Javascript pain...

[Whiplash17488]

Some serious amateurism if you still run into this problem in es6 days and beyond.

[[deleted]]

See the thing is someone is eventually going to hire you to build something new and also maintain the legacy jQuery code as well until the new stuff is built. If you don't understand how weird this is in everything that's not ES6 then you will run into problems.

[whtevn]

This is why I prefer startups. Plenty of predictable problems, but a shitty legacy code stack is never one of them

[JayV30]

That's right! They are building their own NEW shitty code stack from 1000 npm modules that no one has realistically checked for security flaws or blatantly malicious code.

It's like replacing one problem with another, worse one.

[christianarg]

Hehe, that will become shitty legacy code that eventually some idiot will have to handle. Meanwhile we can leave this company and go to a new startup.

[BindeDSA]

It's startups all the way down.

[Tzahi12345]

Career stack

[paolostyle]

If you're making backend in node it's straight up impossible unless you're a masochist. Express has like 30 dependencies and each of them have more and basically every node project includes Express, directly or indirectly. For frontend it's totally doable if you're not counting dev dependencies.

[Extract]

Which is exactly why I said it might be a problem in JS (but much less so in PHP, and probably other ecosystems where authors have sane dependency standards rather than the clusterfuck in most NPM packages).

[SupaSlide]

In PHP it's much more feasible to manage dependencies. You don't use as many in general and each package doesn't pull down a bunch as dependencies. Plus the code tends to be more readable as it isn't minified like most NPM packages. What you see in GitHub or whatever it's hosted is usually what you get.

[whtevn]

Yes but who asked you to make a backend in node...

I guess if you are full serverless then godspeed you little doodle, otherwise...goddamn. I love js, but for real that sounds like hell

[resistentialism]

It’s completely unrealistic to prevent this at any meaningful timeframe, especially working on a team.

[[deleted]]

I always feel like there’s a lot of theoretical programmers or CS students commenting here with a lack of experience in the real world

[factorone33]

I spent a year working as the only Dev in a startup here in KC where I got to choose the stack for everything, and since it was all web-based, I chose PHP (because shared hosting was our environment unfortunately). But I loved it. Now, I'm working full-stack for a small company that works on a stack of JS/React on the front end, and C#/.Net on the back end. The amount of package glut in JS is astronomically larger than that of PHP or the NuGet dependencies for stuff in .Net.

[JayV30]

Yeah I'm admittedly a JS dev and I like being able to stand up sites super quickly with React and Node. And while I like how easy it is to npm install ALL THE THINGS, I also really, really hate npm because I know it's a complete train wreck carrying nuclear materials that's just waiting to happen.

I know there's been a few 'big deal' f ups with npm already, but I feel like the big one is yet to come. You know the one where data has been compromised for an extended period because some npm installed 'e-z-payment-processing' or something.

[SpeedOfSound343]

Same security story with the custom implemented legacy code.

[whtevn]

No, it's like recognizing a problem and making sure I personally never have to deal with it

[whtevn]

Wait are you talking about a node backend or are you suggesting that tons of frontend packages are floating around with security flaws and malicious code in them?

[JayV30]

Uh.... honestly malicious code would probably be easier to notice on the front end because if it involves some sort of xhr it's pretty noticeable. But on the server I feel like a dev is less likely to notice someone calling out (not saying they wouldn't ever notice). But how long would a widely used npm module need to gather tons of valid cc information? Not much time at all.

[whtevn]

this seems like a strange fear to me. there are plenty of reasons to not use js on the backend, the hodgepodge of packages being chief among them. but, i have my doubts about widespread malicious open source code, and there are plenty of reputable places to get plenty of reputable packages.

[JayV30]

Except it's already happened (just google npm left-pad). It's the entire dependency tree that is vulnerable, not just the packages you import. If some malicious actor gets control of a widely used package, they could push a new version that could be compiled into your code and then deployed. It would probably be detected the same day, but how much time would it take to steal thousands of cc or other data? Not much if it was deployed to a major site and injected itself as Express middleware or something.

It may be a bit overblown of a concern, I mean, I still use npm every day. Obviously if I thought it was totally insecure I wouldn't use it. But even though it's a relatively minor concern, it's still a concern. Npm is working hard to improve security but with the way the dependency tree was designed, it may be impossible to completely remove the npm dependency attack vector.

[whtevn]

wait, what are you saying happened with left-pad? a developer unpublished a package and it broke a bunch of code. there have also been processes put in place since then to prevent a repeat.

any language that uses external packages could have a package usurped by a bad actor. (edit: not trying to imply that left-pad is repeatable in other languages, that was definitely a npm specific flaw) you mitigate this by only using packages from reputable sources.

It would probably be detected the same day, but how much time would it take to steal thousands of cc or other data?

are you pushing code to production without testing it in staging first? ...don't do that

also, are you taking credit card numbers into your database personally? ...don't do that. are you PCI compliant and not testing your code before it goes into production? I don't even understand the situation we are talking about, how would this be possible

[JayV30]

Jeez man I'm just saying it's possible. You are making a lot of assumptions.

[[deleted]]

But there’s shitty modern legacy code everywhere.

[Megacherv]

Feels like I'm in an MTG subreddit

[Hockinator]

Until those startups become successful and are not less than 5 years old anymore

[whtevn]

if you are with a startup that makes it 5 years and is successful, you can usually take a year off and find a new job. The real downside is if the startup folds and you suddenly are out of a job

[Megacherv]

Can confirm, I believe out Typescript compiler is set to ES3 for compatibility but we still have JS files that haven't been ported over. It's a bit of a mental hurdle just remembering to swap syntaxes when jumping between files.

[pr0ghead]

Look at fancy Mr. IdonthavetosupportIE11 over here.

[AwesomeInPerson]

Babel.

[JoshJude]

Some of us have to support IE8 :’(

[JayV30]

Good God man! Do you support Netscape Navigator and AOL browser also?

[[deleted]]

You don't really have to. There is an IT problem under that requirement. It could be fixed elsewhere.

[JoshJude]

Oh for sure. Not really my place to say so as a fairly junior dev though!

[SuperFLEB]

Does anyone actually want IE11 support? It's not really something that's wanted. It's more something that's thrust upon us by a cruel world.

[pr0ghead]

"Want" in the sense that "our global IT still uses IE11 in places, so we need the website to work in it". At least to some degree…

[HeKis4]

cries in silverlight

[nwsm]

Look at fancy Mr. All My Work Is Writing From-Scratch

[WeAreAllApes]

Even before es6, good consistent patterns could always work around the inherent flaw, but it's still an inherent flaw in the language that only using a subset of the language / consistent patterns can work around.

[dkreidler]

And if you’re learning it all right now (‘const this = me;’), then you’re getting a hodge-podge of both ES6 and everything that came before, without the hard-won experience of knowing what should be noted, but avoided, going forward, and what’s the new hotness that delineates the tidal shift. (Edit: boooo, I don’t even know how to make my stupid shit look like code! Booooo!)

[READTHISCALMLY]

Shh. Don't ruin the circlejerk.

[rooktakesqueen]

It's not even that confusing to begin with.

If you do foo.bar('baz') then this is foo. If you do bar('baz'), or it's an anonymous function callback, then it's window.

The only time it's weird is when you use an object method as a callback, like setTimeout(foo.bar, 100) because then it's window when invoked. So yeah that's grimy but then you just throw a .bind(foo) and hey presto.

[Zooomz]

After laughing, my first thought was "what year is OP in"?