<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Forem: Bartłomiej Pasik</title>
    <description>The latest articles on Forem by Bartłomiej Pasik (@spolsky).</description>
    <link>https://forem.com/spolsky</link>
    <image>
      <url>https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F54131%2F65982cb6-8f53-43f6-84cb-371d63fbc90b.jpg</url>
      <title>Forem: Bartłomiej Pasik</title>
      <link>https://forem.com/spolsky</link>
    </image>
    <atom:link rel="self" type="application/rss+xml" href="https://forem.com/feed/spolsky"/>
    <language>en</language>
    <item>
      <title>Stop Writing Better CVs. Start Writing Queries.</title>
      <dc:creator>Bartłomiej Pasik</dc:creator>
      <pubDate>Wed, 08 Apr 2026 12:31:00 +0000</pubDate>
      <link>https://forem.com/spolsky/stop-writing-better-cvs-start-writing-queries-24o8</link>
      <guid>https://forem.com/spolsky/stop-writing-better-cvs-start-writing-queries-24o8</guid>
      <description>&lt;p&gt;A few days ago, I was browsing developer roles and noticed something odd: &lt;strong&gt;the same people kept showing up across completely different searches.&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;A backend-heavy Node.js profile showed up in one role. The same person appeared again in a TypeScript/PostgreSQL search. Then again in an AWS/event-driven one.&lt;/p&gt;

&lt;p&gt;It wasn't always because they were obviously the best candidate. A lot of the time, they were just &lt;strong&gt;easier to retrieve&lt;/strong&gt;.&lt;/p&gt;

&lt;p&gt;That sounds harsh, but it matches how hiring works now.&lt;/p&gt;

&lt;p&gt;Before a recruiter ever talks to you, your profile has already been filtered, ranked, matched, or ignored by some kind of system - ATS filters, recruiter search, internal databases, Boolean queries, recommendation engines.&lt;/p&gt;

&lt;p&gt;And most developers are still optimizing for the wrong thing.&lt;/p&gt;

&lt;p&gt;They ask:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;em&gt;"How do I describe myself better?"&lt;/em&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;But the better question is:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;&lt;em&gt;"What searches do I need to appear in?"&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;
&lt;/blockquote&gt;




&lt;h2&gt;
  
  
  Your Profile Is Data, Not Just Writing
&lt;/h2&gt;

&lt;p&gt;When we build software, we don't throw data into a system and hope for the best. We think about schema, indexing, query patterns, ranking, and signal quality.&lt;/p&gt;

&lt;p&gt;Then we switch into job-search mode and suddenly become irrational. We start polishing wording, swapping adjectives, and trying to "sound senior."&lt;/p&gt;

&lt;p&gt;That's the career equivalent of dumping JSON into a database with no indexes and praying search still works.&lt;/p&gt;

&lt;p&gt;Your CV is not just a story.&lt;br&gt;
Your LinkedIn is not just a bio.&lt;br&gt;
Your GitHub is not just a portfolio.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;They are search surfaces.&lt;/strong&gt;&lt;/p&gt;




&lt;h2&gt;
  
  
  Hiring Is Search-First, Then Human
&lt;/h2&gt;

&lt;p&gt;A lot of strong developers are invisible for a very boring reason: their experience exists, but the &lt;strong&gt;query match&lt;/strong&gt; does not.&lt;/p&gt;

&lt;p&gt;A recruiter searches for something like:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;code&gt;senior node.js backend aws&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;typescript postgres distributed systems&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;lambda kafka event-driven architecture&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;solana data indexing engineer&lt;/code&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Now ask the uncomfortable question: &lt;strong&gt;do those exact concepts exist in your profile?&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Not "kind of." Not "implied." Not "someone smart could infer it."&lt;/p&gt;

&lt;p&gt;Do they &lt;em&gt;literally&lt;/em&gt; exist?&lt;/p&gt;

&lt;p&gt;If not, you're depending on a human to guess what the system failed to find. That is a bad strategy.&lt;/p&gt;




&lt;h2&gt;
  
  
  Why Good Experience Still Gets Ignored
&lt;/h2&gt;

&lt;p&gt;This is where a lot of developers get stuck. They have real experience, solid projects, good judgment, strong fundamentals - but they describe that work in vague, compressed language.&lt;/p&gt;

