Hacker News Reader

Comment by bassdropvroom | Hacker News Reader

I think a big problem with the node ecosystem is the lack of standard library. When I'm developing on PHP, Python, or go, they have a vast standard library that means the likelihood of me using a third-party package is relatively low for the most mundane stuff. Comparing that to node, and you'll need to use an npm package for just about anything. This automatically gives you a much larger attack surface. If I understand correctly Deno is supposed to address that, but I have yet to play with it, so not sure how it works.

View on HN

Definitely a valid counter-point. I'm sure for that and several other reasons, the Node package ecosystem is probably indeed the riskiest of the set. But it's still really foolish for the parent just immediately turn their nose in disgust simply at the sight of a package.json file.

Or to say "When I depend on a library A in say Python I can be reasonably sure that it won't download and execute random shit from Internet", which is just completely untrue and misguided in a lot of ways. It's absolutely just as easy for anyone to backdoor a Python package as it is to backdoor an NPM package, and it happens all the time. It's possible it could happen a lot more frequently in the future, too.

You could argue that statement's true in a sense, but given that same sense it's also true of Node; it's not a good way of thinking about dependency supply chain attacks.

You totally misunderstood my point. I wasn't talking about backdoors or supply chain attacks. When I say that a dependency downloads and executes random shit from Internet I meant it as a behavior intended to fulfill its function. The problem is that this is generally acceptable in nodejs/NPM ecosystem. In other words, the gap in dependency hygiene between nodejs/NPM and other ecosystems is huge, and users of it seems not to bother.

>When I say that a dependency downloads and executes random shit from Internet I meant it as a behavior intended to fulfill its function.

Can you give an example?

I'm aware of the banner thing, but I think that was only a few projects, and that's something else entirely.

See the link in my original post. The other things I'm aware of are ridiculous behaviors of npm packages, like create-react-app, which feels the right thing to do is to spawn my $EDITOR when it sees exception in the log (which it hides), except that the whole terminal session freezes because vim and create-react-app fight for the tty. And there are other things where authors pull in insane amount of dependencies to log in their own colorful fancy way.

But then again, I'm not that well versed in nodejs to judge by that experience alone. As I said in the middle, I'm not trying to dismiss author's work. I'm sorry for the tone of my previous replies. This comment thread I spawned is also very off-topic.

>See the link in my original post.

>Over a year ago, I was investigating using Prisma to be the ORM for a GraphQL API of a Postgres database. When doing a proof-of-concept, I discovered that under the hood @prisma/client was spinning up it's own GraphQL server that it would send requests to in order to generate SQL to send to postgres. This extra middleware layer between my frontend code and postgres generated some pretty poor performing queries that took 50% longer to complete than the queries generated by using Hasura as our whole GraphQL API.

Doesn't seem like it's worth writing off Node/JavaScript/NPM just due to this large project making a questionable design decision

>like create-react-app, which feels the right thing to do is to spawn my $EDITOR when it sees exception in the log (which it hides)

Just seems like it's Facebook's problem. I wouldn't be surprised if there's some Python package out there that does something similar. There's nothing inherent about JavaScript that makes this more likely to happen. Maybe there's something inherent about the community, but I'd really need to see a thorough empirical analysis of packages across a lot of languages before I start making judgments about that.

It might be worth making fun of a particular package if they pull in way too many other packages, but it's still all a case-by-case evaluation.

I personally strongly dislike JavaScript and much of its ecosystem, myself; it's just the kneejerk pattern-matching reaction that I thought was unwarranted.

Reply on news.ycombinator.com