Pika/web: Web Apps Without the Bundler

Re:Pika/web: Web Apps Without the Bundler by jaabe on Wednesday March 20, 2019 @01:59AM (#19439426)

It’s fine from a development perspective where the job is to make something work.

It’s horrifying from an operations perspective where the job is to make sure everything works.

Developers can afford to ignore looking into dependencies, operations need to make sure every dependency is functional and safe.

If you write a piece of C# using the standard .Net library you can be fairly sure it’s safe and sound. If you write something using 2000 JS packages, you have to read through every one of them to be sure.

[ Parent | on HN ]

Re:Pika/web: Web Apps Without the Bundler by ownagefool on Wednesday March 20, 2019 @05:02AM (#19440228)

I disagree that it's the job of a random ops person to ensure that a developers dependencies are sane.

Putting the onus on the developer to do a good job with regards to secure development practices is an essential part of a wider system.

[ Parent | on HN ]

Re:Pika/web: Web Apps Without the Bundler by jaabe on Wednesday March 20, 2019 @07:06AM (#19440881)

Oh I agree with that completely, but it’s very easy for developers to get away with shitty practices in a lot of shops.

[ Parent | on HN ]

Re:Pika/web: Web Apps Without the Bundler by __oh_es on Wednesday March 20, 2019 @12:29PM (#19443809)

Agree with you but this goes the other way too - Ops not allowing security patching or upgrading of systems because "they work".

[ Parent | on HN ]