&lt;div class="table-wrapper-paragraph"&gt;&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Weak signal&lt;/th&gt;
&lt;th&gt;Searchable signal&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;Worked with cloud infrastructure and backend services.&lt;/td&gt;
&lt;td&gt;Built event-driven backend services with Node.js, AWS Lambda, SQS, and PostgreSQL.&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Improved database performance.&lt;/td&gt;
&lt;td&gt;Optimized PostgreSQL queries and indexing, reducing API p95 latency by 42%.&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Led architecture decisions.&lt;/td&gt;
&lt;td&gt;Designed a multi-tenant Node.js service with Kafka-based async workflows and PostgreSQL read replicas.&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;&lt;/div&gt;

&lt;p&gt;The point is not to stuff keywords. The point is to &lt;strong&gt;encode evidence in a way search systems can actually use&lt;/strong&gt;.&lt;/p&gt;




&lt;h2&gt;
  
  
  Systems Don't Reward Style. They Reward Signal.
&lt;/h2&gt;

&lt;p&gt;Most hiring systems are trying to infer a few things:&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;What tools you've used&lt;/li&gt;
&lt;li&gt;How recently you used them&lt;/li&gt;
&lt;li&gt;Whether you've worked at the expected level&lt;/li&gt;
&lt;li&gt;Whether your experience is consistent across sources&lt;/li&gt;
&lt;li&gt;Whether your profile looks comparable to successful candidates&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;That means vague language is expensive.&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;"Worked with AWS"&lt;/strong&gt; → weak.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;"Built a Lambda + S3 + Step Functions pipeline processing 10M+ events/month"&lt;/strong&gt; → strong.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;One tells a story. The other creates retrieval, depth, and seniority signals.&lt;/p&gt;




&lt;h2&gt;
  
  
  The Mindset Shift That Changes Everything
&lt;/h2&gt;

&lt;p&gt;Stop asking:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;em&gt;"How do I present myself better?"&lt;/em&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Start asking:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;&lt;em&gt;"What queries should retrieve me?"&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;That one shift changes how you write everything - your CV bullets, your LinkedIn headline, your About section, your project descriptions, your GitHub README text, even the names of your pinned repos.&lt;/p&gt;

&lt;p&gt;You are not just presenting yourself. &lt;strong&gt;You are designing structured evidence.&lt;/strong&gt;&lt;/p&gt;




&lt;h2&gt;
  
  
  A 30-Minute Exercise That Exposes the Problem Fast
&lt;/h2&gt;

&lt;p&gt;Here's the simplest version of this.&lt;/p&gt;

&lt;h3&gt;
  
  
  Step 1: Pick 5 real roles
&lt;/h3&gt;

&lt;p&gt;Not aspirational ones. Not "maybe in two years" roles. Pick five jobs you would realistically apply to &lt;strong&gt;this month&lt;/strong&gt;.&lt;/p&gt;

&lt;h3&gt;
  
  
  Step 2: Extract the raw search terms
&lt;/h3&gt;

&lt;p&gt;Copy the &lt;strong&gt;exact phrases&lt;/strong&gt; from those job descriptions. Not your summary of them - the company's actual language.&lt;/p&gt;

&lt;p&gt;Not this:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;cloud experience&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;But this:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;AWS Lambda, DynamoDB, Kafka, event-driven architecture, PostgreSQL, microservices, observability, system design&lt;/p&gt;
&lt;/blockquote&gt;

&lt;h3&gt;
  
  
  Step 3: Build a query coverage checklist
&lt;/h3&gt;

&lt;p&gt;Turn those phrases into a checklist and compare them against your CV, LinkedIn, GitHub, and personal site:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;[ ] Node.js&lt;/li&gt;
&lt;li&gt;[ ] TypeScript&lt;/li&gt;
&lt;li&gt;[ ] PostgreSQL&lt;/li&gt;
&lt;li&gt;[ ] AWS Lambda&lt;/li&gt;
&lt;li&gt;[ ] Kafka&lt;/li&gt;
&lt;li&gt;[ ] event-driven architecture&lt;/li&gt;
&lt;li&gt;[ ] distributed systems&lt;/li&gt;
&lt;li&gt;[ ] system design&lt;/li&gt;
&lt;li&gt;[ ] observability&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Every unchecked box is a discovery problem.&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;
  
