Justin Lowery cerebrl

The original text comes from "The Tall Office Building Artistically Considered" by Louis Sullivan. I've edited down the text considerably to reveal what I feel are the best parts.

All of these critics and theorists agree, however, positively, unequivocally, in this, that the tall office building should not, must not, be made a field for the display of architectural knowledge in the encyclopaedic sense; that too much learning in this instance is fully as dangerous, as obnoxious, as too little learning; that miscellany is abhorrent to their sense …

To this latter folly I would not refer were it not for the fact that nine out of every ten tall office buildings are designed in precisely this way, in effect not by the ignorant, but by the educated. It would seem indeed as though the "trained" architect, when facing this problem, were beset at every story, or at most, every third or fourth story, by the hyst

tl;dr

Don't run as root.
For sessions, set httpOnly (and secure to true if running over SSL) when setting cookies.
Use the Helmet for secure headers: https://github.com/evilpacket/helmet
Enable csrf for preventing Cross-Site Request Forgery: http://expressjs.com/api.html#csrf
Don't use the deprecated bodyParser() and only use multipart explicitly. To avoid multiparts vulnerability to 'temp file' bloat, use the defer property and pipe() the multipart upload stream to the intended destination.

Some Tricks for Troubleshooting

You can use these API calls in your code if you need to, but I've actually found them quite useful when on the console in Chrome:

require.defined(moduleId) - returns true if your moduleId has been defined and is ready for use.

require.specified(moduleId) - returns true if your moduleId has been listed as a dependency by another defined module. Note that just because this returns true doesn't mean your moduleId is ready to use (don't you just love asynchrony?).

requirejs.s.contexts._.config - I learned about this from Vernon Kesner. This is technically a "back door/undocumented" call - so it could change or disappear without warning. However it returns a very useful object full of configuration info, see below: Chrome Console results for requrejs.s.conects._.config

	var myApp = angular.module('myApp', []);

	//service style, probably the simplest one
	myApp.service('helloWorldFromService', function() {
	this.sayHello = function() {
	return "Hello, World!"
	};
	});

	//factory style, more involved but more sophisticated

	var parser = document.createElement('a');
	parser.href = "http://example.com:3000/pathname/?search=test#hash";

	parser.protocol; // => "http:"
	parser.hostname; // => "example.com"
	parser.port; // => "3000"
	parser.pathname; // => "/pathname/"
	parser.search; // => "?search=test"
	parser.hash; // => "#hash"
	parser.host; // => "example.com:3000"

	<style>
	#content-slider {
	width: 650px;
	overflow: hidden;
	height: 300px;
	}

	#content-slider-inside {
	list-style: none;
	height: 320px; // these 3 lines

	ol {
	counter-reset: numbering 0;
	}

	ol li:before {
	counter-increment: numbering 1;
	content: counter(numbering, decimal);
	}

	/*****************************
	Leading at 1.33em
	*****************************/

	h1 {
	/* Total Height: 106.6666px */
	font-size: 4em; /* 64 */
	line-height: 1.3333em; /* 85.3312 */
	padding-bottom: 0.3333em; /* 21.333312 */
	}

	function showIt(elID) {
	var el = document.getElementById(elID);
	el.scrollIntoView(true);
	}

	var express = require('express');
	var https = require('https');
	var http = require('http');
	var fs = require('fs');

	// This line is from the Node.js HTTPS documentation.
	var options = {
	key: fs.readFileSync('test/fixtures/keys/agent2-key.pem'),
	cert: fs.readFileSync('test/fixtures/keys/agent2-cert.pem')
	};