RisingStack Blog

Some more links that are express specific: https://expressjs.com/en/advanced/best-practice-security.html https://blog.risingstack.com/node-js-security-checklist/ I am also curious to know what's wrong with express.

For anyone not in the JS/Node worlds, this is a significant release that people are particularly excited about. It was also delayed somewhat due to wanting to align with V8 which should, however, be totally worth it :-) Other relevant posts digging into new features include http://codingsans.com/blog/node-8 and https://blog.risingstack.com/important-features-fixes-node-js-version-…

Rising Stack blog: https://blog.risingstack.com/ Ok Grow! blog: https://www.okgrow.com/posts Differential blog: https://differential.com/insights/

Mostly testimonials, but interesting examples for me to see considering I've just got 6 months of full-time Node.js under my belt after many years in Java and Ruby. There's a link from this blog post to the Node Hero Tutorial and I don't remember coming across this recommendation to organize file structure around features rather than roles: https://blog.risingstack.com/node-hero-node-js-project-structure-tutor… It looks like a good option to me. I just finished a standalone notification system in one of our Node.js apps and all the files are organized more like this than the typical Rails file structure.

This title has been changed from its original. Mods? Node.js applications are one thing, Express.js applications are another. This seems to talk about the Express.js framework, and Express has its own set of guidelines that should be followed as the bare minimum, sadly in the "advanced" section: https://expressjs.com/en/advanced/best-practice-security.html https://blog.risingstack.com/node-js-security-checklist/ In reality I see two things that bite most outfits getting their feet wet with Node for the first time, and it's not how well the passwords are hashed. First is the age-old problem of input validation. Express.js devs read the tutorials that show bringing in data directly from req: https://expressjs.com/en/api.html#req ... and just accept it. Unvalidated input / unfiltered output seems par for the course in a lot of smaller Express.js APIs, especially when they are using Angular, Knockout or another client-side framework that offers some filtering of data being returned from the API. A close second is third-party dependencies. While the Node Security Project does what it can to help out, and nsp/snyk are good best practices, the Node.js culture of importing modules for everything often leads to really large attack surfaces with rarely-audited modules of unknown provenance added for development speed. Third-party modules -- especially less popular ones -- are a goldmine of critical vulnerabilities just as WordPress plugins used to be (and still are). Also, a…

You have a number of ways of keeping a handle on async code now. 1. Native ES6 promises will cover most of your basic needs. See https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_… In fact, unless you have very specific needs not covered by native promises, you shouldn't drop a third party library into your project. 2. For more advanced operations on promises, use Bluebird. See http://bluebirdjs.com and http://bluebirdjs.com/docs/api-reference.html. It has a ton of features built on top of native ES6 promises. If you're using an older version of Node, it also acts as a polyfill. It can also make it easy to work with libraries that only expose a callback-based interface. So yeah, Bluebird is the shit. 3. co is a generator-based control flow library that can make your async code look more like synchronous code. It's pretty cool, but I haven't personally used it in a project, nor do I know of anyone else who uses it. It builds on top of promises and generators, and isn't very hard to understand under the hood. See https://github.com/tj/co. I wouldn't recommend it, but it might be something to play with because ... 4. ... async/await is coming to JavaScript! At a very high level, this pair of keywords is syntax sugar for what co already does as a library. This is the final stage in the evolution of taming callback hell in JavaScript, and it builds on top of everything that has come before (promises and generators). Here's a tutorial:…

I think the post needs a clarification in that ECMAScript is not a language and has nothing to do with the name JavaScript. ECMA International defines a standard called ECMAScript that implementations such as JavaScript, ActionScript3 (Adobe), TypeScript and probably some more have adopted. https://blog.risingstack.com/history-of-javascript-on-a-timeline/

Wow that cellular automata sandbox is almost identical to something I wrote a while back! You might find this article interesting for running arbitrary code in a browser sandbox: https://blog.risingstack.com/writing-a-javascript-framework-sandboxed-…

The more users, the less likely you are to use an off-the-shelf framework. Netflix: https://netflixtechblog.com/building-the-new-netflix-experience-for-tv… Facebook: https://blog.risingstack.com/the-history-of-react-js-on-a-timeline/ Edit: find out what framework (although it didn’t work on some urls I tried): https://www.wappalyzer.com/

