Hasty Briefsbeta

All tags

javascript

41 stories total

Bilingual

Leaflet.js
2 months ago
- Leaflet is a lightweight (42 KB) open-source JavaScript library for creating interactive maps on mobile and desktop.
- It offers a simple, well-documented API with essential features like tile layers, markers, popups, vector layers, GeoJSON, and image overlays.
- Interaction features include drag panning, scroll wheel zoom, pinch-zoom, double-click zoom, keyboard navigation, and events.
- Visual features include smooth animations, retina support, and a clean default design for markers, popups, and controls.
- Customization is supported via pure CSS, HTML/image markers, custom map projections, and a modular build system.
- Performance is optimized with hardware acceleration, smart rendering, and no external dependencies.
- Browser support covers Chrome, Firefox, Safari 5+, Opera 12+, IE9-11, Edge, and major mobile browsers.
- The library is community-driven, encouraging contributions, bug reports, and help on forums like Stack Overflow and GitHub.
EU tells firms to label AI-generated content from Sunday
2 months ago
- JavaScript is disabled in the browser, requiring user action to proceed.
- A required part of the site failed to load due to potential browser extensions, network issues, or browser settings.
- Troubleshooting steps include checking connection, disabling ad blockers, or using a different browser.
Recursion is lying to you
2 months ago
- Recursion is elegant for naturally recursive problems (tree walks, divide-and-conquer) but each call consumes stack space, leading to stack overflow at large depths.
- Tail call optimization (TCO) can theoretically reuse stack frames, but JavaScript runtimes rarely implement it reliably; even correctly tail-recursive code may still overflow.
- The Fibonacci example shows that exponential branching and stack overflow are distinct failure modes, requiring different fixes.
- A table of runtime TCO support (May 2026) shows that Chrome/V8, Node.js, Deno, Firefox, Safari, and Bun all lack reliable TCO, so portability cannot be assumed.
- Production-safe alternatives include iterative rewriting and the trampoline pattern, which maintains recursive style while avoiding stack growth.
- Practical checklist: never assume TCO, test with realistic bounds, favor iteration for deep or user-driven input, and treat recursion as a readability tool only for bounded depths.
Beej's Bit Bucket
2 months ago
- In JavaScript, prototypal inheritance differs from class-based inheritance: an object's prototype is an implicit reference to its constructor's prototype property.
- If a property isn't found on an object, it's searched for in that object's prototype, and further up the prototype chain until found or exhausted.
- Inheritance can be implemented by setting a constructor's prototype to an instance of another constructor, forming a chain; it's important to fix the constructor property afterward to maintain correct references.
Javascript obfuscation tricks
2 months ago
- Functions can read themselves via comments, allowing arbitrary string data to be embedded and used; deobfuscators that remove comments will break the code.
- Stack trace line and column numbers can be used as encryption keys; reformatting or removing functions changes these numbers, causing decryption to fail.
- Browser crashes can be triggered by async fork bombs (e.g., async function calling itself twice) that hide the crash location in devtools.
- Variable names can be extracted as strings through object key iteration, enabling data storage in identifiers and enforcing name integrity with eval.
- To thwart LLM-based deobfuscation, embed threatening Base64 instructions (with noise) that cause models to refuse, or overload the context window by making every code segment essential.
Overview of JavaScript Virtualization Obfuscation
2 months ago
- No code protection is unbreakable because computers must see instructions to execute them, so the goal is to abstract program execution.
- Virtualization obfuscation involves creating a fantasy CPU, compiling input code to its instruction set, and running it in an interpreter, similar to the Java Virtual Machine.
- Web protections (JavaScript) are generally easier to crack than binary protections, as binary security has a more established scene.
- A basic example shows a program as an array of instruction IDs and operands, with a loop that interprets instructions like push and add.
- Monitoring program memory can break such virtualized code, just like executable programs.
Try-Catch Control Flow Obfuscation
2 months ago
- JavaScript exception handling can be exploited to create non-linear code flow that confuses analysis.
- Attackers can force errors in try blocks to jump to catch blocks, hiding the actual intended functionality.
- The catch block executes real logic, often with conditional checks based on state set in the try block.
- Chaining multiple try-catch blocks creates complex execution paths that only reach specific code through specific error chains.
