It's always seemed clear that Vercel has been, at best, OSS-ish. Trying to play both sides of claiming to be open source but also (somewhat sneakily) building a walled garden to lock users into their hosting platform.
Use minimal html/css with server side rendering (and maybe a CDN/edge computing) for stuff that needs to load fast. Use react/vue/whatever heavy framework for stuff that needs complex functionality. If you keep them separate, it's all very easy. If you combine them, it becomes really difficult to reason about.
It is react-router all over again. For those who weren't around, react-router appeared early in React's life, and lots of people were using it. But, for every major version they released, they completely changed the way of doing the routes/routing, so if you wanted to use a maintained release, you'd have to constantly refactor, often without any real gains except "now we're on the latest version". I, just like parent with next.js, eventually stopped using it because it was too much.
It's kind of weird to me how programmers (especially of libraries like that) aren't more careful about introducing breaking changes, since the work needed to be done afterwards multiplies really quickly. I'd wish people just split their new stuff into new libraries instead of changing the interface of existing ones.
The way they've handled this vulnerability has made me even more uneasy.
Vercel's initial framing of their Firewall as having "proactively protect[ed]" their customers definitely leaves a bad taste.
This, plus the delay in notifying other platforms, reveals a conflict of interest I had not previously considered: is Vercel actually less motivated to prevent such vulnerabilities from being introduced to Next.js in the future because they can roll out mitigations on their own platform before public disclosure and then say "well you wouldn't have been affected if you used us for hosting :)"?
Alot of people think Acquia, being started by the creator of Drupal, has special control of the open source project, but at the end of the day they really don't have that kind of control.
So when the security team found this vuln, they coordinated with as many Drupal hosting platforms as they could, and immediately Pantheon, Platform.sh, and Acquia had all blocked the exploit at the firewall level by the time the CVE was announced.
What are some salient counter points for choosing next.js? I see a lot of new devs not want to have to think about deployment and management of systems so that is one aspect. If you only know react I guess getting SSR without having to learn something else is a win at the cost of complexity in your codebase.
Anything else?
There is a lot of magic and complexity under the covers that I haven't fully groked, and from that perspective I have reservations about it, especially after the recent CVE. As an example of the complexity, I had to set up Sentry, and while Sentry does have a package specifically for next.js, it was still tricky to ensure we were capturing errors with appropriate context in every possible spot.
It's possible as our project matures we'll hit some roadblocks that will make us question our decision to use next.js and self host, but overall our dev team has been productive with it.
Well there are alternatives to Next.js that handle SSR. Remix for example. That's a popular one.
For a smaller project I wouldnt be afraid of rolling your own with Vite. It's pretty simple.
And for any developer I'd really recommend implementing SSR yourself with an express server or whatever. It really increases your understanding of how frameworks work.
Maybe people should rediscover the joys of just FTPing files on a cheap host.
It's not like most project will have problems running on those hosts. And if it is the case scaling is one bare metal server + nginx away.
API routes in same codebase that can use same TypeScript types instead of these typegen tools is really nice too.
I'm very much in the camp of not fiddling with build, routing, hydration, state, etc. as they end up being a distraction from just making the thing you set out to make.
Using something else, means not having support, and spending time yak shaving instead of coding the real solution.
From Java/.NET ecosystem point of view, Next.js is the framework where I feel at home.
I work with agencies that have partner agreements with Vercel/Netlify, which makes it a good option for SaaS products that are in the MACH architecture space.
I now just use a React SPA with Vite.
[Vike]: https://vike.dev/ [SSG]: https://vike.dev/pre-rendering
Remix (or React Router v7, it seems now, confusing) or even TanStack (if you feel adventurous with beta versions) seems like much more reasonable choices if you want SSR and such.
On the other hand, there does seem to be a sleight of hand with Vercel. They want it both ways — to be a company that champions and fosters open source while also keeping the necessary friction in place to make their hosting platform the best choice.
For better or worse, I think we’ll only see more of this model in the future.
And the serverless approach very likely was the reason they used HTTP headers for this kind of privileged communication between parts of the application. Which is a terrible idea for environments where you can't be sure those headers are never set by users.
I tried next once, and I was met with a bunch of hydration errors in production. The concept is nice, but the framework just over complicates everything for some potential gain of rendering on the server, while in reality none of this is needed (just use traditional HTML rendering).
And I’m not even mentioning the fact that the entire framework was built as a nice facade to sell their overpriced cloud service because todays developers can’t write a CI/CD pipeline that rsyncs their code to a VPS and reloads whatever reverse proxy they use.
There’s actually an old PG essay talking about Java where I feel a lot of what he says applies to Nextjs: https://www.paulgraham.com/javacover.html
This was probably at the strongest when they could not decide on the edge function strategy and made a handful of statements that made no sense or made partial sense but were very clearly not the full picture.
Buying rich harris while assuring this would have no impact on the level of sveltekit lock-in crossed a line for me to feel really anxious. So far i did not see anything concrete go bad with sveltekit but its hard to imagine a scenario where this would not happen. Lets hope rich can keep his integrity and awareness enough to walk away at the right time.
Would it? Or would it turn Next.js hosting into a commodity with zero marginal profit, ulimately making it impossible to fund development?
Scrutinizing an oss maintainer is one of the first tasks I check off when researching tech stacks.
Even the slightest ethical concerns would exclude something from my decision making.
Their built-in image exporter (next/image) never had support for static export whatsoever (in contrast to gatsby). When I brought that up on HackerNews some time back, an employee of Vercel tried to argue against that and dial that down without disclosing he is actually an employee of Vercel [0].
Overall, sketchy company with sketchy business practices.
Come on, this is a patently false statement.
There's nothing inherently stateful about Next.js deployment, and self-hosting is both thoroughly documented and straightforward: https://nextjs.org/docs/pages/building-your-application/depl...
If you've worked with any modern deployment pipeline, you'd know self-hosting Next.js is no more complex than any other React application. You build it, you deploy it, you scale it with standard practices.
For many teams with existing infrastructure, self-hosting is actually simpler than migrating to a platform like Vercel. This kind of misinformation reads like someone who either hasn't actually tried self-hosting or has some agenda against the approach.
> The setup needs to be able to dynamically scale up very quickly in order to handle sudden bursts of traffic, while at the same time being able to scale down to zero in order to be cost-effective.
This is obviously a non-issue with the vast majority of deployed apps as a even a single nextjs instance will be able to trivially handle thousands of requests per second.
Both are hype technology and will go the way of Gastby.
And I just recently open-sourced the JS framework. It loads modules on-demand as you need them. It’s supposed to be an all-in-one alternative to React+Redux, Angular etc.
Feedback would be welcome. I do want to start promoting it but it’s still early days.
EDIT: why so many downvotes, and no feedback at all? Just curious. Do the downvoters wish I not share my code with open source MIT license with others? They want people to hear only about existing encumbents?