Yes, and you can code in assembly as well if you want it. But: that's not how 99% of the people using node is using it so that it is theoretically possible to code up every last bit yourself is true but it does not contribute to the discussion at all.

An eco-system, if it insists on slapping on a package manager (see also: Rust, Go) should always properly evaluate the resulting risks and put proper safeguards in place or you're going to end up with a massive supply chain headache.

▲

anonymous908213 6 hours ago | parent [-]

Writing code yourself so as not to cultivate 1000 dependencies you can't possibly ensure the security of is not the same as writing assembly. That you even reach for that comparison is indicative of the deep rot in Javascript culture. Writing your own code is perceived as a completely unreasonable thing to be doing to 99% of JS-devs and that's why the web performs like trash and has breaches every other day, but it's actually a very reasonable thing to be doing and people who write most any other language typically engage in the writing of own code on a daily basis. At any rate, JS the language itself is fine, Node is fine, and it is possible to adopt better practices without forsaking the language/ecosystem completely.

▲

jacquesm 6 hours ago | parent [-]

> That you even reach for that comparison is indicative of the deep rot in Javascript culture.

Sorry?

No, I'm the guy that does write all of his code from scratch so you're entirely barking up the wrong tree here. I am just realistic in seeing that people are not going to write more code than they strictly speaking have to because that is the whole point of using Node in the first place.

The Assembly language example is just to point out the fact that you could plug in at a lower level of abstraction but you are not going to because of convenience, and the people using Node.js see it no different.

JS is a perfectly horrible little language that is now being pushed into domains where it has absolutely no business being used (I guess you would object to running energy infrastructure on Node.js and please don't say nobody would be stupid enough to do that).

Node isn't fine it needs a serious reconsideration of the responsibilities of the eco-system maintainers. See also: Linux, the BSDs and other large projects for examples of how this can be done properly.

▲

notpachet 6 hours ago | parent [-]

I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Not that there aren't problems with Node itself, but as many people have pointed out, there are plenty of organizations writing in Node that aren't pwn'd by these sorts of attacks because we don't blindly update deps.

Perfect is the enemy of good; dependency cooldown etc is enough to mitigate the majority of these risks.

▲

jacquesm 6 hours ago | parent | next [-]

> I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through.

Familiarity breeds contempt.

▲

notpachet 5 hours ago | parent | next [-]

The truth is typically somewhere in the middle. I feel you though. I'm that way with Ruby/Bundler.

▲

user34283 2 hours ago | parent | prev [-]

What's the problem?

I think JS is great. It's simple, anybody can use it.

TypeScript is excellent too. The structural type system is very convenient.

It's not going to replace Rust in cases where performance is essential or where you want strict runtime type checking or whatever, but for general use and graphical applications JS seems like a great pick.

I often hear people complain about JS, but really, how is it any worse than say Python?

	▲	jacquesm 11 minutes ago \| parent [-]
		> I often hear people complain about JS, but really, how is it any worse than say Python? That's not the flex you think it is.

▲

acheron 4 hours ago | parent | prev [-]

Reality has an anti-JS bias.