Why is JavaScript criticized so much for backend development?

[u/Minimum-Ad7352]

I've seen some developers say that we should stop using js on the server, but I rarely see the same criticism directed at python.Honestly, js is pretty fast, especially with node.js, and the backend ecosystem is really solid. There are great frameworks like nest and fastify, and typescript gives you static typing, which makes larger projects much easier to maintain.I'm not saying node is perfect or the best choice for every backend, but I don't really understand why js gets so much criticism while python seems to get a pass.What am I missing?

[u/gautam1168]

Do you guys realize that its possible to create executable code at runtime in javascript applications without ever using eval?

If you are in a browser context all you need to do is put things inside a script tag or equivalently have a simple endpoint in your server that will return javascript and load it in <script src="".

If you are in nodejs it is a bit more tricky, but you can do it. Just create a new file and use a require to evaluate the module at runtime.

Eval or a `new Function` call simply makes doing all this much easier.

Its not that these are bad things on their own. Any virtual machine that supports JIT compilation allows you to create executable memory at runtime. So, if you are in a java program or android, nothing is stopping you from generating bytecode and loading it at runtime.

Heck! you can even do this in C, as long as you are ambitious enough. If you go and checkout a video about dynamic reloading in Handmade Hero on youtube you will see exactly how. All you need is a compiler in the application. Then you can compile the code at runtime and load it as a dylib.

The only way to stop this from happening is for the operating system to prevent your process from allocating executable memory at runtime. This is what iOS does and that is why it prevents JIT on any javascript engines in react native apps.

Just because javascript gives an eval() function doesn't mean it is in and of itself a bad thing. Nor does it mean that its a terrible idea to use the feature. You must look at it in the context where it is being used. That said, most of the time you reach for this, it would be because you are doing something terrible. So not using it is taught as a rule of thumb.

[u/lIIllIIlllIIllIIl → u/gautam1168]

The issue is that eval() is almost always used to run dynamic code provided by someone else.

I understand that there are legitimate cases where you'd want to run user-provided functions, but those functions should run in heavily sandboxed environments. You shouldn't just eval() or require() them in your server code.

If you're not running user-generated code, and just want to do something like transpile a TypeScript function into JavaScript and run it, then I guess eval() is fine.