AI changes the approach I choose for software development, the tools I choose, and the security posture I am to maintain. the approach may be debated unless I am your father, in which case the approach will be followed.
In the broader world of software engineering in the last 15 years there has been an evolution towards javascriptification. the web is the most widely distributed platform, javascript is the only scripting language natively available on all clients, people writing for the web used javascript everywhere.
The tools to make the web apps were also written in javascript. javascript was originally a browser-only language. Someone made node.js then it could start running on the server. Walmart had their servers over-run on a Black Friday, the next year node.js was used and their servers handled it. node.js was on the ascent.
In the browser the frameworks for making web apps kept growing and growing. React.js was a solution to framework bloat, handling only the components. Overtime next.js has become the react framework, the company behind next.js has hired more of the react core team and now react and next.js are very tightly linked.
The framework-from-day-one framework, Angular, had evolved very nice mechanisms for frameworks, including a monorepo approach they used to build all of the angular packages in one place, ensure consistent outputs with independent developers and to make sure the developers using Angular would have a nice reference for their own work to draw structure from.
A couple of Angular team guys created Nx, which is now a cross-framework compatible monorepo management tool. Nx was a necessary tool for me because I wanted to build in a monorepo and managing a dependency graph without cycles is an important part of that, which Nx had first-in-class tooling for.
AI changes the approach and the tools I use.
In the last months I removed Nx from the monorepo because it used webpack under the hood. Webpack is one of those tools built during the “javascriptification” era. It has since been superseded for many purposes by other tooling written in other languages. I wanted to go to esbuild, written in Go, and needed to ditch Nx to do it. I could only do this because AI generated code could help with the work of dependency graph organization that was previously done by Nx. It could also bridge the gap.
Prior to Claude, I liked a home-grown approach to a framework because I thought Angular was becoming to stale and slow and I thought that next.js was becoming too ambitious in capturing all use-cases without having the stability of something like Angular. I started a project to re-create some of the recent core innovations of next.js, namely, React Server Components. I succeeded then stopped without implementing client-side react, which is just around the corner whenever I want it, yet am getting by without.
AI changes the security posture.
Angular, React, Next, all the big public projects have been reliably patching security in their repos from day 1. Generally speaking, that is not enough today. Since Claude there have been much faster attackers taking much more nuanced approaches to attacks. One such major success recently was an attack on a package called axios, which was built for a lot of purposes and a lot of use-cases, which gained massive popularity, and was not reconsidered by many, just considered safe. An attack on the package made next vulnerable. Know who was not vulnerable? Me and THC. Much of the homegrown-framework approach has meant a build-it-without-dependencies approach as well. Instead of axios we use the language built-in packages, which are safer. Generally, removing intermediary packages increases safety because it means fewer points for leakage.
The main thc admin app does not use next. The planning and musicians apps do use next. Next is good enough, works for the use cases they are designed for. There are occasional bugs that come from the next ecosystem having many complexities I hinted at before and it can send AI into a weird pattern of adding more complexity to fix a problem caused by complexity. Next prefers adding complexity to solve problems caused by complexity. It’s just the nature of the next team.