Web development thread

Don't get personally offended over which tools people use or don't use edition! Talk about front end, back end, devops and anything in between. Just remember that life doesn't make sense and feeling offended over someone's technical preferences only makes you a little bitch in the eyes of the universe!

Just getting into node and back end dev in general. Can anyone give me some tips on back end security? Any recommended material? There's painfully little information online, most of which is very basic (sanitize user input, have common sense on URLs, etc)

Currently writing an imageboard in Elixir for my small community of users on 8ch. I want to move us away from there for various reasons, but I couldn't find any existing software that I felt happy adopting, so I'm rolling my own. Meguca came closest but it was overkill for our needs.

>>284 OWASP is usually a good place to start when it comes to anything web security https://www.owasp.org/index.php/OWASP_Guide_Project

There's hardly any threads, how could you miss it: >>51

>>306 The content of that thread is of a particular opinion that not everyone is behind.

>>306 The thread turned into a soykafshow of "my technology beats your technology". The point of this thread is specifically to avoid that kind of pointless behavior.

How does one go through the process of picking a language for a project? Wanted to create something simple, a site where users can upload a file and send a link for the recipient to download its content. Initially I was going through with Python/Django, but then many other web developers much more experienced than I started giving me advice to use languages like GO, Ruby, and even Node.js Any advice?

>>320 >How does one go through the process of picking a language for a project? "How will this language make my life easier and fill the needs of my project?" If the answer is "whatever", then whatever. It's not important which language you pick unless you understand the implications of using that language. It's a mistake to use any tool just because someone told you to, if you don't understand the advantages of X you will not use X effectively, you know? So it honestly doesn't matter which language you use. Pick any of them and start working on your project, in time you will get experience with more languages and understand the upsides and downsides of each one and then you can mix and match between them for each project.

>How does one go through the process of picking a language for a project? If there is a certain that you think would be the best fit for your project, go with that (and implicitly the language it's written in). Otherwise I'd just go with whatever language/framework you're the most experienced with as you'll be the most productive with that. If you have a certain thing in mind you want to build and building (and having) it is the primary goal, I wouldn't jump on anything other people recommend because that'd just slow you down.

>>283 May we politely talk about how in general the frontend for many websites are very heavy (if not bloated). http://motherfuckingwebsite.com and http://bettermotherfuckingwebsite.com are satirical answers to this problem and are also examples of lightweight pages.

>>320 >How does one go through the process of picking a language for a project? >Wanted to create something simple, a site where users can upload a file and send a link for the recipient to download its content. Initially I was going through with Python/Django, but then many other web developers much more experienced than I started giving me advice to use languages like GO, Ruby, and even Node.js The first question you have to ask yourself is: does the language make a difference to you. For me personally its important to use a programming language I like, not just for having modern syntax features, but the aesthetics of the language itself. Languages like Ruby, Javascript, Coffeescript just put a smile on my face. If you plan to do web development as a profession and use this language 8 hours a day then this choice makes a big difference because it affects how you think about code and how productive you are. Now Im not saying that the language makes a difference for everyone because I know programmers who are top notch rock star level who dont give a rip as to what language they are using any more than they care about what brand of gas they put in their car. If you are one of those type of people who dont care about programming languages then I would suggest starting with PHP. PHP syntax itself is a mix of Perl, C and Java so it just feels old to me and I personally cant get into it. But PHP will give you a good general understanding of how backend programming works. Unlike more complicated frameworks PHP just uses a simple API of functions to give you more direct control of what is going on than a large web framework would. If using nice programming languages do make a difference then I would suggest a microframework like Sinatra or Flask. If you already have experience doing frontend work with Javascript then it might be worth starting out with node.js. node doesnt really take the place of large frameworks like Rails or Django, its more for doing live updates to a webpage that dont require a page refresh.

>>338 I think that's to be expected, given the boom in webdev job offerings and the amount they pay. With relatively little knowledge you can make 60k/y. I think that leads to people who don't really understand or even like what they're doing to make these pages, thus they end up not giving much of a fuarrrk about security or bloat. That's of course, taken right out of my ass, i have no proof whatsoever, it's just what it looks like to me.

