R2S was a painful one, but Lachlan was a dream of a security researcher to partner with. Not just from a responsible disclosure POV, but things like hopping on multiple calls with Meta and our team to help us validate remediations. Thank you Lachlan for helping make the internet safer (and great job on figuring out this 'labyrinth' of a vulnerability)
This was a pivotal project for me as a young lad learning Linux and software engineering back in the day. Can't recommend it enough. So many little frustrations and painpoints to overcome, wasn't easy , and shows you the ropes of what's to come.
Heard and appreciate the feedback. We’re well aware of the DX papercuts in Middleware. With 15.5 we made a big step in supporting Node runtime[1] which addresses a slew of issues people have reported over time.
If I went back in time, I would have called it Routing Middleware or Routing Handler. A specific hook to intercept during the routing phase, which can be delivered to the CDN edge for specialized providers. It’s also a somewhat advanced escape hatch.
Since OP mentions logging, it’s worth noting that for instrumentation and observability we’ve embraced OpenTelemetry and have an instrumentation.ts convention[2]
It’s possible `/` redirects but other hidden routes phish. If someone gets e.g.: a fake password reset email, it might help the attacker bypass sanity checks users make.
I've been acting mostly as the 'ideas guy' and helping with the architecture / QA. It's a great way for me to dogfood Vercel and build empathy as a user in an external org, using external services.
Someone in our community created a provider and I wanted to showcase it.
It’s nice insofar with very little abstraction, runtime, and bundle size overhead, you can easily switch between models without having to learn a new API.
JS is used for fast page transitions and stuff like that, but funny enough I'm pretty sure I end up shipping less JS overall by running server-side JS.
Last I checked, a Tweet embed alone was several mbs of JS, and it causes a bunch of layout shift and loads third party resources. On my blog they're pre-rerendered and shipped statically[1]
Probably the strongest reason though is to not set a 'power cap' on your project unnecessarily. It'd suck to have to rewrite a project because you got trapped in a local maxima, which is why i always share you can have your 100 lighthouse cake & eat it too.
If you have any concrete feedback on what we should improve, I’m all ears. We heard feedback from the community that they wanted better documentation and guidance on self-hosting and we shipped it last month[1]. Curious what you’d like to see improved.
Middleware does work with self-hosting[1]. It’s a more limited runtime that’s based on web standard APIs, which creates optionality for running it in high performance / resource constrained scenarios.
I appreciate your good faith engagement and legitimate questions.
Three quick reactions:
- The employee did not find location information on our platform. Our security team is certain of this and that the system worked as intended, but the employee misused it.
- Everyone at the company takes PII and protecting customer data extremely seriously. We have and we will continue to reinforce this in light of this situation.
- Our ToS are specifically designed to protect our customers. Note that in the terms folks are discussing we mention “only in connection to providing our services”. That said I’ll be following up internally to see if more clarifications can be made (I’ve seen companies provide high level summaries in the past to help with the legalese interpretation)
- Leap AI (tryleap.ai) created a template which is a demo, incomplete version of other popular products.
- Templates get submitted to the marketplace all the time. One of Vercel’s devrel promoted it. The idea is to help people learn from a realistic, complete example
- This template has nothing to do with the code or data of any existing hosted Vercel app
> Turns out Vercel are trying to kill solutions like Tamagui
No one is trying to kill Tamagui. Why would we want that?
> the higher ups there are investors in Tailwind
I don’t know any investors in Tailwind at Vercel. I’m certainly not one. I don’t think they’ve even taken outside investment. And it’d be against our ethical and fiduciary responsibilities to favor one solution over another on that basis.
> are trying to consolidate styling around it for their own ecosystem benefit
Tailwind is a great solution that’s earned the hearts and minds of the community, and that’s why we include it as an option in `create-next-app`.
Maybe your perception is backwards? Large parts of the ecosystem are consolidating on Tailwind, and it’s our job to provide sensible defaults according to that.