kumavis

"use strict"

const { Membrane } = require('es-membrane')


// create raw object to be protected by membrane
const rawObj = { secure: true }

// create membrane to manage interaction
const membrane = new Membrane()

kumavis

const provider = polyfillJsonRpcBatchAsBatchTx(inpageProvider)


function polyfillJsonRpcBatchAsBatchTx (oldProvider) {
  const newProvider = { sendAsync }
  return newProvider

  function sendAsync (req, cb) {
    if (Array.isArray(req)) {

kumavis

_then = Promise.prototype.then
// [Function: then]

Promise.prototype.then = function(){ console.log('then!'); return _then.apply(this, arguments);  }
// [Function (anonymous)]

p = new Promise(resolve => resolve())
// Promise { undefined }

kumavis

> x = 'hello'
'hello'
> x.toString = () => 'ayy'
[Function]
> x.valueOf = () => 'yoo'
[Function]
> x
'hello'
> x+''
'hello'

kumavis

const { makeStringTransform } = require('browserify-transform-tools')


module.exports = makeStringTransform('lavamoat-browserify-workarounds', { excludeExtension: ['.json'] }, (content, _, cb) => {
  const result = content
    // fix html comments
    .split('-->').join('-- >')
    // fix direct eval
    .split(' eval(').join(' (eval)(')
    .split('\neval(').join('\n(eval)(')

kumavis

LavaMoat

js tooling to help prevent attacks from evil dependencies.

read more here

lavamoat-webpack

webpack plugin for creating bundles protected by the LavaMoat kernel.

kumavis

const { builtinModules: builtinPackages } = require('module')
// [email protected]
const { createModuleInspector } = require('lavamoat-core')

const inspector = createModuleInspector({
  // used to see if this imports builtins
  isBuiltin: (name) => builtinPackages.includes(name),
  // adds some notes on ses compat, etc
  includeDebugInfo: true,
})

kumavis

hi guybedford/
i really enjoyed your blog post https://guybedford.com/secure-modular-runtimes.html

here's some quick notes comparing your proposal and lavamoat in its current form (https://github.com/lavamoat/lavamoat)
these differences represent lavamoat currently, and can easily be changed with input from smart folks like yourself

### basic runtime structure
  [exactly] "this runtime can fully restrict high-level capability access from packages for third-party code running in the same process"
  [exactly] "That this runtime can support an onramp from the existing JavaScript ecosystems, which is crucial for adoption. "

kumavis

https://www.redfin.com/OR/Portland/6109-SW-Thomas-St-97221/home/173018992?utm_source=android_share&utm_medium=share&utm_nooverride=1&utm_content=link
https://www.redfin.com/OR/Portland/3246-SW-Cascade-Ter-97205/home/26369492?utm_source=android_share&utm_medium=share&utm_nooverride=1&utm_content=link

kumavis

syncing geth on digital ocean

- name: eth2-mainnet-00
- sync time: (failed to sync, bound by disk perf)
- region: fra1
- type: s-8vcpu-16gb
- primaryDb: attached volume
- ancientDb: attached volume
- price vps: $0.119/hr
- price volume: $0.052/hr 350gb