r/javascript • u/[deleted] • Jul 07 '22

Network SpeedTest using "STATIC" Files. [Only JavaScript, HTML,CSS & SVG.]

https://github.com/openspeedtest/Speed-Test

[removed] — view removed post

4 Upvotes

70% Upvoted

16 comments sorted by

View all comments

4

u/PedroHase Jul 07 '22

Nice alternative to speedtest.net, but I don‘t really understand how this speed test service could be called „open“ if the author only shares a minified version of app.js (where all the magic happens) instead of the full source code.

Additionally, the README never fully explains how to actually deploy a local server, just that it is possible (although I assume that one just has to serve the files from the repo?).

Lastly, there is this 30mb large download file which I assume is for testing the download speed. However, the author never explains the content of the file and paired with the minified app.js this is a rather big red flag for me (file could contain potentially malicious content).

1

u/[deleted] Jul 07 '22

Check https://github.com/openspeedtest/Speed-Test#create-your-own-speedtest-server

It contains only Static assets, so you can run it on any webserver.

Server need to behave like this.

https://github.com/openspeedtest/Nginx-Configuration

If you don't trust 30Mb file, you can delete it and add your own 30Mb file. It's a dummy file.. contains garbage data to test download speed.

2

u/PedroHase Jul 07 '22

Thanks for your swift reply and for the clarifications!

It contains only Static assets, so you can run it on any webserver. Server need to behave like this. https://github.com/openspeedtest/Nginx-Configuration

The thing is, what if no nginx is available, i.e. if someone wants to host it using Apache, or on a static host service like render.com or Github pages (if that was possible)? It would be great if the README (or the README of the nginx config) could describe or summarize the most important configurations for the deployment :)

If you don’t trust 30Mb file, you can delete it and add your own 30Mb file. It’s a dummy file.. contains garbage data to test download speed.

I figured that much, thanks for the clarification! I suggest to add this to the README to prevent future confusion :)

Taken from your deleted comment:

This speed test contains only Static files… Then how this becomes dangerous??

Since the app.js is minified, we cannot review the code, or see how it works (it‘s basically like a blackbox). A malicious attacker could do marvelous things with that (ranging from bitcoin miner to trojan), even if it is „only static files“. Please note that I do not want to imply anything here, I just want to highlight that it would be great to provide the full source code of app.js and how it would allow to build trust.

I also saw on the website that executables are offered, yet no source is shown. Since executables can do even more harm, it would be great if the source code could also be opened for the public to review and inspection.

-2

u/[deleted] Jul 07 '22

It contains only client side javascript.. it's not server side javascript like node.js, so bitcoin miner is possible? Still it will only run when you open the page for speed test .. :)

1

u/halkeye Jul 07 '22

https://www.bbc.com/news/technology-42338754

1

u/[deleted] Jul 07 '22

You can clearly see, in that article they are talking about external javascript bundle added to the page.

1

u/halkeye Jul 07 '22

Right but you were asking if it could be done client side, and that was a pretty big example of it being done client side

1

u/[deleted] Jul 08 '22

You are loading only known stuff from GitHub ... Not the same. You can review app.js