I built a little messaging web app a while back. I'd like to clean it up and go live with it; design will be mobile-first. I built it without any real framework and it's really raw. so if I were to repackage it with intent of making it usable on mobile, would Angular be the way to go?

>>348 Maybe it would, maybe it wouldn't. Read angular's goal as a framework and see if it does for your program what you expect it to do. Nobody can answer your question with this description.

Any books you guys would recommend for someone getting into back end? Most back end material i've come across usually teach programming, which is not what i'm looking for. In the front end you have essential knowledge (html, css, js). What i'm looking for is the back end foundation: routes, security, and anything else essential for a real project.

Free as in freedom. I saw this thread and the `modern' web development thread, so I thought about this. Who here is making a site with nothing more than HTML and maybe CSS? No javascript, nothing server-side. What do you do to make your site have semantic data? Do you use both rel and rev in your links? Do you use "prev" and "next"? Do you use XHTML? I only do some of those things, i.e. all the things I can do in HTML 4.01 strict, but I want to know how my fellow lainons preserve a semantic web of free documents, full of free information and metadata, on their personal sites. I just realised now, before making this post, that the web development I speak of isn't programming. There is no action to documents. But until a /tech/ board is made, I hope this thread and this post is okay.

>>338 The second site is retarded, because he thinks CSS is good rather than bad. Documents should be documents, and CSS should only be user-defined custom CSS, and never supplied by website creators.

>>356 When I make websites, I try to keep them very simple to make it light out of principle and to make it the best for the user, while also very easy to update in the future. I have only ever done static websites, but the code is usually HTML5 and HTML4 compliant, with some CSS used to make it look nice and to make it work on mobile phones aswell. I'm not so much sure about "rel or rev" tags and using them.

>>357 While that is nice and all, I'm afraid thats not how what is considered the web currently works. As much as that sounds like a grand idea, I don't see it moving to that anytime soon, so what the second website is more for is to give you a good way to please the eyes of those users who don't appreciate their own custom CSS but also could do with the move back to lightweight design.

>>357 Says who? You're not an authority on how the internet works, and clearly everyone else thinks it's the correct way of doing things or else it wouldn't be done that way.

>>357 While HTML was originally born as a language to define documents like you say, nowadays it's a wrong definition. Today's HTML + CSS are declarative languages to define interfaces rather than documents.

>>353 bumpity bump

>>498 >>353 If youre looking for a magic web programming book that will make you an instant backend expert, I havent found it. Ive read so many Rails and node.js books that Ive lost count. If I get back into backend I plan to start with PHP because all the Rails and node books seem to assume you already have previous backend experience.

>>499 I never mentioned "book to turn me into an expect". I was referring to basic principles, as language agnostic as possible.

>>356 How is that more free as in freedom than anything else? You can write free JavaScript and free server-side code. The way I do things is my server-side is PHP licensed under the GPL and on the client I have optional JavaScript also under the GPL. The site works fine with JS disabled but you lose some minor extra functionality. There is nothing wrong with using JS to add some extra nice things, what is wrong though is making any content inaccessable with JS turned off, thats a big issue. I'm a big fan of progressive enhancement.

>>749 Shouldn't you post this in that thread instead?

>>501 You're not gonna find a language agnostic one, but Miguel Grinberg's book on Flask is great for this. Flask is a micro-framework for python, and since it's small you end up hooking things up as needed. It starts with templates -> forms -> databases -> ORMs -> authentication -> sessions -> email confirmation/password resets -> admin panels. They're really easy to learn, and even if you don't stick with them, you'll know how and why "all in one" frameworks work and why people use them instead of "growing their own". And since you know how to put it together, you'll also know how to use another micro framework in another language, like Express.js or what have you. It's in the PDF thread, the tutorial on his site is pretty outdated. Probably one of the only web development i'd wage slave because it's just that good (in my opinions).

i write heaps of stuff in python. i switched to it from PHP a few years ago and haven't looked back. im pretty handy with javascript but think all those new fangled frameworks like react are for hipsters, especially when i hear about how fuarrrking complicated it is to put some basic text on a page with it... what happened to just html and js... anyway my latest thing is aws and salt stack. they go together nicely and i'm learning lots about it. discovering salt stack reminds me of when i first discovered SCM: "how did i live with out it". i dont know much about similar tech like puppet, docker... anyone care to give a quick comparison?