  
  Step 4: Patch the missing surface area
&lt;/h3&gt;

&lt;p&gt;Update your profile using real evidence from work you've actually done. Not keyword stuffing. Not a giant "skills cloud." Just better encoding.&lt;/p&gt;

&lt;p&gt;Add the missing concepts where they naturally belong: headline, summary, role bullets, project descriptions, repository READMEs.&lt;/p&gt;

&lt;p&gt;The goal is &lt;strong&gt;truthful query coverage&lt;/strong&gt;.&lt;/p&gt;




&lt;h2&gt;
  
  
  What Developers Usually Get Wrong
&lt;/h2&gt;

&lt;h3&gt;
  
  
  1. They optimize for sounding smart
&lt;/h3&gt;

&lt;p&gt;Words like "passionate," "strategic," "visionary," or "results-driven" rarely help without technical proof.&lt;/p&gt;

&lt;h3&gt;
  
  
  2. They optimize for sounding unique
&lt;/h3&gt;

&lt;p&gt;Clever phrasing is bad for retrieval. &lt;strong&gt;Clear beats clever.&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;
  
  
  3. They compress specifics into abstractions
&lt;/h3&gt;

&lt;p&gt;"Cloud-native distributed platform" sounds impressive. &lt;code&gt;Node.js, AWS Lambda, SQS, PostgreSQL&lt;/code&gt; is far more searchable.&lt;/p&gt;




&lt;h2&gt;
  
  
  Your GitHub Creates Searchable Surface Area Too
&lt;/h2&gt;

&lt;p&gt;Even when recruiters don't read your code, they still scan your repos, README intros, pinned projects, and naming choices. That matters more than people think.&lt;/p&gt;

&lt;p&gt;If your LinkedIn says you built a real-time event processing service, but your repo is called &lt;code&gt;new-final-project-v2&lt;/code&gt;, you're wasting signal.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Name things like you want them to be found.&lt;/strong&gt;&lt;/p&gt;




&lt;h2&gt;
  
  
  One Practical Place to Start
&lt;/h2&gt;

&lt;p&gt;If you need raw material for this exercise, open a few real listings from &lt;a href="https://career.now/boards" rel="noopener noreferrer"&gt;career.now's Board Directory&lt;/a&gt; and pull the exact terms companies are using today. Then compare those terms against your own profile.&lt;/p&gt;

&lt;p&gt;You'll usually find the gap in minutes - and that gap is often more useful than another round of CV polishing.&lt;/p&gt;




&lt;h2&gt;
  
  
  The Uncomfortable Truth
&lt;/h2&gt;

&lt;p&gt;You are not only competing with other developers. You are competing with &lt;strong&gt;profiles that are easier to index, easier to match, and easier to rank&lt;/strong&gt;.&lt;/p&gt;

&lt;p&gt;That doesn't mean skill doesn't matter. It means skill that can't be retrieved often doesn't get seen.&lt;/p&gt;




&lt;h2&gt;
  
  
  Final Thought
&lt;/h2&gt;

&lt;p&gt;The market is no longer human-first. It's &lt;strong&gt;search-first, then human&lt;/strong&gt;.&lt;/p&gt;

&lt;p&gt;So stop treating your career documents like essays. Treat them like systems.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Define the schema. Improve the signal. Optimize for retrieval. Make the right queries return you.&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Because the developer who gets found gets considered. And the developer who gets considered gets a chance to prove they're actually the best fit.&lt;/p&gt;

</description>
    </item>
    <item>
      <title>How NOT to launch your new product</title>
      <dc:creator>Bartłomiej Pasik</dc:creator>
      <pubDate>Tue, 26 Nov 2019 13:13:30 +0000</pubDate>
      <link>https://forem.com/spolsky/how-not-to-launch-your-new-product-212n</link>
      <guid>https://forem.com/spolsky/how-not-to-launch-your-new-product-212n</guid>
      <description>&lt;p&gt;As an indie maker at some point you face the last phase of your product development - the launch. Here's how not to launch your product… learned the hard way 😐&lt;/p&gt;

&lt;p&gt;&lt;a href="https://www.producthunt.com/posts/i-need-brains" rel="noopener noreferrer"&gt;I Need Brains&lt;/a&gt; it was my first product... which I've screwed so much 🤦‍♂️&lt;/p&gt;

