol, cause that's the only "proven" technology out there :-,
- drakaal 13y ago
  Number of deployments doesn't equate to secure, or Windows 95 would have been considered Secure in 1996. (It's in good shape these days) Most companies get Node to be "secure" by putting a Proxy in front of it. Doing a lot of packet inspection, and limiting interactions with the server to validated requests. If you set something like this up you can make anything secure. But most people can't do this, they don't know how. Most enterprise don't do this because setting up packet inspection for validation requires a lot of planning, and so unless you are massive scale it isn't worth, so this remains in the realm of things only banks and financial institutions do.
  - lttlrck 13y ago
    That doesn't mean there isn't a net benefit using NodeJS vs. other solutions.
  - filipedeschamps 13y ago
    Ok, great, Node.js seems really insecure. Can you tell me how to hack a Node.js app so easily?
  - briantakita 13y ago
    > If you set something like this up you can make anything secure I'm surprised there isn't an open source "secure" proxy service that you mentioned. It also makes sense to keep on top of updates. Also, if security is an important requirement, then it makes sense for the organization to use someone who knows what they are doing to set up the network and own the security requirement. Audits would also be prudent.
  - drakaal 13y ago
    Since the tree is as deep as it will go... @filipedeschamps "How to Hack a Node.Js" for Send multiple pipelined HTTP requests via a single connection. Find anywhere the developer has used an "Eval" and exploit it. Those are the quick 2 that fit easily in a HN comment.
    - briantakita 13y ago
      > Send multiple pipelined HTTP requests via a single connection. That DoS attack vector was fixed. http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/ http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-... Also, some proxy servers will prevent such attacks. > Find anywhere the developer has used an "Eval" and exploit it. Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server. As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.
- kyrra 13y ago
  For work I've done, NodeJS would have to be proxied behind something like Apache. Specifically for being FIPS 140-2 compliant and tested[0]. [0] http://en.wikipedia.org/wiki/FIPS_140-2 http://en.wikipedia.org/wiki/FIPS_140-2
deleted 13y ago
[deleted]

by drakaal 13y ago

briantakita 13y ago

Node is "production safe". The many deployments and success stories override your fud. It's time for you to move on and bash a newer, emerging, "unproven" technology. In the mean time, have fun with cobol, cause that's the only "proven" technology out there :-,

drakaal 13y ago
Number of deployments doesn't equate to secure, or Windows 95 would have been considered Secure in 1996. (It's in good shape these days) Most companies get Node to be "secure" by putting a Proxy in front of it. Doing a lot of packet inspection, and limiting interactions with the server to validated requests. If you set something like this up you can make anything secure. But most people can't do this, they don't know how. Most enterprise don't do this because setting up packet inspection for validation requires a lot of planning, and so unless you are massive scale it isn't worth, so this remains in the realm of things only banks and financial institutions do.
- lttlrck 13y ago
  That doesn't mean there isn't a net benefit using NodeJS vs. other solutions.
- filipedeschamps 13y ago
  Ok, great, Node.js seems really insecure. Can you tell me how to hack a Node.js app so easily?
- briantakita 13y ago
  > If you set something like this up you can make anything secure I'm surprised there isn't an open source "secure" proxy service that you mentioned. It also makes sense to keep on top of updates. Also, if security is an important requirement, then it makes sense for the organization to use someone who knows what they are doing to set up the network and own the security requirement. Audits would also be prudent.
- drakaal 13y ago
  Since the tree is as deep as it will go... @filipedeschamps "How to Hack a Node.Js" for Send multiple pipelined HTTP requests via a single connection. Find anywhere the developer has used an "Eval" and exploit it. Those are the quick 2 that fit easily in a HN comment.
  - briantakita 13y ago
    > Send multiple pipelined HTTP requests via a single connection. That DoS attack vector was fixed. http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/ http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-... Also, some proxy servers will prevent such attacks. > Find anywhere the developer has used an "Eval" and exploit it. Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server. As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.
kyrra 13y ago
For work I've done, NodeJS would have to be proxied behind something like Apache. Specifically for being FIPS 140-2 compliant and tested[0]. [0] http://en.wikipedia.org/wiki/FIPS_140-2 http://en.wikipedia.org/wiki/FIPS_140-2

deleted 13y ago

[deleted]