Rather newbie here, all help is welcome. Quick background info: I do already know C, Python, bit of C++ and I am getting my hands dirty with ASM, so I am a bit knowledgable already. The thing is, all the programming I have ever done has been for microcontrollers, nothing else. My question: If I wanted to learn some web programming, from back to bottom, what should I learn? I already know HTML, which feels like an underpowered LaTeX and some CSS. I really do not like javascript, I am a bit in favour of D. Knuth's opinion: if something is too widely used, then I may think I am doing something wrong. Javascript just feels to be designed to make everything easy with the least bit of knowledge, I don't like that. The thing is, I really don't know what language to learn to program backends. People say PHP is rather soykaf, but for what I have read, it is getting better and it mostly depends on good practices (like C). Ruby looks beautiful, however, the Rails thing... I don't like it, it seems you are completely dependant on other utilities that your language should support, and it looks a bit hacky. Python seems to be a recommended language, with all new frameworks popping up. I like Python for quick hacky scripts and maths related stuff... But to use it in the web... What about Go, Elixir, Clojure? I do not mind if a language is old and whether "you shouldn't use it any more", If it does it's job correctly, and requires an average brain to do so, I am fine with it. I don't mean average as not too intelligent, but as not stupid. Which has the more documentation, future, performance, ecosystem, scalability and is easy to modify? Is there anything I should know about frameworks when it comes to an specific language? Many thanks in advance!!

What CMS do you use, Lain?

>>754 >im pretty handy with javascript but think all those new fangled frameworks like react are for hipsters, especially when i hear about how fuarrrking complicated it is to put some basic text on a page with it... what happened to just html and js Like any tool, they serve a specific purpose. You should learn about that specific purpose and evaluate it's value in your project. Nobody puts in hundreds/thousands of yours in developing a framework just for complexity sake. Computer science isn't politics and it shouldn't be treated as such, not learning a framework because you don't want to is understandable, not learning because "it's for hipsters xDDD" doesn't make any sense.

>b-b-b-ut j-j-javascript is f-f-for hipsters!!!!!!!!!! Let's stop with the elitism bullsoykaf over which language to use, this is programming god damn you, not makeup. You pick whatever is suitable for the job not whatever will make your e-peen look bigger. If you want to make a website javascript is suitable, so you use it. It doesn't make you dumber, but complaining about the existence of a language does make you look like a whiny uninformed bitch. If you want to criticize <language> that's ok, but please, please provide honest arguments and scenarios. "I feel like thats for hipsters xDDDDD" is such an ignorant argument my balls ache in pain from reading it, god damn it. Don't talk out of your ass, if you want to criticize get some information, read their docs, look for benchmarks, get actual information that can be refuted or agreed upon. Your feelings will not compile. Don't give me this bullsoykaf of "i feel like", you don't feel like anything this is not fuarrrking therapy, you either have arguments against something or you don't know what the fuarrrk you're talking about. If you're picking a language because it makes you look good, you're the hipster, you're literally acting like the definition of a hipster. At the very least wait for web assembly to come out, then you can justifiably use C to make an image gallery if you want.