&lt;p&gt;I wanted to create something. Literally SOMETHING. It didn't need to earn money. It could just bring some followers on my Twitter. That's all.&lt;/p&gt;

&lt;p&gt;When the idea came, I just grabbed the laptop and I started coding backend in Node.js and after that frontend in React.&lt;/p&gt;

&lt;p&gt;The app solved my problem. I don't know who should I follow on Twitter to get the meat. I don't want to read about politics. Only engineering and indie stuff.&lt;/p&gt;

&lt;h2&gt;
  
  
  Do not launch when your competitor launched his/her product a couple of days ago 🤦‍♂️
&lt;/h2&gt;

&lt;p&gt;Couple of days before my launch &lt;a href="https://www.producthunt.com/posts/followfriday" rel="noopener noreferrer"&gt;Follow Friday&lt;/a&gt; appeared on PH. Almost the same idea. Better design. Quicker launch. He gained hundreds of upvotes and I got 4 😐&lt;/p&gt;

&lt;h2&gt;
  
  
  Do not forget about marketing stuff 💩
&lt;/h2&gt;

&lt;p&gt;I was so angry that I wanted to launch quickly and I did. I'd just made two screenshots, written some short description and that's all. Did the same thing for Hackernews and for Wykop (Polish Reddit).&lt;/p&gt;

&lt;h2&gt;
  
  
  Do not overegineer your product 🤖
&lt;/h2&gt;

&lt;p&gt;I wanted to do simple app that will list Twitter profiles. I'm full stack developer, so I thought that I should use my technologies to do it quickly. Nope. That's not how you do the MVP as an indie maker. Use the &lt;strong&gt;No Code tools&lt;/strong&gt;. Seriously. For example, do you need an API that will serve some data? Use Google Sheets with &lt;a href="https://sheety.co/" rel="noopener noreferrer"&gt;Sheety&lt;/a&gt; or &lt;a href="https://www.sheet2site.com/" rel="noopener noreferrer"&gt;Sheet2Site&lt;/a&gt; to make even a full app. Do you want to do simple one page app? Use &lt;a href="https://carrd.co/" rel="noopener noreferrer"&gt;Carrd&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;&lt;a href="https://www.hownottolaunch.com/" rel="noopener noreferrer"&gt;Here&lt;/a&gt; are other things you can check before launch.&lt;/p&gt;

&lt;p&gt;Cheers. Hope your launch will be successful 🚀&lt;/p&gt;

</description>
      <category>webdev</category>
      <category>startup</category>
    </item>
    <item>
      <title>Why and where you should use Node.js</title>
      <dc:creator>Bartłomiej Pasik</dc:creator>
      <pubDate>Tue, 26 Nov 2019 11:46:52 +0000</pubDate>
      <link>https://forem.com/spolsky/why-and-where-you-should-use-node-js-4io0</link>
      <guid>https://forem.com/spolsky/why-and-where-you-should-use-node-js-4io0</guid>
      <description>&lt;p&gt;In 2009, Ryan Dahl introduced his side project which had revolutionized the JavaScript world. Since then Node.js is helping businesses in the rapid development of scalable solutions that suit high traffic needs. Furthermore, Node.js has a great developer experience thanks to the Node Package Manager which is the largest open-source library registry in the world.&lt;/p&gt;

&lt;h1&gt;
  
  
  Why should you consider using Node.js in your next project?
&lt;/h1&gt;

&lt;h2&gt;
  
  
  Easy to learn
&lt;/h2&gt;

&lt;p&gt;Node.js is really easy to start. Those who know JavaScript, know how to write Node.js applications. There are some differences, however, mostly everything is the same. The hardest thing about Node for beginners is the asynchronous non-blocking programming paradigm. Even though it’s still JS, once you get the idea, you’ll fall in love with it.&lt;/p&gt;

&lt;p&gt;Node’s main advantage is that one JavaScript developer can work on the whole web application instead of two developers working on the frontend and backend side. Furthermore, frontend and backend applications can share the JS code. Code reusability makes application development costs less. &lt;/p&gt;

&lt;h2&gt;
  
  
  Active open-source community
&lt;/h2&gt;

