Node.js Author Introduces Secure JavaScript Platform Deno 1.0

After two years of development submitted first significant release Give me 1.0, a stand-alone JavaScript and TypeScript application execution framework that can be used to create handlers that run on the server. The platform is being developed by Ryan Dahl (Ryan Dahl), creator of Node.js. Like Node.js, Deno uses a JavaScript engine V8, which is also used in Chromium-based browsers. At the same time, Deno is not a fork of Node.js, but is a new project created from scratch. Project code spreads under the MIT license. Assemblies prepared by for Linux, Windows and macOS.

A significant version number is associated with the stabilization of the APIs in the Deno namespace, which are responsible for the interaction of applications with the OS. Programming interfaces, which are not stabilized, are hidden by default and only available when run in "--unstable" mode. As new versions are formed, such APIs will gradually be transferred to the category of stable ones. The API in the global namespace, which includes common functions such as setTimeout() and fetch(), is as close as possible to the API of regular web browsers, and evolves in accordance with Web browser standards. The APIs provided by Rust, which are used directly in the platform code, as well as the interface for developing plug-ins for the Deno runtime, are not yet stable and continue to evolve.

The key motivation for creating a new JavaScript platform was the desire to eliminate conceptual errors, admitted in the Node.js architecture, and provide users with a more secure environment. To increase security, the binding around the V8 engine is written in Rust, which avoids many vulnerabilities that arise due to low-level memory manipulation, such as accessing a memory area after it has been freed, dereferencing null pointers, and buffer overruns. The platform is used to process requests in non-blocking mode. Tokyo, also written in Rust. Tokio allows you to create high-performance applications based on event-driven architecture (Event-driven), supporting multithreading and processing network requests in asynchronous mode.

All features Deno:

  • Focus on security in the default configuration. File access, networking, and environment variable access are blocked by default and must be explicitly enabled. Applications run in sandboxed environments by default and cannot access system capabilities without explicit permissions;
  • Built-in TypeScript language support in addition to JavaScript. The native TypeScript compiler is used to check the types and generate JavaScript, which leads to a performance drop compared to parsing JavaScript in V8. In the future, we plan to prepare our own implementation of the TypeScript type checking system, which will increase the performance of TypeScript processing by an order of magnitude;
  • Runtime comes in the form of a single self-contained executable ("deno"). To run applications with Deno, it is enough download for its platform, one executable file, about 20 MB in size, which does not have external dependencies and does not require any special installation into the system. At the same time, deno is not a monolithic application, but a collection of Rust crate packages (deno_core, rusty_v8), which can be used separately;
  • When starting the program, as well as for loading modules, addressing via URL can be used. For example, to run the welcome.js program, you can use the command "deno https://deno.land/std/examples/welcome.js". Code from external resources is downloaded and cached on the local system, but is never automatically updated (updating requires explicitly launching the application with the "--reload" flag);
  • Efficient processing in applications of network requests via HTTP, the platform is designed to create high-performance network applications;
  • The ability to create universal web applications that can run both in Deno and in a regular web browser;
  • Availability standard set of modules, the use of which does not require binding to external dependencies. Modules from the standard collection have been additionally audited and tested for compatibility;
  • In addition to runtime, the Deno platform also acts as a package manager and allows you to access modules by URL inside your code. For example, to load a module, you can specify "import * as log from "https://deno.land/std/log/mod.ts" in the code. Files downloaded from external servers by URL are cached. Linking to module versions is defined by specifying version numbers inside the URL, for example, "https://unpkg.com/[email protected]/dist/liltest.js";
  • The package includes an integrated dependency inspection system (β€œdeno info” command) and a code formatting utility (deno fmt);
  • All application scripts can be combined into one JavaScript file.

Differences from Node.js:

  • Deno does not use npm package manager
    and is not tied to repositories, modules are addressed via URL or file path, and the modules themselves can be placed on any site;
  • Deno does not use "package.json" to define modules;
  • API difference, all asynchronous actions in Deno return a promise;
  • Deno requires explicit definition of all necessary permissions for files, network, and environment variables;
  • All errors not provided with handlers cause the application to terminate;
  • Deno uses the ECMAScript module system and does not support require();
  • Deno's built-in HTTP server is written in TypeScript and runs on top of native TCP sockets, while the Node.js HTTP server is written in C and provides JavaScript bindings. The Deno developers focused on optimizing the entire TCP socket layer and providing a more general interface. The Deno HTTP Server provides less bandwidth, but guarantees predictable low latency. For example, in the test, a simple application based on the Deno HTTP server was able to process 25 thousand requests per second with a maximum latency of 1.3 milliseconds. In Node.js, a similar application processed 34 thousand requests per second, but the delays ranged from 2 and 300 milliseconds.
  • Deno is not compatible with packages for Node.js (NPM), but is developed separately interlayer for compatibility with the Node.js standard library, as Deno evolves, more applications written for Node.js will be able to run.
  • Source: opennet.ru

Add a comment