>>899 >If I wanted to learn some web programming, from back to bottom, what should I learn? It seems like you need the basics of programming, the concepts. Language syntax isn't worth anything. I would point you towards CS50, it's a free harvard course on edx. They teach the essentials of programming (language agnostic), and then explain how a web server works, make a few basic pages, etc.. When i did the course a few years back, you even developed a web server in C for the sixth problem set. >If it does it's job correctly, and requires an average brain to do so The way you speak says more about what you don't know than what you know. Programming isn't a football club, you don't need brains to use any language, you either understand the basic premises or you don't. A 5 year old child can learn X86, probably faster than you or me. Don't get so attached to languages, it's cheap because programming is broader than syntax. Also, you're worried about aspects of a language that don't make sense for a beginner. What do you care about future, performance or scalability? Are you going to marry the language? Worry about understanding the basic principles of web development, then pick a language suitable for the kind of job you want, this is the kind of research you have to do yourself. In the end you will have to deal with sessions, password encryption, authentication, routing, databases etc..etc.. in any of those languages. As a beginner, this is what you must learn, in whatever language you can find a good book/course/tutorial in. Don't buy into programming elitism, anyone recognizes that behavior as something only really new people do, specially in job interviews that really, really makes people think you don't know what you're talking about.

>>899 Im in the same boat youre in, I understand your apprehension of not wanting to get good at a programming language with syntax that I dont like or that feels underpowered. Once you get good at a language it tends to mold how you think about programming and its hard to want to try something new. First of all Javascript is a very powerful language and you will not be held back at all by learning it. It has the more powerful high order functions than Ruby or Python, you just cant pass functions in Ruby and Python and do things like you can with Javascript. The whole module system in Javascript just uses functions and objects as is, there is no special built-in module system in Javascript. One function or one object can contain an entire library worth of functionality. Where Javascript shows it age is lack of mapping functions and comprehensions to iterate over arrays and objects. You should almost never have to manage variables explicitly in for/while loops in modern scripting languages. Coffeescript does fix that, Coffeescript takes all the best syntax from Javascript, Ruby and Python, I wish it was its own language. I recommend learning Coffeescript if you have to do Javascript programming. And no, Ecmascript 6 does not come close to doing what Coffeescript does. As for frameworks. Rails hides too much. Ive tried learning backend programming from Rails and failed. Node is nice but the whole callback thing can get kind of messy so I had a hard time learning backend programming from that too. I hate to say it, but it might be worth learning some PHP just to get going with an understanding of how backend web programming works. You can try Go, Elixir, Clojure also, these languages tend to do backend more like Node rather than how Rails works. I personally like Go to replace the web API type of frameworks that Node does.

>>904 Thanks for the quick reply. I am sorry if my tone was elitist, I wanted to be precise. I know the mojo, use the right tool for the right task, and I intend to apply it. I simply wanted an honest answer, which you nicely gave. Thank you. I was very specific with what I wanted so I wouldn't be trying new languages for the next couple of years, though that may be what I have to do. Regarding scalability and performance. I mentioned them to know which languages are more suitable in the long run, I intend to go full on this topic. Either way, I was already signed up for CS50, however, uni exams just got in the way, I'll start it in June. >>906 I will eventually learn Javascript. I mean, I may not like it, but if I want to understand how the web works, there is no other way I can do it ~sight; nonetheless, it will helpful in the future if I ever want to start customizing things in the future. I have been looking into Clojurescript for a while, I'll compare it with Coffeescript, thanks. And about the issue with Rails you mentioned, that is what I didn't want. If learning is my goal, then using something that hides the process was not going to help me. Many thanks!

>>906 >Ecmascript 6 does not come close to doing what Coffeescript does. coffeescript compiles 1-to-1 with JS. its literally syntactic sugar, you LARPer

fuarrrk man, every single time. This contractor eager to move to my project tried to win points by naming completely irrelevant Java frameworks that have no place in the project while arguing that Java is just as good as Scala for functional programming.

>>921 >clojure literally compiles 1-to-1 to Java, therefore its just Java and not its own language huuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuur((USER WAS WARNED FOR NOT ELABORATING))

Do any of you freelance? If you do, what technologies do you use and where do you find clients?

>>928 Clojure doesn't compile to Java, it just runs on the JVM. Scala and Kotlin do the same thing. Using the JVM's runtime isn't "compiling to java". You have no idea what you're talking about so please stop brewing soykaf and lurk more.