&lt;p&gt;I think the next cool feature right after the non-blocking I/O operations (communication between the system and the outside world) are open-source packages from the NPM (Node packages registry). By the numbers, there are more than 1 million active packages at this moment in the repository. Last week downloads reached 14 billion and last month over 61 billion! The numbers are tremendous.&lt;/p&gt;

&lt;h2&gt;
  
  
  I/O highway
&lt;/h2&gt;

&lt;p&gt;The core thing about Node is the Input/Output operations and how they are handled. I/O operations are for example a database call, getting file, calling an external service, etc. In Node, we have the event loop which stores all incoming requests which are blocking operations in the loop with their callback functions. Callback functions are called right after finishing the blocking operation. With this solution, Node is not blocking the main thread and can handle new requests. Such feature allows us to handle more requests compared to threads solution from other languages.&lt;/p&gt;

&lt;h2&gt;
  
  
  Scalability
&lt;/h2&gt;

&lt;p&gt;Node allows you to scale concurrent requests to more than other languages can do out of the box. Some guys achieved scalability levels of over &lt;a href="http://blog.caustik.com/2012/08/19/node-js-w1m-concurrent-connections/" rel="noopener noreferrer"&gt;1 million concurrent requests&lt;/a&gt; and over &lt;a href="https://blog.jayway.com/2015/04/13/600k-concurrent-websocket-connections-on-aws-using-node-js/" rel="noopener noreferrer"&gt;600,000 WebSocket connections&lt;/a&gt;. Of course, it’s a matter of the work you do behind each request and how many resources you have, though Node is still good at scaling things up. &lt;/p&gt;

&lt;p&gt;Compared to Java, below some point defined by the number of Java threads, Java is better in handling concurrent requests, because threads are faster. Though Node, after that point is going higher in the number of concurrent requests and Java stays with the same maximum. Of course, if you write bad code, you’ll have 10 requests per second instead of 1000. In general, it’s easier to write scalable solutions in Node.&lt;/p&gt;

&lt;p&gt;Its limits here are mostly about CPU usage due to the fact that the whole application is running on a single thread. You can’t fully use the CPU power. To scale things, you need to create a Node Cluster, use things such as PM2 node process manager or scale with Docker if you run Node inside a Docker container.&lt;/p&gt;

&lt;h2&gt;
  
  
  Developer productivity and satisfaction
&lt;/h2&gt;

&lt;p&gt;The freshness of the technology gives developers the power to make great software. It’s ten years old now. In contrast, Java or PHP appeared more than 20 years ago, so it’s still pretty young. That and less boilerplate code, easy asynchronous programming, and elastic JSON manipulation makes Node.js developers happy while staying productive.&lt;/p&gt;

&lt;h1&gt;
  
  
  Where can you apply Node.js?
&lt;/h1&gt;

&lt;p&gt;Node will more or less fit everywhere. When you want to do a quick minimum viable product to test your idea or you want to go enterprise, use Node. There are some caveats, however, the overall image of the Node ecosystem is good.&lt;/p&gt;

&lt;h2&gt;
  
  
  API
&lt;/h2&gt;

&lt;p&gt;I wonder why every blog post about Node.js usage doesn’t say anything about simple API. Authors say that you can use it for sophisticated cases, but developers can use Node just to create your CRUD application. With ORM support for SQL or NoSQL databases, you can quickly expose your resources as an API. Perfectly fits MVP use case. No rocket science with project setup. Just write the API and launch your product.&lt;/p&gt;

&lt;h2&gt;
  
  
  Real-time applications
&lt;/h2&gt;

&lt;p&gt;In Node, it’s super easy to integrate with WebSockets such as  Socket.io. WebSockets, give you the ability to create a duplex connection between the client and the server. With this, the server can send real-time updates to the user when something changes.&lt;/p&gt;

&lt;p&gt;Example usage of WebSockets: &lt;/p&gt;

&lt;p&gt;Social feeds — update instantaneously user feeds with new posts without the need of refreshing the user’s browser&lt;br&gt;
Games — fire an action event and broadcast it to other players&lt;br&gt;
Document collaboration – document editing simultaneously by multiple users like Google Docs&lt;br&gt;
Clickstream data — analyze user movements and behavior on your site&lt;br&gt;
Real-time analytics and financial tickers — update instantaneously your charts in the client browser&lt;br&gt;
Instant messaging — live chat experience inside the client browser&lt;/p&gt;

