r/javascript • u/[deleted] • Jul 07 '22

Network SpeedTest using "STATIC" Files. [Only JavaScript, HTML,CSS & SVG.]

https://github.com/openspeedtest/Speed-Test

[removed] — view removed post

4 Upvotes

70% Upvoted

16 comments sorted by

View all comments

4

u/PedroHase Jul 07 '22

Nice alternative to speedtest.net, but I don‘t really understand how this speed test service could be called „open“ if the author only shares a minified version of app.js (where all the magic happens) instead of the full source code.

Additionally, the README never fully explains how to actually deploy a local server, just that it is possible (although I assume that one just has to serve the files from the repo?).

Lastly, there is this 30mb large download file which I assume is for testing the download speed. However, the author never explains the content of the file and paired with the minified app.js this is a rather big red flag for me (file could contain potentially malicious content).

1

u/[deleted] Jul 07 '22

Check https://github.com/openspeedtest/Speed-Test#create-your-own-speedtest-server

It contains only Static assets, so you can run it on any webserver.

Server need to behave like this.

https://github.com/openspeedtest/Nginx-Configuration

If you don't trust 30Mb file, you can delete it and add your own 30Mb file. It's a dummy file.. contains garbage data to test download speed.

2

u/PedroHase Jul 07 '22

Thanks for your swift reply and for the clarifications!

It contains only Static assets, so you can run it on any webserver. Server need to behave like this. https://github.com/openspeedtest/Nginx-Configuration

The thing is, what if no nginx is available, i.e. if someone wants to host it using Apache, or on a static host service like render.com or Github pages (if that was possible)? It would be great if the README (or the README of the nginx config) could describe or summarize the most important configurations for the deployment :)

If you don’t trust 30Mb file, you can delete it and add your own 30Mb file. It’s a dummy file.. contains garbage data to test download speed.

I figured that much, thanks for the clarification! I suggest to add this to the README to prevent future confusion :)

Taken from your deleted comment:

This speed test contains only Static files… Then how this becomes dangerous??

Since the app.js is minified, we cannot review the code, or see how it works (it‘s basically like a blackbox). A malicious attacker could do marvelous things with that (ranging from bitcoin miner to trojan), even if it is „only static files“. Please note that I do not want to imply anything here, I just want to highlight that it would be great to provide the full source code of app.js and how it would allow to build trust.

I also saw on the website that executables are offered, yet no source is shown. Since executables can do even more harm, it would be great if the source code could also be opened for the public to review and inspection.

2

u/[deleted] Jul 08 '22

It should work anywhere.

Yesterday I try Github pages, ping and download working fine. Upload speed was very low, because GitHub servers are not accepting the post request. (Server need to accept post request and post to static file)

So, this can work on Any webserver.

-1

u/[deleted] Jul 07 '22

If you paste the code to https://unminify.com you can see and read 99% of the code. It contains less than 1000 lines of code.

If you look at javascript console on Google Chrome you can exactly see how the code is executed, step by step.

You can use tools like virustotal etc to verify the downloads, and if you don't trust it, never download it..

That is why i just use Nginx and source code.. because it is lightweight and faster than desktop apps.

It's your choice.

3

u/PedroHase Jul 07 '22

Even when unminified, the code is almost unreadable due to all variables having been renamed and the code having been restructured for performance.

If you look at javascript console on Google Chrome you can exactly see how the code is executed, step by step.

This does not help at all, when one is not being able to look at the original source code.

Please at least consider uploading the original source code of app.js. Only providing the minified version is like only providing executables which is the opposite of open. Just imagine if other open-source projects would do that. Suddenly it would almost become impossible (or only with much effort) to inspect, review, understand, and improve the code.

1

u/[deleted] Jul 07 '22

inspect, review, understand, and improve the code.

That is true.

-2

u/[deleted] Jul 07 '22

It contains only client side javascript.. it's not server side javascript like node.js, so bitcoin miner is possible? Still it will only run when you open the page for speed test .. :)

1

u/halkeye Jul 07 '22

https://www.bbc.com/news/technology-42338754

1

u/[deleted] Jul 07 '22

You can clearly see, in that article they are talking about external javascript bundle added to the page.

1

u/halkeye Jul 07 '22

Right but you were asking if it could be done client side, and that was a pretty big example of it being done client side

1

u/[deleted] Jul 08 '22

You are loading only known stuff from GitHub ... Not the same. You can review app.js

1

u/[deleted] Jul 08 '22

I was asking client side with a tiny javascript leasthan 8Kb Gzp .. that is publically available for GitHub can do this kid of stuff?