←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 2 comments | 11 Dec 25 20:46 UTC | HN request time: 0.001s | source
Show context
hedayet ◴[11 Dec 25 22:00 UTC] No.46237810[source]▶
I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.
replies(2): >>46237834 #>>46238943 #
jsheard ◴[11 Dec 25 22:02 UTC] No.46237834[source]▶
Does Facebook actually use RSC? I thought it was mainly pushed by the Nextjs/Vercel side of the React team.
replies(2): >>46237934 #>>46238171 #
acemarke ◴[11 Dec 25 22:28 UTC] No.46238171[source]▶
No, but it's primarily because Meta has their own server infrastructure already. RSCs are essentially the React team trying to generalize the data fetching patterns from Meta's infrastructure into React itself so they can be used more broadly.

I wrote an extensive post and did a conference talk earlier this year recapping the overall development history and intent of RSCs, as best as I understand it from a mostly-external perspective:

- https://blog.isquaredsoftware.com/2025/06/react-community-20...

- https://blog.isquaredsoftware.com/2025/06/presentations-reac...

replies(1): >>46238677 #
brazukadev ◴[11 Dec 25 23:13 UTC] No.46238677[source]▶
So contrary to all other changes, this one was not done for Facebook to use. What was the reason behind RSC then?
replies(2): >>46238959 #>>46239743 #
1. cluckindan ◴[11 Dec 25 23:43 UTC] No.46238959[source]▶
Market capture?
replies(1): >>46242659 #
2. brazukadev ◴[12 Dec 25 10:15 UTC] No.46242659[source]▶
That seems to be the case. They killed React for that.