Deno v1.8 – support for WebGPU, private modules, Intl, and much more

362 134 5 years ago

I really want to use Deno, but until it's got a decent solution for cryptography, it seems as if encrypted session cookies are a no go, which makes a lot of my use cases a no go.

lucacasonato3• 5 years ago

We are hoping to ship WebCrypto support in 1.9, in 6 weeks. That should do most general purpose crypto stuff pretty well.

chovybizzass• 5 years ago

no xml library either.

modeless3• 5 years ago

Wow, WebGPU support is really cool. Graphics is usually an afterthought in programming language runtimes, which is crazy when you consider that most devices these days have a GPU which is physically larger and has far more raw compute power than the CPU.

I understand why. The extremely proprietary and platform specific nature of graphics APIs and hardware makes it hard. WebGPU is a good choice for portability.

coding_lobster• 5 years ago

I was under the impression that Deno is a runtime mostly intended for the server environment which is probably an area where GPU presence isn't generally as strong as on other types of devices outside of the applications that specifically need it. I could be wrong of course about anything or everything.

dexwiz2• 5 years ago

WebGPU is an abstraction over classic graphics and newer compute APIs.

pocketgrok• 5 years ago

Not necessarily. Ryan has said a major motivation for creating deno was to let JS compete with Python for local scripting and ML.

dexwiz2• 5 years ago

Looks like they are using wgpu, which is the main (only?) implementation of WebGPU. Seems like WebGPU will work because everyone is going to ship the same shim (wgpu) over the top of proprietary APIs.

crowlKats4• 5 years ago

There is also Google's Dawn implementation

modeless3• 5 years ago

There are three implementions of WebGPU in development for the three browser engines. Dawn for Blink and wgpu for Gecko are cross platform, and I think Apple may be doing something Metal-specific for WebKit.

remexre2• 5 years ago

Kinda :/ on there not being a GPU permission (that I can find in the post or the docs); GPUs/GPU drivers have been a vector for some pretty nasty attacks in the past...

FlashBlaze• 5 years ago

Since there is no permission requirement as such, could a malicious user use my GPU for mining?

modeless3• 5 years ago

For years WebGL has been exposed to every website you visit with no permission prompt, and WebGPU soon will be too. It is possible to expose GPUs securely and the WebGPU API is designed with sandboxing and security in mind.

Edit: I believe the bug you linked below (https://bugs.chromium.org/p/project-zero/issues/detail?id=20...) can't be exploited through WebGL or WebGPU in the browser because all GPU access is remoted to a separate process with a special GPU sandbox. I don't know if Deno does this but it should.

Soremwar3• 5 years ago

The thing is that without read/write or net permissions, a malitious script that turns your computer into a mining rig will throw because it can't connect to any server or use your filesystem. We already expose CPU to third party code, doing the same for GPU is trivial in that sense if you remove the possibility to do anything with it without your consent

pmarin• 5 years ago

I understand why. The extremely proprietary and platform specific nature of graphics APIs and hardware makes it hard.

And hardware bugs, crappy drivers, etc

baxuz• 5 years ago

Here's hoping that we'll soon be able to port FFmpeg in its entirety to WASM + WebGPU.

tyingq• 5 years ago

Looks like Cloudflare isn't happy about this url:

https://deno.land/posts/v1.8/webgpu_triangle.png

mmastrac• 5 years ago

I wonder if they were APNG animations. Other than that, it doesn't seem like it should have triggered any other rule violations.

lights0123• 5 years ago

It's their restrictions on non-HTML bandwidth usage. All images on the site are blocked like that: https://deno.land/images/icons/apple-touch-icon-180x180.png

searchableguy6• 5 years ago

if anyone from cloudflare is reading this thread, please reach out to luca on twitter: https://twitter.com/lcasdev/status/1366938508875726851

This is breaking all the code which relies on deno.land/std and deno.land/x registries too.

In the meantime, you can rely on other module registries or cdns:

1. https://nest.land/

2. https://www.skypack.dev/

3. https://esm.sh/

You can also use raw github links but don't do that in production.

tasogare• 5 years ago

Good illustration of why relying exclusively on code being online (external repositories, code on github, hosted code like this) to make a project compile is a bad idea.

ipsum22• 5 years ago

This is an important example of why to avoid Cloudflare. If your website gets popular, your website's images will be replaced with the image: "This content has been restricted. Using Cloudflare's basic service in this manner is a violation of the Terms of Service." and your website will break.

https://www.cloudflare-terms-of-service-abuse.com/streaming....

