Comment by monarchwadia | Hacker News Reader

Comment by monarchwadia | Hacker News Reader

Parent Full thread

Anecdata from a JS developer who has been in this ecosystem for 14 years.

I'm actively moving away from Node.js and JavaScript in general. This has been triggered by recent spike in supply chain attacks.

Backend: I'm choosing to use Golang, since it has one of the most complete standard libraries. This means I don't have to install 3rd party libraries for common tasks. It is also quite performant, and has great support for DIY cross platform tooling, which I anticipate will become more and more important as LLMs evolve and require stricter guardrails and more complex orchestration.

Frontend: I have no real choice except JavaScript, of course. So I'm choosing ESBuild, which has 0 dependencies, for the build system instead of Vite. I don't mind the lack of HMR now, thanks to how quickly LLMs work. React happily also has 0 dependencies, so I don't need to switch away from there, and can roll my own state management using React Contexts.

Sort of sad, but we can't really say nobody saw this coming. I wish NPM paid more attention to supply chain issues and mitigated them early, for example with a better standard library, instead of just trusting 3rd party developers for basic needs.

Make sure you have a run of govulncheck [1] somewhere in your stack. It works OK as a commit hook, it runs quickly enough, but it can be put anywhere else as well, of course.

Go isn't immune to supply chain attacks, but it has built in a variety of ways of resisting them, including just generally shorter dependency chains that incorporate fewer whacky packages unless you go searching for them. I still recommend a periodic skim over go.mod files just to make sure nothing snuck in that you don't know what it is. If you go up to "Kubernetes" size projects it might be hard to know what every dependency is but for many Go projects it's quite practical to know what most of them are and get a sense they're probably dependable.

[1]: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck - note this is official from the Go project, not just a 3rd party dependency.

> React happily also has 0 dependencies,

Ok, but it has 112 devDependencies, I'm not really sure "0 dependencies" best describes React.

Those are not installed.

Dev dependencies are not installed when you install the package into your project.

Also I checked how many deps vuejs has, also 0.

I'm going almost the same direction, for the same reasons. Golang seems very interesting. Rewriting some hobby projects to get an understanding of the language and ecosystem. I'm on Node/webpack now and don't love where things are going.

Frontend: eh - you could pick something that targets wasm. Definitely a tradeoff with its own headaches.

Rust wasm ecosystem also needs a lot of crates to do anything useful, a lot of them unmaintained.

Now I imagining it like being outside a concert or other ticketed event: "Crates, who's selling? Who's buying?"

Try Scala? You only need one 0-dependency library for UI (Laminar), and you're good to go.

Reply on news.ycombinator.com