Readit News logoReadit News
jcmontx commented on RCE Vulnerability in React and Next.js   github.com/vercel/next.js... · Posted by u/rayhaanj
coffeecoders · 15 days ago
This vulnerability is basically the worst-case version of what people have been warning about since RSC/server actions were introduced.

The server was deserializing untrusted input from the client directly into module+export name lookups, and then invoking whatever the client asked for (without verifying that metadata.name was an own property).

    return moduleExports[metadata.name]

We can patch hasOwnProperty and tighten the deserializer, but there is deeper issue. React never really acknowledged that it was building an RPC layer. If you look at actual RPC frameworks like gPRC or even old school SOAP, they all start with schemas, explicit service definitions and a bunch of tooling to prevent boundary confusion. React went the opposite way: the API surface is whatever your bundler can see, and the endpoint is whatever the client asks for.

My guess is this won't be the last time we see security fallout from that design choice. Not because React is sloppy, but because it’s trying to solve a problem category that traditionally requires explicitness, not magic.

jcmontx · 14 days ago
Just like the old days of PHP servers exposing their source code
jcmontx commented on Programming the Commodore 64 with .NET   retroc64.github.io/... · Posted by u/mariuz
keraf · a month ago
> Subpar tooling outside of Windows (I'm looking at you C# Dev Kit)

JetBrains Rider is excellent and runs on Windows, Mac and Linux. It has a few Windows only features but nothing important for me, it's the best IDE for C#/.NET you can get on non-Windows platforms imo. And it's free for non commercial use.

jcmontx · a month ago
You're probably right. I haven't tried it thoroughly
jcmontx commented on Programming the Commodore 64 with .NET   retroc64.github.io/... · Posted by u/mariuz
bnchrch · a month ago
Question to HN .NET Devs

Its been a long time since I was in the MSFT ecosystem (left just as wsl was getting popular).

I remember thinking C#, F#, .NET and LINQ was a pretty robust set of tooling that was ahead of its time and certainly ahead of Java.

At the time, the things that were holding it back was:

- Poor to non existant linux support

- A confusing labyrinth of MSFT web frameworks that were nonsensically named and often deprecated

- A very GUI heavy dev and production setup

I know a lot has changed since then. So how is it in 2025?

jcmontx · a month ago
Citing my own comment from another thread:

I've worked with .NET for over 10 years and we built our startup on top of it. Here are my thoughts: Pros:

* Stability

* Very decent standard library

* Good balance between productivity and robustness

* Great package management

* Extremely easy to upgrade, so essentially free goodies (performance) every year or so

Cons:

* Very MSFT dominated (obviously)

* Subpar tooling outside of Windows (I'm looking at you C# Dev Kit)

* C# has way to many features, it feels bloated

* Culturally, it feels like .NET devs are less "passionate" about their work

* The freaking stigma of being a .NET dev: you will never be as cool as the guys who work with Node/Python/whatever

Edit: Also I'd like to add EFCore as one of the pros of the ecosystem. Hands down the best ORM. Others don't come close.

jcmontx commented on AI World Clocks   clocks.brianmoore.com/... · Posted by u/waxpancake
jcmontx · a month ago
Grok is impressive, I should give it a shot

Deleted Comment

jcmontx commented on .NET 10   devblogs.microsoft.com/do... · Posted by u/runesoerensen
jerhewet · a month ago
> C# has way to many features, it feels bloated

Could not agree more. Too many -- WAY too many -- "features" from Javascript and functional languages have been jammed into C#, and the language has suffered for it. Every time I see "var blah" in C# code I cringe at how lazy you must be to not use strong typing when declaring a variable.

Same goes for "astink / await". If you need asynchronous multi-threaded code, use the damned Thread Parallel Libraries that Microsoft provided over a decade ago. Being forced to have every damned thing you write in C# wrapped with astink is just one giant code smell.

Yes, I'm old. Thank ghod I'll be retiring very soon, because as far as I'm concerned the tooling and languages I've used over the past 50 years have taken one step forward and at least three steps back in the past five years...

jcmontx · a month ago
> "astink / await"

If you take it in the context of the industry, I think async/await is the more imperative friendly option. It let's you write code sequentially without callbacks. And the performance gains are definitely worth it. I'll have to respectfully disagree

jcmontx commented on .NET 10   devblogs.microsoft.com/do... · Posted by u/runesoerensen
deburo · a month ago
* C# has way to many features, it feels bloated

Most of the newer features make C# less cumbersome to use. I can't imagine using the language from ten years ago, in fact the first thing I do when working on a legacy app is to set langVersion=latest.

jcmontx · a month ago
Sometimes less is more. It very easy for devs to use the language in completely different ways. I lean towards Go style in that regard. My ideal language would be like Go + Linq.
jcmontx commented on .NET 10   devblogs.microsoft.com/do... · Posted by u/runesoerensen
jcmontx · a month ago
I've worked with .NET for over 10 years and we built our startup on top of it. Here are my thoughts:

Pros:

* Stability

* Very decent standard library

* Good balance between productivity and robustness

* Great package management

* Extremely easy to upgrade, so essentially free goodies (performance) every year or so

Cons:

* Very MSFT dominated (obviously)

* Subpar tooling outside of Windows (I'm looking at you C# Dev Kit)

* C# has way to many features, it feels bloated

* Culturally, it feels like .NET devs are less "passionate" about their work

* The freaking stigma of being a .NET dev: you will never be as cool as the guys who work with Node/Python/whatever

Edit: Also I'd like to add EFCore as one of the pros of the ecosystem. Hands down the best ORM. Others don't come close.

jcmontx commented on Building a 2.5kWh battery from disposable vapes to power my workshop [video]   youtube.com/watch?v=dy-wF... · Posted by u/rsanek
jcmontx · a month ago
Incredible how wasteful we're being. Market-driven economy will doom us all

Edit: I'm not saying I have a better alternative, but this system is deeply flawed

u/jcmontx

KarmaCake day572January 24, 2018
About
CTO
View Original