&lt;h2&gt;
  
  
  Serverless
&lt;/h2&gt;

&lt;p&gt;If you want to scale your application automatically that will detect traffic spikes and scale up or down to match incoming traffic, serverless is a good option. It gives you the ability to pay only for the resources used during the execution, so you don’t need to pay monthly for monstrous instances that can handle that traffic. &lt;/p&gt;

&lt;p&gt;For instance, Amazon Web Services has a thing called Lambda which is a function-as-a-service product, so you write a JavaScript function that handles the requests, saves the code in the AWS, binds it to some endpoint with API Gateway and that’s all. AWS will do the rest for you and you can sleep well when a rush of users visit the site on Black Friday, for example. &lt;/p&gt;

&lt;p&gt;There is one thing which I don’t like about serverless architecture. It’s the vendor lock-in problem, however, in Node.js we have a framework called serverless. It allows you to write serverless applications that you can deploy to any cloud provider with a consistent experience and that’s a pretty cool thing. It integrates easily with AWS, Azure, Cloudflare Workers, Fn, Google, Kubeless, OpenWhisk, Spotinst, so you can choose which provider fits your needs best.&lt;/p&gt;

&lt;h2&gt;
  
  
  High throughput APIs
&lt;/h2&gt;

&lt;p&gt;The best examples of high throughput API are chat applications. You want to be reliable and fast when millions of users are typing messages to each other. Of course, chats are not the only example. You can use it everywhere where you need to work at a huge scale. Proper horizontal scaling such as app architecture on top of the AWS with Node.js I/O gives you the ability to achieve this goal. Nevertheless, it’s not a magic technology that will do it out of the box.&lt;/p&gt;

&lt;h2&gt;
  
  
  Streaming services
&lt;/h2&gt;

&lt;p&gt;Imagine you have a video file on your server which weighs 20GB and your server has only 8GB RAM. You want to give a link to a friend to download it, so you just set up your server and endpoint and you give the link to your friend. Your friend clicks the link and after that, your server is going down due to out of memory error, because the server tries to load the whole file into the memory. &lt;/p&gt;

&lt;p&gt;In Node you can produce an &lt;a href="https://espeo.eu/blog/build-error-monitoring-tool/" rel="noopener noreferrer"&gt;out of memory error&lt;/a&gt;, however, Node Streams come to rescue us. With Streams, by creating file stream in our endpoint, we are just increasing memory usage by 25MB (default chunk size), because Node is not buffering the whole file. It’s just sending chunks, one by one to the end-user. Moreover, you can transform the stream on the fly. So for example, if you’d have a text file that would weigh 2GB, you could just make an uppercase of all letters in each line on the fly without loading the file into the memory. With those possibilities, you can create your own Netflix clone or any other streaming platform. &lt;/p&gt;

&lt;h2&gt;
  
  
  Enterprise applications
&lt;/h2&gt;

&lt;p&gt;Java is super enterprise. Many treat Node as an MVP tool. However, in my opinion, that’s the matter of used tools. Many use the Express.js framework, which is elastic, good for rapid development. Although it’s used by many incompetently and that leads to non-enterprise software.&lt;/p&gt;

&lt;p&gt;Nevertheless, there is a solution. &lt;a href="https://nestjs.com/" rel="noopener noreferrer"&gt;Nest.js&lt;/a&gt; is our Enterprise Hero. If you are familiar with Java Spring Framework, you’ll love it. Moreover, Nest.js uses TypeScript which gives it more Enterprise power. TypeScript is a superset of Javascript which has static type-checking which allows you to “write Java with JSON”, so with TS you are more error-proof. Nest with its design forces you to write clean, enterprise code which makes your application more scalable in the matter of architecture and less error-prone, because type errors are caught even before running your app.&lt;/p&gt;

&lt;h2&gt;
  
  
  SQL and NoSQL
&lt;/h2&gt;

&lt;p&gt;Many say that SQL support is worse in Node. Two years ago I would say that Node.js should only be used with NoSQL databases because working with NoSQL is a pleasure and with SQL is not. However, nowadays SQL tools are much better. For example, there is the Sequelize which is pretty good when you need to create CRUD operations and there is also Knex which can be used when you need to perform some advanced queries. I like query builders, however, Java query builder called jOOQ is at the top of my list, sorry Node!&lt;/p&gt;