>>899 Well you could do some Go (bias: I use Go for fun), you won't really have a hard time figuring anything out as it's relatively C-like in nature. From there you can do two different things: 1) Try delving deep into the lovely standard library (net/http), where you can control everything you'd like in your application. 2) Try a framework, I'm using Gin for a chan proxy myself and it seems rather fun. I've also heard Martini is a relatively popular choice,

>>928 Clojure compiles to java byte code, that's why it can run on the JVM, just like scala. That doesn't mean it gets compiled to Java.

>>956 OK, the point made was that languages transpiled to the Javascript interpreter are "1 to 1" which implies that the language is constrained to the grammar of Javascript compared to code that compiles to the JVM is not constrained to Java grammar. The JVM interprets opcodes that appear to look like an assembly language, so that might give someone the impression that the JVM is not tied to the Java language. Code that is fed into the JVM is first lexed (broken into tokens) then parsed (checked for correct grammar). This is a very superficial step in the compilation process which means the resulting bytecode has to be grammatically correct Java. Lexing and parsing are the two steps that come before the bytecode gets turned into an abstract syntax tree. So the point I am getting at is that languages that get compiled to Java bytecode are not going through an entire compilation process, they are just doing surface level lexing/parsing of a syntax. And so code from languages that get transpiled to Javascript are really at the same level of the compilation process, the code gets lexed/parsed into Javascript. Admittedly the code that is produced by the transpiler is readable Javascript code but grammatically speaking the languages that get compiled to the JVM are at the same level of the compilation process in that it is on top of the AST. I'm obviously not a compiler expert but maybe someone out there can back up what I'm saying. I would argue that languages that get transpiled to Javascript have more gramaticaly freedom that JVM languages as the function and object scoping is a lot freer which is why you see a lot more diverse languages transpiled to Javascript.

My host was acquired by godaddy. just fuarrrk my soykaf up.

Hello, Lain. I have a pretty extensive portfolio(roughly 35 projects) in Node, React, D3, Mongodb and html/js/css. How much is an OK salary, considering i have zero professional web development experience? Assume remote work/location agnostic

>>1010 That depends on your location and whether or not you have a cs degree.

>>1018 I don't have a degree, and i'm only avaiable for remote positions, so location isn't important.

>>1019 Then it's hard to say. Not sure if you can do remote work internationally, so I'd suggest to look around what js stack webdev jobs in yor country have to offer.

>>1101 >Not sure if you can do remote work internationally Nah, that possibility isn't a concern. I'm 100% sure you can work remotely outside of the US. I'm trying to work remotely exactly because my country doesn't have a lot to offer. Both financially and professionally.

Can someone rec a language that transpiles to JS that has a lot of strict checking of types etc?

>>1166 https://github.com/jashkenas/coffeescript/wiki/List-of-languages-that-compile-to-JS If you're just starting out I recommend Elm, it's a very easy to learn subset of Haskell and it guarantees no exceptions at runtime, at the cost of some boilerplate when you want to do more complex things, and very limited type-level computation. The language is also very young and still in development, so some stuff is still just "compiler magic" and can't be accessed (like type classes and effect modules), and there will be breaking changes from one version to another (though the compiler can do some of it for you and it never takes long). That said, I think it's a very nice language.

>>1166 Im sure you'll find something you like in this list: https://github.com/jashkenas/coffeescript/wiki/list-of-languages-that-compile-to-js

>>900 I made my own CMS There is no better kind than that one

Hello. I'm building a blog generator using server side cljs. https://gitlab.com/escherize/bengine

>>1325 Any reason for choosing cljs over regular clojure for the server? Also, aren't the two mostly the same?

>>1327 Thanks for asking. It's a static site builder (with some use addable tag functions), so I wanted it to be able to run very fast. Some true weirdness required to splice in the tag functions (like tag/title in gp).

