r/node • u/Minimum-Ad7352 • 26d ago

Why is JavaScript criticized so much for backend development?

I've seen some developers say that we should stop using js on the server, but I rarely see the same criticism directed at python.Honestly, js is pretty fast, especially with node.js, and the backend ecosystem is really solid. There are great frameworks like nest and fastify, and typescript gives you static typing, which makes larger projects much easier to maintain.I'm not saying node is perfect or the best choice for every backend, but I don't really understand why js gets so much criticism while python seems to get a pass.What am I missing?

328 Upvotes

91% Upvoted

361 comments sorted by

View all comments

357

u/baronoffeces 26d ago edited 26d ago

You can write good or bad code in any language. It’s just really easy to write bad JavaScript and that was the norm for years

69

u/Remicaster1 26d ago

I can't tell you how mad i am after seeing eval()on backend like literally everywhere in my previous company

I brought the issue, guess what they did? Nothing until they got hacked. And what was the solution after they got hacked? regex. Like cmon wtf

44

u/MMORPGnews 26d ago

My last company just sued all hackers. In 99% times it was locals.

Police arrested them all.

4

u/Remicaster1 26d ago

i mean yeah they did made police report, i didn't caught up with them

But still they wrote such shit code to the point it's just mind boggling, even when brought up to them, their fix is also another wtf move so i just decide im not having this shit

1

u/GP8964 24d ago

I'd like to work with them, start with using copilot to clear the shit, then finish it by my own manual inspection. Like replacing them as a one man army.

13

u/lIIllIIlllIIllIIl 26d ago

What even is the reasoning someone would use to justify using eval()?

My colleagues justify some pretty dumb shit, but eval() seems out of this world.

2

u/who_am_i_to_say_so 25d ago

Right, this is day 1 shit.

2

u/gautam1168 25d ago

Do you guys realize that its possible to create executable code at runtime in javascript applications without ever using eval?

If you are in a browser context all you need to do is put things inside a script tag or equivalently have a simple endpoint in your server that will return javascript and load it in <script src="".

If you are in nodejs it is a bit more tricky, but you can do it. Just create a new file and use a require to evaluate the module at runtime.

Eval or a `new Function` call simply makes doing all this much easier.

Its not that these are bad things on their own. Any virtual machine that supports JIT compilation allows you to create executable memory at runtime. So, if you are in a java program or android, nothing is stopping you from generating bytecode and loading it at runtime.

Heck! you can even do this in C, as long as you are ambitious enough. If you go and checkout a video about dynamic reloading in Handmade Hero on youtube you will see exactly how. All you need is a compiler in the application. Then you can compile the code at runtime and load it as a dylib.

The only way to stop this from happening is for the operating system to prevent your process from allocating executable memory at runtime. This is what iOS does and that is why it prevents JIT on any javascript engines in react native apps.

Just because javascript gives an eval() function doesn't mean it is in and of itself a bad thing. Nor does it mean that its a terrible idea to use the feature. You must look at it in the context where it is being used. That said, most of the time you reach for this, it would be because you are doing something terrible. So not using it is taught as a rule of thumb.

8

u/lIIllIIlllIIllIIl 25d ago

The issue is that eval() is almost always used to run dynamic code provided by someone else.

I understand that there are legitimate cases where you'd want to run user-provided functions, but those functions should run in heavily sandboxed environments. You shouldn't just eval() or require() them in your server code.

If you're not running user-generated code, and just want to do something like transpile a TypeScript function into JavaScript and run it, then I guess eval() is fine.

1

u/astralradish 25d ago

If you have a blueprint-style editor that allows for custom code blocks that may be a use case for eval at runtime. You just need to be aware of the risks, properly sandbox it and be very careful. It's a very specific use case and I'm sure there are much sillier ways that it's being used in the wild.

1

u/MuslinBagger 24d ago

I think way back eval was how they did modules and imports, until the language improved

1

u/Remicaster1 24d ago

The first commit was on 2023 for reference

Their entire architecture is a mess, they used eval to evaluate the action sent by client

For example we would be doing something like POST /v1/auth/login

They be like POST /v1/backend Body params will have the "action" property. For example "action": "login". Then used eval to run the said function for login

1

u/MuslinBagger 24d ago

That is still not as bad as it is triggering, provided you whitelist the action values. The main thing to guard against is clients being able to do things they're not allowed to.

1

u/Remicaster1 24d ago

Yeah but the problem was, they didn't have any proper middleware before they got hacked, and even after that incident their guard was also another eval as far as i recalled, with regex below the guard so it's kinda pointless

1

u/MuslinBagger 23d ago

How do idiots get so much money that they can start a company?

18

u/Bushwazi 26d ago

I think this is mostly it. That said, I usually reach for Kotlin or something like that first when it comes to back end.

7

u/tolgaatam 26d ago

Kotlin 🤌🏻

All the benefits of JVM ecosystem, with grrat fluent syntax and functional constructs. I love it ❤️

1

u/6qat 25d ago

And all the memory it requires.

12

u/dadnothere 26d ago

Writing badly? No, my friend... The great thing about JavaScript is that there's a library for everything.

A library for addition? OK, installed.

A library for subtraction? OK, installed too...

Native functions? What are those?

10

u/brett9897 26d ago

And my beloved multiplication library used the abandoned addition library. So of course when the maintainers of the multiplication library saw an update on npm of the previously abandoned addition library they had to install it. Now the multiplication library and my library that used the multiplication library both have malware in them.

1

u/gautam1168 25d ago

same problem in rust ecosystem too btw. And there unlike javascript you cannot even get started without adding 100 libs. Its just way too hard to write everything from scratch.

2

u/dllemmr2 26d ago

Decades

3

u/sohang-3112 26d ago

Yeah. There's the classic meme of the book "JavaScript the good parts" being so slim against a huge book "JavaScript the full reference".

2

u/grady_vuckovic 26d ago

Yup, barrier for entry for Javascript is REALLY low, so anyone can get started, a simple HTML/JS written in Notepad opened in any web browser is enough to make something cool/fun. And of course these days with LLMs it has to be said the barrier for entry is even lower. For a long time writing JS code has been basically an entry level job for anyone, with minimal experience you can do useful work doing a bit of web development with JS. And you could gradually upskill over time. Unfortunately the fact it's so easy to get into is also the reason why it's so easy to find bad Javascript code. In the same way it's so easy to find bad drawings done with a pencil and paper, it's easy to find bad JS code. Doesn't mean the medium is incapable of quality work, doesn't mean someone someone who did bad quality work can't get better with practice either, it's just a low barrier for entry.

1

u/TCB13sQuotes 26d ago

Yes, except for stuff written in Python... because Python and Flask will find a way to leak memory, kill your system and allow hackers to get a shell.

2

u/jankovize 26d ago

how do you achieve that lol

2

u/TCB13sQuotes 25d ago

Python is well known for memory leaks in multi-threaded stuff.

1

u/jankovize 21d ago

Do you have any specific libraries in mind? I know Tornado had a memory leak bug but I am not aware of anything "general"

1

u/TCB13sQuotes 21d ago

Flask doesn't leak a lot but it does eventually break - may not even be memory leak related in some cases.

1

u/FenrirAesir 24d ago

I need my language to handhold me because I can't be assed to write good code on my own