&lt;p&gt;Node.js SQL tools are not more complicated, I mean here the syntax, than NoSQL tools. They are at the same level, in my opinion. So, yes, you can use Node.js with the SQL database, no worries.&lt;/p&gt;

&lt;h1&gt;
  
  
  But…
&lt;/h1&gt;

&lt;p&gt;As history shows, NPM had some failures. One of them was about the 11 line Node package which was adding characters to the string — named “left-pad.” On March 22nd, 2016 this package was deleted from the repository and it resulted in world chaos in the Node.js environment. Many projects couldn’t be built on that day. Fortunately, NPM fixed the problem by making it harder to unpublish a version of a package.&lt;/p&gt;

&lt;p&gt;Another thing about NPM vulnerabilities, on the 6th of January, David Gilbertson published an article &lt;a href="https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5" rel="noopener noreferrer"&gt;“I’m harvesting credit card numbers and passwords from your site. Here’s how.”&lt;/a&gt; It shows how any hacker could inject malicious code in the package code and the package could be installed not as your first party, but even as a third-party package. To be more precise, it’s not only a Node.js problem, but it appears also in almost any frontend technology which uses NPM. What we can do about this? &lt;/p&gt;

&lt;p&gt;Keep checking npm audit security report.&lt;br&gt;
Choose the packages you use carefully. Use more popular ones.&lt;br&gt;
Have fewer dependencies.&lt;/p&gt;

&lt;h2&gt;
  
  
  Practical implementation
&lt;/h2&gt;

&lt;p&gt;Recently, we’ve experienced the practical implementation of the article, with some extra social engineering attacks. One owner of a popular &lt;a href="https://github.com/dominictarr/event-stream/issues/116" rel="noopener noreferrer"&gt;NPM package&lt;/a&gt; didn’t want to maintain the package anymore, so he gave maintain access to the guy who had previously asked him if he can do it for him. Unfortunately, the guy was a hacker and has added two lines of code which were importing the hacker’s package which was hijacking user data. The package was published with a malware subpackage. After that many NPM packages were updated with newer package version and the hacker could steal the data that went through applications which had the hacked package inside.&lt;/p&gt;

&lt;p&gt;To solve the problem many packages were updated to the previous non-hacked version. It’s not a problem only of the NPM. It can appear in any language library, some will be secured, though some will fail. A solution could be to not use the newest version. For example, update the package version every two releases or more, so the version has time to be verified.&lt;/p&gt;

&lt;p&gt;So as you can see there are some pitfalls for which we need to be ready when we use NPM. Nevertheless, it’s still the best repository of libraries among all programming languages in my opinion, because you can find almost everything here. You want to generate pdfs? NPM has it. Work with colors? No problem. Sprite sheets? Sure, that and everything else you can find in the NPM. Just remember about security checks and you’ll be ok.&lt;/p&gt;

&lt;h1&gt;
  
  
  Node.js limitations
&lt;/h1&gt;

&lt;p&gt;There is one more thing, namely, CPU usage. Node is very efficient when you try to do many I/O operations, however, if you’d like to use Node for e.g. image processing, just don’t. Due to its design, it operates with a main single thread and it is not suitable for heavy computations. An application can’t scale one process to all available CPU cores and it’s a little bit slower than Java, for example. Node wins when you need to do plenty of I/O operations, but in this situation, you’d need to choose another language such as Java or Python. Of course, we can use 100% of available cores thanks to the Node Cluster, however, it will create new processes, so we will gain only more requests than we can handle, no CPU power to compute heavy stuff.&lt;/p&gt;

&lt;h1&gt;
  
  
  So are you ready for Node?
&lt;/h1&gt;

&lt;p&gt;In summary, you need to define what your product needs to do. I’d say that the only no-go is when you need to do heavy computation. Although, you can use Node as a service that will handle the traffic to your other service that is doing heavy computations. &lt;/p&gt;

&lt;p&gt;It will fit in most cases. Now with the Nest as an enterprise framework, you can’t say no to Node.&lt;/p&gt;

</description>
      <category>javascript</category>
      <category>node</category>
      <category>webdev</category>
      <category>programming</category>
    </item>
  </channel>
</rss>
