alpine

I like the simplicity. I've been building some web apps with Alpine.js recently, another lightweight React alternative. It's pretty powerful and capable for building reactive SPAs, only ~16kb. https://alpinejs.dev/ https://github.com/alpinejs/alpine

Claude said to use Markdown, text file or HTML with minimal CSS. So it means the author does not know how to prompt. The blog itself is using Alpine JS, which is a human-written framework 6 years ago (https://github.com/alpinejs/alpine), and you can see the result is not good.

I really want to switch over to htmx, as I've moved away from SPAs frameworks, and I've been much happier. SPAs have so much abstraction, and modern, vanilla JavaScript is pretty decent to work with. The thing that keeps holding me back from htmx is that it breaks Content Security Policy (CSP), which means you lose an effective protection against XSS.[0] When I last asked the maintainer about this, the response was that this was unlikely to ever change.[1] Alpine.js, a similar project to htmx, claims to have a CSP-compatible version,[2] but it's not actually available in any official builds. [0] https://htmx.org/docs/#security [1] https://news.ycombinator.com/item?id=32158352 [2] https://alpinejs.dev/advanced/csp [3] https://github.com/alpinejs/alpine/issues/237

Yeah, this is the dealbreaker for me with alpine.js and htmx. And I wouldn't even say "tight CSP" as much as "standard CSP." To make alpine.js play nice with CSP, you have to allow unsafe-eval, which severely weakens your protection against XSS. alpine.js claims to have a compatibility build with CSP, but it's not officially available, doesn't fully work, and the parts that are broken in the CSP build aren't documented.[0] htmx works under CSP, but it opens a new vector for attackers to inject JS into your page, which effectively neuters CSP.[1] [0] https://github.com/alpinejs/alpine/discussions/1944 [1] https://htmx.org/docs/#security

Thanks for sharing and for your work on intercooler.js and htmx! I share your sentiments about SPAs, and I've been trying to get back to a simpler web stack. One of the hurdles I keep running into with libraries like htmx and Alpine is that they don't play nicely with Content Security Policy. And I'm reluctant to forfeit CSP to use a JS library since CSP is the most robust solution I've found for preventing XSS. Alpine is working on a CSP-compatible build, but it hasn't been released[0] and doesn't seem to be a priority. htmx is compatible with CSP, but it effectively reverses the protection it offers. The attacker can inject JS through htmx directives.[1] I know there's hx-disable, but this degrades CSP's effect from "secure by default" to "secure when the developer remembers to mark the subtree as containing user-controlled data." Is th

I was going by Github language stats indicating 90% HTML / 10% JS https://github.com/alpinejs/alpine

This seems to be the reason https://github.com/alpinejs/alpine/discussions/1423

After hesitating with Tailwind I did come around to loving it, but I've had a much harder time getting over my initial impressions of Alpine. I recognize that one, it targets a very specific type of website, and two, it's easy to let subjective feelings about what makes for readable & maintainable code get in the way of an unbiased take on the framework. But writing JavaScript in strings is unappealing to me, even for server-side sites that just need some sprinkling. Some questions that come to mind that would sway me one way or another: - How is the tooling and debugging experience? - Do you get intellisense with the VSCode extension within x-for, x-show, etc. expressions? - Can you easily set breakpoints in devtools and step through your code? - In reference to the issue below, how susceptible would I be to XSS attacks in using this fra

Good point. It's a small JS framework that you might think of as a VueJS/React "lite" https://github.com/alpinejs/alpine

The LiveView is just a HTML page so you can have whatever CSS/JavaScript you like on the client side for animations and interactivity. Talking to the server is opt-in and you’d basically do it wherever you’d usually make an API call from React etc. The go-to for JS in LiveView seems to be Alpine (https://github.com/alpinejs/alpine) but I haven’t got around to trying that out myself yet.

Neat, appears to occupy a similar niche as Alpine: https://github.com/alpinejs/alpine

Fav thread ever! A good 5+ years ago I built HasGluten [1] with react backed by a google spreadsheet, hosted on github pages. Proven technology, it's still working. More recently I hacked together MultiPreview [2] with react + API served by firebase functions. I'm also temp using firebase hosting as I have little traffic, but plan to replace it with edge computing / CDN caching. MultiPreview is backed by Saasform [3]. This is more like a classic node/express (nestjs) application, but I really like how we're separating concerns: the SaaS = MultiPreview handles the biz logic / Saasform handles landing page + auth + payments. While building the new landing page I played with and liked a lot Bulma [4], I used but didn't like AlpineJS [5] and I'm thinking to move to Hotwire [6]. My personal experience is that performance only matters when you'

> Vue can be used just like jQuery without any nodejs tooling You can, but you probably shouldn’t (outside of prototyping). It requires you to both ship the template compiler to the client, and to perform the template compilation on the client, on every single page load (vs serving a cached, pre-compiled JS file). If you want to sprinkle JS onto an otherwise server rendered page, you’re better off with something like Alpine.js [1] [1] https://github.com/alpinejs/alpine