This might be a slightly controversial opinion, but I don't think the time it takes to get an application running with a framework is a relevant metric. Being able to get an application up and running fast is only a useful benefit when you're first starting out and trying things. If you're choosing a tech stack and you're going to be working on something for months or years, the fact that you can see something on a screen after an hour or after 3 days is completely insignificant compared to how good it is to work with in the long term.

Choosing a technology because you can start working on a new application quickly is the wrong way of thinking about your tech stack.

My noob a-ha example is `rails generate devise:install` where I first thought, wow, what a time saver. Eventually I learned lessons like, perhaps authentication is too important to be hiding from your source code. In fact, maybe almost everything is.

It can be, especially when you're learning or putting together lots of small projects, but my point is that people over-emphasis the benefit of that feature on a long term project. It might be fine that a framework takes a lot of time and effort to set up before you see any results, and it could actually be a good thing if that initial time means other things about the framework are better.

All other things being equal it'd great to be able to spin up quickly, but things are never really equal between frameworks. So, to me, choosing a tech stack because it's quick to initialise a new project feels like you're optimizing for the wrong thing, and potentially you're making a less optimal choice because of that.

So I completely and wholeheartedly disagree. Frameworks should be as simple as they can be.

You can view the source code of Devise any time you want on its github repo - it's not hiding anywhere.

I think that having authentication code vetted by 100s, if not 1000s of different developers is much better than rolling your own authentication code.

You make your prototype or fit your product with a rapid dev framework, Rails is pretty much built for that, it doesn't intend to scale beyond it (see Basecamp: they don't pile onto a monolith, they make fresh new versions).

One you get that product fit, your codebase should still be small enough to rebuild it quickly in a more stable language. Java, C#, Go, Rust, whatever... something that gives you better runtime guarantees without requiring bonkers amounts of language hacks so you can spend less time writing unit tests and stubs and mocks.

Im not saying it’s rational to skip three days of early development for months of effort down the line, just that it happens.

I think being able to have a default toolbox that will allow you to get up and running quickly so you can find a proof of concept or really start to formalize the problem your app addresses and the solution it provides, along with a quick feedback loop, is very valuable.

“Time to Productivity” is a reasonable way to evaluate the overall complexity of a tool.

When GraphQL came out I was quite honestly shocked that this didn’t get more attention. It’s essentially trivial to not notice that a query could cause the server to loop heavily. User > Friends > Friends = easily 10000 results, and that’s the simplest top-of-the-head example I can think of. When an object has even 3 or 4 possible relationships, there are exponentially more attack vectors.

And on a minor note: the fact that objects are returned inline makes a query for duplicates that much larger in KB.

Now, what does GraphQL _actually_ solve? For one, it gives proper documentation and ability to know what the client(s) are consuming. In turn allows client devs to develop their side much faster and independently from the backend. Where we used to have a lot of back and forth about the design of the api we can now model our interface according to the Business model and not have to accommodate for the limitations of a flatten structure. There are more advantages to GraphQL but it goes too far to elaborate in this comment