This is on the Business tier too, not the Free one.

ksec• 5 years ago

Even on Business? I remember Neocities were serving terabyte of images and CF didn't even force them to upgrade.

tedk-422• 5 years ago

Probably an edge case. From what i've seen these edgecase errors are quickly fixed/intervened by a human and fixed.

(i have no personal experience with popular sites personal/free-tier sites sadly)

Soremwar3• 5 years ago

Already fixed

simlevesque2• 5 years ago

The link never loads for me.

barosl• 5 years ago

Wow, the `Deno.permissions` API is a great idea! Why haven't I thought of this? It sounds like a natural extension to what browsers are already capable of. It would make it very convenient to grant permissions to remote scripts without knowing the exact permissions they require beforehand.

rajangdavis4• 5 years ago

Asking out loud, but is anyone aware of a way to build Ruby on Rails assets with Deno in place of yarn and node?

The use case is to be able to leverage ES6/Typescript but have security built into the assets management. I'm not unhappy with the sprockets pipeline, but I would like to move forward with a modern assets pipeline without having to think too hard about the security implications of using yarn and node.

qbasic_forever• 5 years ago

Maybe esbuild can help? It's a go-based bundler that does typescript, es6, etc. and a lot more. https://github.com/evanw/esbuild It's still pretty well integrated into the npm world and distributed as a node package though, so there might be some issues.

rajangdavis4• 5 years ago

Thanks, I'll take a look, there might be something to look at to get something going.

pupdogg2• 5 years ago

I don’t know about Rails specifically but I was able to create my own custom asset pipeline for Roda framework using the latest version of Snowpack. I’m assuming it would be no different for Deno.

rajangdavis4• 5 years ago

Do you happen to have source you can share?

I've rolled my own assets pipeline with a Sinatra app, but did not tap into Node.

I think with Rails, there's probably some way to hook into the framework, just not sure how one would approach this.

seer• 5 years ago

If your concern is mainly security, you can try yarn 2 (berry)’s “zero install” feature.

That vendors yours dependencies, so the whole project can then be started without yarn itself, but avoids the gigabytes and millions of files problem of node_modules.

Just an alternative.

ww5204• 5 years ago

What's the difference between WGSL and GLSL? Is WGSL a native language understood by the GPU? Or is it a purely Web-level construct and needs translation to GLSL before piped to the GPU?

skohan2• 5 years ago

GLSL is not a native language understood by the GPU. GLSL is a high level language which has to be compiled to machine instructions for the GPU, just like HLSL and WGSL.

ww5204• 5 years ago

Yes. The GPU only runs machine code. That makes sense.

GLSL is compiled by the OpenGL driver. The question becomes is WGSL sitting on top of OpenGL driver and thus requires the OpenGL drivers to support it or with a transpiling to GLSL, or does it has its own WebGPU driver that can compile the WGSL and interface with the GPU directly?

tambourine_man• 5 years ago

Deno has a set of reviewed (audited) standard modules that are guaranteed to work: deno.land/std

This is such a great idea.

aitchnyu• 5 years ago

Is a comprehensive std a goal for Deno? In the future, can I replace Python and make a 10 line script to download a gzipped csv and parse it incrementally?

lucacasonato3• 5 years ago

Yes! We have a CSV parser in the standard lib, and HTTP requests that are gzipped are automatically decompressed if they specify the `transfer-encoding: gzip` header.

40four2• 5 years ago

Is https://deno.land seriously getting the ‘hug of death’?!

I’m seeing some very odd behavior. I’ve gone from getting an SSL error, to stuck in loading ‘forever’, to sometimes it loads.

Anyone else experiencing this?

simlevesque2• 5 years ago

It's not just you.

40four2• 5 years ago

Ok, I see the other thread on this now. Sounds like it’s hosted on Cloudflare? That is somewhat concerning, considering they say they are on the business tier.

brundolf3• 5 years ago

Has anybody here used Deno recently? I tried it out at 1.0 and it was... a little bit rough. Basic APIs like fs weren't stable yet, the documentation on how to import them was out of date, there were multiple VSCode extensions and it took a couple hours to get one of them working properly.

