In the risk reduction tab, it should compare the vulnerability count against the node-slim image. In my eyes, it takes away from the offering when they try to prop up the vuln count for the official images, and nobody deploys `node:latest`.
I understand the general point you're making, but the pg package isn’t a good example. It has 6 deps, not 13, and 5 of those are internal packages from the same monorepo without additional dependencies. There’s only a single external dependency, and that one brings in just one additional package.
In my opinion, the pg repo and packages are an example of how OSS stuff should be maintained. Clean repo, clean code, well-maintained readme, and clearly focus on keeping things simple instead of overcomplicating.
Can somebody provide an archive link? Trying to access the site, I get a Cloudflare security page that says my access has been blocked by some security rules.
The target audience also includes Angular developers. NestJS emulates several aspects, such as modules, that it doesn't necessarily need to mimic Angular's appearance.
I cannot pass judgment on whether this is good or bad, but I can easily see how this familiarity can be beneficial for the average programmer.
> For a long time NestJS depended on class-validator ... and regularly suffers from security vulnerabilities that can take years to fix.
As a maintainer of class-validator, I'd like to clarify that this is not accurate. Legitimate security issues, when reported, are promptly addressed. The multi-year security alert listed in NIST NVD is akin to the bogus report that the curl maintainer discussed a few months ago.
In a nutshell, the report suggests that specific settings can potentially lead to validation bypass, which is indeed the case because these settings determine whether unknown objects should fail or pass the validation. This is analogous to my creating a CVE for Windows simply because anyone can access my computer when I haven't set a password.
However, the other part about the scare support is sadly true though.
I think the most bad rep for RxJS comes from using it when it is not needed.
Parent comment said:
> But the problems they solve are also unintuitive.
Do you consider calling a JSON API unintuitive or complex? If not, then you may be using the wrong tool. If you need nothing else, you are perfectly fine using a promise.
If you need to await extra requests, transform them, and react to other events then you need RxJS. For a simple call, you do not.
> I would imagine most people’s use case (mine certainly is) for RxJS boils down to “call a JSON API and receive a response”. That shouldn’t be a hard problem
Do you consider the following code hard to understand or are you are making requests in a more complex way?
```
this.network.get('<url>').subscribe(response => <do whatever you want here>)
```
Even if we agree to disagree that the above code snippet is hard to understand, you can just convert it to a promise:
Thanks for this! There are more than 400 comment here, so my post will be probably buried instantly but I just need to share this with someone!
I just have finished playing A Plague Tale: Requiem[1] a few days ago, and I spent the last two days with this strange feeling of sadness, almost grieving. It is such a masterpiece of emotions, the story of the bond of a sister and brother who went through hell to save the boy.
I remember the first game had the same effect when I played it the first time. For days I felt the with a mix of sadness and happiness. The developers have been successful creating such a strong bond to the characters that I felt I am practically there next to them, experiencing the pain and happy moments alike.
I really suggest everyone who has the smallest intention to play games to experience these two masterpieces[2][3]. (You definitely need to play the first game to be able to experience the second to its fullest.)
Since we are on HN, one technical detail that impress me so much the number of unique animations they created to give life to the word around us and to show the bond between the two of them. Like how Amicia waits for Hugo to get down from the ladder every time or how Amicia picks Hugo up multiple times during the storyline to carry him.
Thanks for letting me share this, I hope all of you have a nice day!
> ...team is great and lot of interesting challenges...
A great team and exciting challenges are a strong retaining factor, and I dare to say, it's way harder to find a job that excites you than one which pays well.
It's worth a note that this was introduced with the latest DLC, and the AI currently is hopelessly broken as it does not understand the importance of defending your railway lines connecting your supply depots.
I am surprised no one said it yet. The usage of Github logo is now allowed as your own product branding[1]. You probably won't get into trouble, but still you should consider changing it.
> You just described every frontend framework. None of these are unique to Angular. Any developer with an understanding of JS can learn and use any framework in the exact same way.
You just summed up, why he said Angular is better in this regard. Yes any developer with experience CAN lean how to write good structured React apps. In Angular it is basically enforced.
An honest questions: How much have you worked with Angular? I have worked with it since the first release and what I see that it is steadily (albeit sometimes slowly) going into the right direction. Today the dev UX is great and differs nothing from that of using CRA for example. (If we are talking about tooling)
I live in east Europe in a country with public healthcare (our system even considered to be in bad state). However if I have to choose between spending the saving of my family and spending a week or a month in an ugly hospital, I choose the latter without thinking. The doctors doing the healing are the same, the quality is the same, only aesthetics differ.
There are problems with puclic healthcare that needs solving, but I would much rather focus on thoose problems than pumping insurace companies with money so private hospitals can charge 10x-100x the price of a treatmant (compared to Europe for example).
It's so surprising that nobody ever talks about the active nuclear policies the countries have. For example Russia states the following:
> With regard to nuclear weapons specifically, Russia reserves the right to use nuclear weapons:
> - in response to the use of nuclear and other types of weapons of mass destruction against it or its allies, and also
> - in case of aggression against Russia with the use of conventional weapons when the very existence of the state is threatened.
As long as NATO doesn't nuke something first or the very existence of Russia is not threatened, they should not use nukes.
From this part on I am speculating only, but I believe if Putin would press the red button the officers would have the right to refuse to execute the order.
Just to be clear the Budapest Memorandum doesn't say anybody needs to nuke anybody. It only says that the sovereignty and borders of Ukraine, Belarus and Kazakhstan must be respected. One can respect those borders without going to war and just keep protesting in the UN.