guest271314

Originally posted at https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/

Javascript Cryptography Considered Harmful

WHAT DO YOU MEAN, "JAVASCRIPT CRYPTOGRAPHY"?

We mean attempts to implement security features in browsers using cryptographic algoritms implemented in whole or in part in Javascript.

You may now be asking yourself, "What about Node.js? What about non-browser Javascript?". Non-browser Javascript cryptography is perilous, but not doomed. For the rest of this document, we're referring to browser Javascript when we discuss Javascript cryptography.

Configure HTTP/2 on express with Remix

Remix uses <link rel="modulepreload"/> on client-side JavaScript.

I thought it would be cool to setup HTTP/2 on express to enable pipelining the script files.

Add spdy package, then update server.js to setup server.

Generate self-signed SSL certificate and copy to ./certs folder.

Linux: Compile C++ to WebAssembly and JavaScript using Emscripten and CMake

Download and Install Emscripten

My preferred installation location is /home/user
Get the latest sdk: git clone https://github.com/emscripten-core/emsdk.git
Enter the cloned directory: cd emsdk
Install the lastest sdk tools: ./emsdk install latest
Activate the latest sdk tools: ./emsdk activate latest
Activate path variables: source ./emsdk_env.sh
Configure emsdk in your bash profile by running: echo 'source "/home/user/emsdk/emsdk_env.sh"' >> $HOME/.bash_profile

Maintenance (or lack of it)

This is a not great piece of code I've wrote few years ago (I didn't have better things to do when I was 17, apperantly), when I was fiddling around with the V8 JS Engine. It doesn't work with newer versions of V8, since the library doesn't have a stable API. Time, where I had time to fight with the depot_tools and lackluster MSVC support for fun is long gone. I've tried to redo this example once in the past, after I've got an email notification that someone got interested in stuff that I've put on the net and have forgotten about. Toolset got even more picky than I remember it being and my attention for personal programming projects drifted away somewhere else, so it's highly unlikely that I'll update it to the newer API. But I'm leaving the code there, maybe someone will make good use of it.

	import { spawn } from 'child_process';
	import { parse } from 'node-html-parser';

	const client_id = process.env.SOUNDCLOUD_CLIENT_ID;

	const link = process.argv[2] \|\| 'https://soundcloud.com/rashidaliofficial/kabhi-kabhi-aditi';


	/*
	* Download SoundCloud track page HTML code

	window.performance.getEntriesByType("resource").filter(p => 'nextHopProtocol' in p)[0].nextHopProtocol // 'h2'

	// deprecated
	// https://chromestatus.com/feature/5637885046816768

	window.chrome.loadTimes().wasFetchedViaSpdy; // true
	window.chrome.loadTimes().npnNegotiatedProtocol; // 'h2'
	window.chrome.loadTimes().connectionInfo; // 'h2'

	// 5 March 2022
	// Using window.crypto.subtle.digest()
	// @param "sha-256" or other algorithm
	// @param DataView with ArrayBuffer or just ArrayBuffer

	// Not my own.

	// Copy+paste+modified from
	// https://stackoverflow.com/a/68545495

	// Copyright (c) 2019-2021 Robert Rypuła - https://github.com/robertrypula

	/*
	+--------------------------------------------------+
	\| Binary broadcast WebSocket server in pure NodeJs \|
	+--------------------------------------------------+

	Based on great article created by Srushtika Neelakantam:
	https://medium.com/hackernoon/implementing-a-websocket-server-with-node-js-d9b78ec5ffa8

	/*** Native messaging "ping_pong" example in C.
	*
	* It is reimplementation of the corresponding Python example from
	* https://github.com/mdn/webextensions-examples/tree/master/native-messaging
	*
	* # Python 3.x version
	* # Read a message from stdin and decode it.
	* def getMessage():
	* rawLength = sys.stdin.buffer.read(4)
	* if len(rawLength) == 0:

	#!/bin/sh

	~/.deno/bin/deno run --allow-net --allow-write --allow-read --unstable unzip.js "$@"