Of course these are all relatively easy things to smooth out over time so I'm curious what the experience is like now.

searchableguy6• 5 years ago

It's pretty good.

Deno provides LSP now which is what Vscode extension use. Other text editors also work with deno since they can use LSP.

I haven't had any problems with fs APIs. They provide almost everything and any nice utilities can be imported from std.

Testing has gotten a lot better. Bundling and compiling works too.

Support for third party platforms such as vercel, heroku, and other platforms is decent.

Many rails-like frameworks are also popping up.

Overall, I am satisfied.

brundolf3• 5 years ago

To be clear: IDE support existed and worked fine once I got it going. It just wasn't a smooth experience out of the box; I had to do some digging on Google, fiddle with the configuration, hunt for answers in GitHub tickets, etc. For a runtime whose main appeal (for me) was no-hassle TypeScript, all the hassle put a pretty big damper on things.

Glad to hear things seem better now

mattlondon4• 5 years ago

I've not used it professionally for anything yet but I have been hacking around with it on the side for fun (I've recently created a Gopher protocol client and added it as a Third Party module: https://github.com/matt1/deno-gopher / https://deno.land/x/gopher@v0.0.5-alpha - it has been a fairly enjoyable process)

On the whole I have been quite happy with it - the VSCode support is now pretty good (and even without proper integration it was still fully usable even if I didn't get intellisense and had some red squiggles around the imports etc), and sounds like this release will improve it even more.

I do agree though that the documentation is a bit sparse - the auto-generated docs are nice enough, but it could benefit a bit more from some more coverage of human-generated docs for some of the more common use-cases... that will come with time I guess.

My main criticism is that the built-in test framework is a GREAT thing to have, but it does not have support for mocking or spies so it is limited in real-world usefulness.

E.g. in my Gopher protocol client, there is not an easy way to mock out the `Deno.connect` built-in function to create a TCP socket so it is hard for me to test failures at the TCP level. I am sure with some gymnastics I can abstract everything away under layers of interfaces and classes and manually inject everything to make testing easier, but it would be nice to just be able to mock/spy out functions/classes rather than have the entire architecture of the project be dictated by the testing framework. There are third-party alternatives that can be used, but I'd prefer to stay as close to "standard" as possible.

christiansakai• 5 years ago

This is probably a dumb question, but I'm interested in Deno's TypeScript default configuration. I wonder if I can just steal that configuration and just use it for all of my (TS compiled to JS) NodeJS projects.

searchableguy6• 5 years ago

I recommend reading this page on that: https://deno.land/manual@v1.8.0/typescript/configuration#how...

boredpandas777• 5 years ago

Very exciting.

mleonhard• 5 years ago

Is there any way to limit RAM used by the code inside the VM?

tehbeard• 5 years ago

There might be in V8 flags you can pass in to deno run?

pugio• 5 years ago

I'm hoping deno can lead to a good Electron alternative, in the same spirit and philosophy. I'm currently working on an app and would love to ditch a bunch of the node specific tooling for the deno alternative.

mschuetz• 5 years ago

What are average build times for a deno project? One reason I've sticked with JS, Electron and node up until now are zero build times, but I really miss static typing.

mattlondon4• 5 years ago

Usually just a few seconds (depending on project size), if that. You can also disable some checks (e.g. type checks) to trim it down even further.

mattlondon4• 5 years ago

There are Deno bindings for webview. https://github.com/webview/webview_deno

I have had a quick play around with it - seems functional. Usual caveats about cross-platform webview apply, but I don't see those as major blockers these days unless you are doing something particularly fancy/niche

I love that you can just run the examples by copy-pasting a command and everything is auto-downloaded via Demo's modules. No installation or huge separate binary downloads. Awesome stuff.

pimeys• 5 years ago

Does Deno have a standard API for building Rust modules that communicate with JavaScript? With Node, you have the N-API which is C++, which you can use with the Rust wrappers. But, a standard Rust API for native modules would be much nicer to use compared to the N-API...

crowlKats4• 5 years ago

Yes, there is the unstable plugin system that can be used for that

cutemonster• 5 years ago

Is that for writing performance critical code in rust? And call from Deno?

mattlondon4• 5 years ago

If any Deno dev/members are here, it would be really really nice to see mocking/spy support in the Deno test framework.