1. Fees on chains made for transactions are pennies (Google "X transaction fees" where x = solana, polygon, bitcoin lightning, etc.) 2. I'd expect a project trying to create digital money to take a bit more time then a JS framework[1]. Does that seem reasonable? It took React 6 years to "go mainstream" and had the backing of Facebook. It's hard to do consequential things in the real world, it will take time. 3. Why do you think it won't happen? Just because it's taking a long time? It's a big change with a ton at risk if it goes wrong. It's going to take a while to happen. 1 - https://blog.risingstack.com/the-history-of-react-js-on-a-timeline/

If you include Borg (Kubernetes' predecessor as an internal tool at Google), then the tech has been around since 2003: https://blog.risingstack.com/the-history-of-kubernetes/ I am sure that's not what they meant though!

Just do a search for “use TypeScript with Node”: https://medium.com/javascript-in-plain-english/typescript-with-node-an… https://blog.risingstack.com/building-a-node-js-app-with-typescript-tu… Basically, you install the `typescript` package which gives you `tsc`. Then you configure Node to run your program with `tsc` through your package.json.

Every new thing has humble beginnings... https://blog.risingstack.com/the-history-of-react-js-on-a-timeline/ Fun Fact: The audience was skeptical. Most people thought React was a huge step backward. This happened as mostly 'early adopters' attended this conference, however, React targeted 'innovators.' The creators of React realized this mistake on time, and decided to start a 'React tour' later on to turn haters into advocates.

http://brewfactory.org/ "Full-Stack Homebrew with IoT and Node.js" a blog post about: https://blog.risingstack.com/brewfactory-full-stack-homebrew-with-iot/

maybe check: https://blog.risingstack.com/functional-reactive-programming-with-the-…

Docker is mainly an app packaging mechanism of sorts. Just like you would build a jars, wars or rpms, etc. you create docker images for your applications. The advantage you get is that you can package all your dependencies in the container thereby making your application independent and using the tools provided by docker in combination with swarm, compose, etc. it makes deployment of your apps and scaling easier. OpenVZ, LXC, solaris zones and bsd jails on the other hand or mainly run complete OS and the focus is quite different from packaging your applications and deployments. You can also have a look at this blog which explains the differences more in detail: http://blog.risingstack.com/operating-system-containers-vs-application…

For traditional sessions: 1. All You Ever Wanted to Know About Sessions In Node.js (Stormpath) - https://stormpath.com/blog/everything-you-ever-wanted-to-know-about-no… 2. Express.js Production Best Practices - https://expressjs.com/en/advanced/best-practice-security.html 3. express-session (npm module) - https://ewiggin.gitbooks.io/expressjs-middleware/content/express-sessi… 4. Node.js authentication strategy using Passport.js and Redis - https://blog.risingstack.com/node-hero-node-js-authentication-passport… For JSON Web Tokens: 1. JWT Handbook: https://auth0.com/e-books/jwt-handbook 2. IETF Specification: https://tools.ietf.org/html/rfc7519 3. https://jwt.io/ 4. Authentication in React Applications, Part 2: JSON Web Tokens - https://vladimirponomarev.com/blog/authentication-in-react-apps-jwt 6. Token Authentication Implementation - https://docs.docker.com/registry/spec/auth/jwt/ 7. JWT Validation and Authorization in ASP.NET Core - https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-…

"Almost a decade" About 5 years tbh: https://blog.risingstack.com/history-of-node-js/ "hardly find any large, well-known website being powered by node" * Netflix - https://www.talentbuddy.co/blog/building-with-node-js-at-netflix/ * New York Times - https://www.talentbuddy.co/blog/building-with-node-js-at-the-new-york-… * PayPal - https://www.talentbuddy.co/blog/building-with-node-js/ * Medium - https://www.talentbuddy.co/blog/on-building-with-node-js-at-medium-and… * LinkedIn - https://www.talentbuddy.co/blog/building-with-node-js-at-linkedin/ * Uber - https://www.joyent.com/developers/videos/node-js-office-hours-curtis-c… It's a tool, and like every other tool comes with its pros and cons. I am not saying Node is the perfect fit for any project, because it isn't. However stating it isn't used and almost a decade is just wrong.