Hacker News Reader

Comment by messo | Hacker News Reader

The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used in the majority of modern apps seems like a huge security risk to me. They make rapid cross-platform development possible, but at what cost?

Anyway; the network itself was not hacked, which is good I guess. And the coordinator (centralized node) is said to be the training wheels which will be removed at some point, but it still seems to be quite far of into the future.

View on HN

I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild.

After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.

The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.

Oh jesus this actually hits the mail on the head, I had a brief foray into development of UWP (modern windows store) apps, and damn the performance and language are good, but I was so jealous of all the visualizations, ui elements and libraries web devs have access to, while I had to dick about with basic gauges.

> questionably licensed

People don't want to pay for anything, therefore we get...

> barely maintained, obscure, ... have limited 3rd party compatibility

Building anything really polished that isn't those things is a huge undertaking that someone would have to pay for.

Electron piggybacks on the massive web ecosystem which is funded by SaaS, advertising, and surveillance so it lacks the abandonware problem. Unfortunately it's also not really built for the role of desktop or mobile UI layer and so you get a bloated, insecure, slow mess when you try to shoehorn it in there.

We don't get what we won't pay for.

> all the good UI libraries

Can you name a few?

> I was so fed-up with the dependency hell, I switched to native programming.

Same, but I switched to Flutter. Native performance, declarative UI, and while I do still have dependencies, they’re much easier to manage and the scope of individual packages/widgets are much smaller/tighter/focused imo.

Don't you still need to learn the native API when you do anything beyond a simple UI?

> I switched to native programming.

I mean it has more to do with NPM than Javascript or Node itself, NPM and its "small package that do a single thing" bull philosophy, and the fact that multiple versions of the same package are installed in the dependency tree, because NPM allows it, instead of rejecting package conflicts, like Composer or any sane package manager.

Conflicts should be resolved by the developers, upstream, and package managers shouldn't install trees of dependencies, dependencies should be flat.

It has become almost impossible to audit anything with NPM, when you have the same package installed 50 times with 50 different versions locally.

I mean, one could argue that NPM ended up like that because of JS's terrible standard library that includes none of the basics people need all the time.

I really like working with TypeScript, but that is the pain point that always comes up.

This wasn't an npm vulnerability. It's a direct link to a CDN file that was compromised: https://github.com/iotaledger/trinity-wallet/pull/2565/files...

Electron is not only about JavaScript. Fortunately now you can compile many "native" languages to wasm (i.e Go)

One of the reasons I've stayed away from Node is the ridiculous attack surface brought by the npm ecosystem. It seems that even the simplest of projects end up with hundreds of dependencies - most having different maintainers and security practices.

How does it compare to Rust's cargo and its crates? The above mentioned "small package that do a single thing" philosophy is rampant there as well.

There any further details on this, like which specific lib so we can view commit history?

Reply on news.ycombinator.com