>>1333 speed argument makes sense personally i always wanted to learn clojure but i feel like the ecosystem is a mess

>>1333 I guess that makes sense, if you want to run it as a command from the command line. That's not what Clojure is good at though, IMO; you're supposed to keep a REPL open and interact with it mostly from there. Also, I don't think you should do that hack with eval-str. The whole point of having data as code is to be able to use code in it! Put those files into a module of its own and call them as functions. >>1341 It's actually not; setting up lein is very easy and from there you just have to add stuff to your project.clj file. There's a lot of dead libraries from the Clojure craze years, but you'll generally find something that's maintained and high quality. Using Java libraries is also very easy, so you'll have a massive ecosystem backing you up.

>>1346 Yeah, it's kind of an exploratory thing. It's working now, and I think it's alright. Need to add a watch, and bite off a few more of pollen's tricks (like serving the content rather than running a bulk upload). with npm, clojure on commandline is pretty good, starts fast etc. I have been developing this using a repl but a few times I broke something and couldn't get the app up and running (in order to connect to again) which has happened to me with clojure too, but with this setup it was much much much less painful. also, would be good to have a sorting mechanism besides alphabetical Besides that I am pleased with how it's come along https://github.com/escherize/bengine

What kind of project would you make for your portfolio, Lain? I've done a lot of small projects (APIs, microservices, calculators, etc), but i don't really have a big project, and the most common feedback i get from companies is that i need more experience. The only good idea i had is a mindmap application, since i couldn't find any good, free alternative. But that focuses far too much into front end, which isn't my thing, i'd be able to do it but i don't want a front end position, so it doesn't make a lot of sense to use that as a main project.

Anyone use XHTML? How is it, from your own personal experience and usage? I only know HTML, not XML or XHTML.

>>320 If you want to do something simple find some documentation online that resembles your projects goal. Start small. Try to proceed in a step by step maner and don't hesitate to trash all your first attempts. From my personal experiences : If you settle for nodeJs try to avoid using loads of packages. It's harder but you'll understand what you are doing and it can also force you to read about topics that are related to broader issues in server building

>>1673 As I've heard, once you know html you know xhtml since it's just a stricter variant of it

Anybody know where i can find this book for download? https://www.fullstackreact.com/ Nothing on libgen.

How can you make BASH cgi using NGINX ? what are teh configs? It would potentially allow so much web dev on my part for hidden services. I rather stay away from PHP.

>>2511 That sounds like it'd be a nightmare to sandbox properly, not to mention scaling very poorly. I'm not a fan of PHP either, but are you sure you want a bash script as cgi? If you're determined, look at e.g. https://stackoverflow.com/questions/22891148/nginx-how-to-run-a-shell-script-on-every-request#22891362

>>284 Disable password access with ssh. Monitor logs. Encrypt all traffic to and from your web service. Learn about key authentication and implement it. Exchange some gpg keys with someone. Know what every port is doing. Spend time with tcpdump, wireshark, nvd.nist.gov, and metasploit. In a basic sense, know what data is going to and from your services. Everything is code, code has bugs, so find safe, battle-test code (usually open source :)

I want to make a website that interacts with the youtube API and serves videos as embeds in a page. It shoudl also display related videos and havea search feature. I'm completely new to webdev and I have no clue which language to use. The most I can do is CSS and HTML, and I've deployed a couple of static websites. No js experience.

>>283 Any good alternatives to $.getScript("js/foo.js", function(event){ bar(event); } ?

>>3264 I dunno about "good" alternatives, but I don't use jquery, so I typically do something like var s = document.createElement("script"); s.src = "js/foo.js"; document.getElementsByTagName("head")[0].appendChild(s); Then have foo.js call some function I've previously defined at the bottom.

Has anybody here used vibe.d before? I've started learning it recently, and besides some rough edges, it's been an enjoyable experience.

Is there a way to get a full trace of the JS calls being executed upon loading a page? I want to load from a script a page that has an AES encoded payload in its static content, which is decrypted and parsed into HTML by a large amount of scripts. I can't wrap my head around them, but at least understanding the entry point would help. (of course I can load it with a headless browser, but both me and my RAM would appreciate if we didn't use a cannon to kill this particular fly)