- It is important to avoid making it obvious that the function always throws an error, as that makes the pattern easier to detect.
Beej's Bit Bucket
2 months ago
- This demo explains building a custom drag-and-drop system with JavaScript and CSS, using jQuery for ease while implementing core functionality manually.
- The system moves elements by setting their CSS 'position' to 'absolute' and updating 'left' and 'top' properties relative to the container.
- Drag mode is initiated on mousedown, items follow the mouse during move, and on mouseup, the drop is processed with collision detection on droptargets.
- To avoid the element's corner sticking to the mouse, the system remembers the mouse offset on the element at click and adjusts positioning accordingly.
- Mouse coordinates are converted from document space to the container's coordinate system for proper absolute positioning within the container.
- Elements with class 'stayinparent' are restricted to their parent container, while others can move freely across the document.
- Drop containers are marked with class 'droptarget'; on drop, collisions are checked and a 'drop' event is dispatched with the draggable element.
- Usage involves setting 'draggable' and 'droptarget' classes, calling 'beejdnd.init()', and binding a drop event handler with a draggable reference.
- Suggestions for improvements include bounding drag areas, axis restriction, clone creation, scroll-on-edge, multitouch support, and jQuery plugin conversion.
- The code is licensed under the MIT open source license.
Beej's Bit Bucket
2 months ago
- Gamepad API requires user interaction (plugging in or pressing a button) before it works to prevent information leaks.
- Browser support varies; Firefox, Chrome, Opera, Safari, and Edge support it, but IE does not; Edge has quirks.
- Use navigator.getGamepads() to get an array of gamepad objects; the array may contain null entries for disconnected slots.
- Gamepad objects have properties: index, id, axes, buttons, mapping, and connected; use the index property to identify specific gamepads.
- Poll gamepad state in a requestAnimationFrame loop rather than relying on events; events for connect/disconnect are unreliable.
- Standard Gamepad mapping sets mapping="standard" and defines button/axis layouts; non-standard controllers require manual handling.
- Buttons have pressed (boolean) and value (0.0 to 1.0 for analog); axes range from -1 to 1 for stick positions.
- Implement a dead zone to ignore small axis values near center and prevent unintended drift.
- Clamp joystick values to a circle of radius 1 to normalize maximum speed across different controllers.
async() => { await }
2 months ago
- The internet primarily consists of websites, with Cloudflare's service handling over 300,000 requests per second.
- Serving clients one at a time doesn't scale, so concurrency is needed to handle multiple clients simultaneously.
- JavaScript lacks native threads, leading to callback-based concurrency known as 'callback hell' before async/await was introduced.
- Async/await simplifies asynchronous code, making it more readable and manageable, as shown by converting callback-heavy code to a cleaner async structure.
Making a Shuffle Button
2 months ago
- The author updated their notes blog shuffle feature to navigate to a dedicated shuffle page with JavaScript logic instead of embedding all note IDs in every page.
- The old approach injected all note IDs into every HTML file, causing slow builds and cache invalidation on every new post.
- A no-JavaScript approach using static links was considered but rejected due to its impact on deployment and caching.
- The new solution uses a single JSON file or a dedicated HTML page to store note IDs, reducing cache issues.
- The shuffle page includes a 'Shuffling...' indicator with a 300ms delay to provide user feedback, mimicking old CD players.
- This approach allows direct access to the shuffle feature via a URL route, without requiring GUI interaction.
Why Do We Write super(props)? — overreacted
2 months ago
- In JavaScript, calling `super()` is required in a class constructor before using `this`; React class components inherit this rule.
- Passing `props` to `super(props)` is not strictly necessary because React assigns `this.props` after the constructor runs, but it ensures `this.props` is available during the constructor.
- The `super(props)` convention prevents confusion and bugs, especially when methods are called from within the constructor.
- React's constructor also receives `context` as a second argument, but it's less commonly used.
- Class fields proposal and Hooks eliminate the need for explicit `super()` calls in many cases.
How Does React Tell a Class from a Function? — overreacted
2 months ago
- React treats components differently based on whether they are functions or classes, needing to call functions directly or instantiate classes with `new` and call `render`.
