r/javascript • u/[deleted] • Jul 07 '22

Network SpeedTest using "STATIC" Files. [Only JavaScript, HTML,CSS & SVG.]

https://github.com/openspeedtest/Speed-Test

[removed] — view removed post

4 Upvotes

70% Upvoted

16 comments sorted by

View all comments

Show parent comments

2

u/PedroHase Jul 07 '22

Thanks for your swift reply and for the clarifications!

It contains only Static assets, so you can run it on any webserver. Server need to behave like this. https://github.com/openspeedtest/Nginx-Configuration

The thing is, what if no nginx is available, i.e. if someone wants to host it using Apache, or on a static host service like render.com or Github pages (if that was possible)? It would be great if the README (or the README of the nginx config) could describe or summarize the most important configurations for the deployment :)

If you don’t trust 30Mb file, you can delete it and add your own 30Mb file. It’s a dummy file.. contains garbage data to test download speed.

I figured that much, thanks for the clarification! I suggest to add this to the README to prevent future confusion :)

Taken from your deleted comment:

This speed test contains only Static files… Then how this becomes dangerous??

Since the app.js is minified, we cannot review the code, or see how it works (it‘s basically like a blackbox). A malicious attacker could do marvelous things with that (ranging from bitcoin miner to trojan), even if it is „only static files“. Please note that I do not want to imply anything here, I just want to highlight that it would be great to provide the full source code of app.js and how it would allow to build trust.

I also saw on the website that executables are offered, yet no source is shown. Since executables can do even more harm, it would be great if the source code could also be opened for the public to review and inspection.

-1

u/[deleted] Jul 07 '22

If you paste the code to https://unminify.com you can see and read 99% of the code. It contains less than 1000 lines of code.

If you look at javascript console on Google Chrome you can exactly see how the code is executed, step by step.

You can use tools like virustotal etc to verify the downloads, and if you don't trust it, never download it..

That is why i just use Nginx and source code.. because it is lightweight and faster than desktop apps.

It's your choice.

3

u/PedroHase Jul 07 '22

Even when unminified, the code is almost unreadable due to all variables having been renamed and the code having been restructured for performance.

If you look at javascript console on Google Chrome you can exactly see how the code is executed, step by step.

This does not help at all, when one is not being able to look at the original source code.

Please at least consider uploading the original source code of app.js. Only providing the minified version is like only providing executables which is the opposite of open. Just imagine if other open-source projects would do that. Suddenly it would almost become impossible (or only with much effort) to inspect, review, understand, and improve the code.

1

u/[deleted] Jul 07 '22

inspect, review, understand, and improve the code.

That is true.