This is the major thing holding me back from using Deno more at the moment.

Not being able to mock out a class/function or spy on a particular call etc means that there are large parts of my code/particular situations that are not able to be tested easily without refactoring my entire codebase to use manual IoC and excessive-OO to hide things away under layers of interfaces etc. E.g. I cannot currently mock out `Deno.connect` (....? or can I?) so it is hard to test all sitautions there. Unfortunately this sort of thing (connecting to a remote system) is often quite critical and would benefit hugely from extensive testing.

It would be great to be able to create tests where calls to Deno.connect throw errors, or where it returns 0 bytes, or a special sequence of bytes and so on and so on to verify that my code works - this is the classic sort of `Spy` functionality seen and used extensively in Jasmine et al.

I know there are third-party solutions to this, but it would be nice to see this in the standard distribution.

__jem• 5 years ago

What language runtime provides mocking/spy support? This seems excessively catered to IOC OO design, not the kind of thing a multi-paradigm language usually supports.

e12e• 5 years ago

AFAIK deno ships with "test" as a sub command - having access to mock/spy seems reasonable in that context. It sort of follows from the "batteries included".

Just like deno bundles typescript - there is a reasonable expectation to track latest stable typescript features.

caspervonb2• 5 years ago

Hi there.

Any examples from deno.land/x of what you'd expect from spies and mocks in std/testing?

KyleJune• 5 years ago

I believe they intentionally left it up to third party modules instead of baking in one way of doing it. I created a module called mock on their third party module registry that can be used for spying on and stubbing functions. Even with third party modules, you cannot mock Deno.connect directly because the Deno object is not extensible. If you'd like to spy on or stub connect, you could have Deno.connect passed in to your function as an argument that you can replace in tests with a spy wrapper around it or your mocked out version of it.

Vinnl• 5 years ago

It looks like Deno's really starting to come together! Interested to see where it'll be going in the future.

ramino• 5 years ago

what do they mean with private modules?

searchableguy6• 5 years ago

Ability to import code from private github repos and other places.

thysultan• 5 years ago

That you can import a module that needs authentication to access, like a private github repo etc.

nahuel0x3• 5 years ago

We believe JavaScript, instead of Python, could act as an ideal language for expressing mathematical ideas if the proper infrastructure existed.

It would be nice to read a rationale about this.

pragmatic8• 5 years ago

Indeed. I find this to be a rather strange opinion; in terms of the language itself, I can’t really say one is better than the other for expressing mathematics.

johannes12343213• 5 years ago

As long as we're sticking to core language JavaScript is not the right answer as the only numeric type, Numeric, is a IEE-754 "double". For lots of maths however integer semantics are better suited.

Python has arbitrary sized integers in the language, which even improves the usefulness.

Of course libraries and extensions could eventually help.

christophilus2• 5 years ago

Agreed. At first glance, JavaScript's number implementation seems far from ideal for real computations. I wonder what they have in mind.

nerdkid93• 5 years ago

Deno has first class support for WASM, I wonder if using that runtime for number crunching is better than how Python does numeric computations.

stjohnswarts3• 5 years ago

I agree. Seems like pandas and numpy (et. al.) are doing okay these days. Yeah I know they use some c stuff underneath but still...

krona• 5 years ago

JavaScript doesn't have operator overloading. Implementing something even half as ergonomic as numpy in javascript isn't possible.

goldsteinq2• 5 years ago

I was curious about how `Deno.permissions` prevents things like "requesting the permissions, then clearing the screen and asking to press 'g'". Apparently, `Deno.permissions.request()` just stops program execution waiting for user response, so it's impossible to do anything after this call. It also seems to reset text color, so it's impossible to make text invisible. iTerm custom escape sequences allows program to change color profile on the fly. Setting bg and fg to the same value hides Deno messages and allows someone to conceal which permissions are being granted.

goldsteinq2• 5 years ago

Issue: https://github.com/denoland/deno/issues/9666

caspervonb2• 5 years ago

Thank you! we'll look into it!

Deno v1.8 – support for WebGPU, private modules, Intl, and much more

Related Stories