Issue #50: Overprotected
🎶 There must be another way, cause I believe in taking chances, but who am I to say… 🎶
As inhabitants of this full-stack metaframeworks world, we don’t ask ourselves the question of what and why we need to protect. We ask from whom, and how exactly. Let’s dig deeper into our options today, along with the two biggest metaframeworks and a new modest project of yours truly.
The Good
While people constantly get more and more mad at GitHub for their poor responses to ubiquitous security problems, and other folks trying to give the community good alternatives as new bespoke tools, metaframework development teams come up with their own solutions and processes to face the everchanging challenges on this part of the ecosystem.
Vercel, curating both Next.js and Nuxt teams, published some thoughts on their new security practices for Next.js releases and Nuxt pipelines (which followed closely the latest release of Nuxt) alongside that (I had a hard time trying to reach the latter because of almost permanent outages, hopefully not security-incident-driven ones). Both updates were quite timely as the number of (presumably largely AI-driven and AI-enabled, but we don’t judge here) ethical vulnerability disclosures grows quite quickly (especially for Next.js and Nuxt, and especially lately) and requires some dedicated measures. Socket team tried to help the guys by providing some additional patches too, for older releases specifically, which is an awesome initiative.
All in all, these measures look quite reactive and chaotic, and that’s what bothered me always during work on all the 50 issues of Metaframework Records (🎉). As a long-time OWASP member, I had an idea in mind for quite some time already, and lately I started to iterate on implementing this idea, actually. So the thing I wanted to share in this context is the first draft of Top 10 Metaframework Security Risks — a kind of registry of potential problems, security issues, and vulnerabilities characteristic for metaframeworks of all sorts. The taxonomy is inspired by other OWASP standards many of you have heard of and used, but it’s much more specific to metaframeworks and full-stack web applications and websites built with them. I welcome your feedback and would be happy to accept any contributions to the project.
Of course, I’m not saying this is something that could prevent potential harm that implementing the threats from the aforementioned vulnerability disclosures (or other problems like those patched in the recent Quasar release) would cause (at least yet). But at the same time, it would allow to prepare to that better, build better security programs on comprehensive production examples, and respond in a structured and meaningful way, without breaking the stuff millions of users consume and love.
The Bad
We, software craftsmen, will never give a rest to them security people and will never stop the flow of creative ideas that will definitely bury other (mostly unnecessary anymore) technologies as a legacy code. And the JavaScript world is at the forefront of such (often unsolicited) innovation process.
Two new shiny tools emerged out of nowhere (and with rather minimal amount of tokens) lately.
First of them is a framework with a bold promise for bringing correctness to the web front end, called Foldkit. Interestingly, it is built on Effect (which I personally love and am afraid of so much at the same time) and with Elm architecture in mind (the same here). So if superiority and fear is something of your pieces of the webdev cake, check that out definitely, and maybe you would even be bold enough to ideate on a metaframework above that.
And talking about the metaframeworks, the second project I wanted to mention is mochi, Svelte-based SSR renderer built on top of the bun ecosystem with all sorts of islands you could think of (it is summer in the end you know — the holidays and such).
But if you don’t want to move blazingly fast and just want to chill with rad folks, check your plans for August 8th, as it will be the international HTML day, and it may even take place around your hood. By this time I’ll maybe have another bunch of new metaframeworks to share with you and discuss why just using the platform is often much better.
The Noteworthy
And if anyone knows how to use the Cloudflare platform efficiently and engage a bit of awesome complexity to get innovative engineering gems, it is the Astro guys, who recently published their new minor release 7.1 with lots of performance and DX improvements, but also with some cool stuff I’d been waiting for, to implement pagination for the Metaframework Records website eventually — pagination URL formatting.
The React Router team also published their new minor with minor experimental RSC support improvements while the main metaframework dish (Remix) is still cooking.
As a conclusion for the main topic of today’s newsletter issue, what is the best way to protect your code? Write it yourself, knowing what you do and trusting your deterministic tools. Watch this video from the magnificent Andrew Kelly to get to know why, if you need that push, but overall, just do your best to protect your dearest. Nobody else will.
👋