- The `new` operator in JavaScript creates an object for class constructors, but using it with arrow functions or non-class functions causes errors or unwanted behavior.
- React cannot simply use `new` for all components because it breaks arrow functions and prevents support for primitive return types.
- React distinguishes classes from functions by checking for a special `isReactComponent` flag on the prototype, which is added to `React.Component`.
- Using `instanceof` to check class inheritance is unreliable due to issues like multiple React copies and missing static properties in some transpiled code.
- The `isReactComponent` flag on `React.Component.prototype` provides a practical and reliable way for React to determine component type.
How Does the Development Mode Work? — overreacted
2 months ago
- Development mode includes warnings that help detect bugs but increases bundle size and slows performance.
- The __DEV__ constant is replaced at build time, and minifiers remove dead code in production.
- The process.env.NODE_ENV pattern is substituted with a string literal by bundlers like webpack.
- Dead code elimination requires static conditions; complex expressions or module boundaries may not work.
- Modern tools like Create React App separate development and production builds into distinct commands.
- Development warnings should be on by default to catch bugs early, especially for new users.
- The convention of process.env.NODE_ENV originated from Node.js and was adopted by browserify and React.
- React now precompiles separate bundles for development and production to avoid runtime checks.
- The article advocates for modes as a first-class concept in JavaScript environments.
On let vs const — overreacted
2 months ago
- The author's previous post advocating for 'let' over 'const' sparked controversy, with the majority favoring 'const' wherever possible.
- Arguments for preferring 'const' include reducing mental overhead, preventing bugs from reassignments, teaching immutability concepts, and detecting meaningless assignments like in React Hooks.
- Arguments against include loss of intent communication, confusion with immutability, pressure to avoid 'let' leading to awkward code, and the fact that reassignments rarely cause bugs in practice.
- The author concludes they don't care and recommends following existing codebase conventions, using linters to automate decisions, and deleting any annoying lint rules.
Porffor: An ahead-of-time JavaScript-to-native/WASM compiler
2 months ago
- Porffor is an ahead-of-time JavaScript compiler that outputs WebAssembly or native binaries, achieving 10-30x smaller and faster WebAssembly output than existing JS-to-Wasm projects by compiling rather than bundling an interpreter.
- JS compiled to Wasm enables sandboxed execution for secure server-side hosting and edge runtimes, with low overhead compared to JITs, allowing more customers on the same hardware.
- Compilation to native binaries reduces sizes up to 1000x (e.g., from ~90MB to <100KB), enabling JS use in embedded systems, game consoles, and tiny CLI apps under 1MB.
- Porffor compiles JS to C then to native, works anywhere C works, and natively supports TypeScript without a build step.
- It is written in JS with 0 eval for safety, performs static analysis for optimizations, and avoids the trade-offs of interpreters or multiple JIT tiers by compiling first and running later.
- Drawbacks include lack of dynamic JS evaluation (like eval) and early-stage incompleteness, but it is tested against the Test262 conformance suite every commit.
An AL mother killed herself to fulfill a ChatGPT prophecy, lawsuit alleges
2 months ago
- JavaScript is disabled in the browser, preventing the site from loading.
- The issue may be caused by browser extensions, network problems, or browser settings.
- Suggested solutions include checking the connection, disabling ad blockers, or trying a different browser.
Pixar lays off over 100 Bay Area workers using ElastiGirl letterhead
2 months ago
- JavaScript is disabled in the user's browser.
- A message prompts the user to enable JavaScript to proceed.
- A required part of the site failed to load, possibly due to browser extensions, network issues, or browser settings.
- The user is advised to check their connection, disable ad blockers, or try a different browser.
Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine
2 months ago
- Mohabi is a modern Firefox browser with a securely sandboxed JavaScript engine (SpiderMonkey) using software-based fault isolation (SFI).
- The JavaScript engine was disaggregated from the rest of the browser, requiring complex transformation across data structures and control flow.
- An optimized SFI toolchain was developed to handle large memory footprints and unique JavaScript engine challenges.
- Mohabi incurs modest overheads: 24.82% on JetStream and 24.43% on Speedometer benchmarks.
- The x86-64 SFI toolchain is the fastest to date, with overheads between 5.9%–6.6% on SPEC 2017.
- This is the most ambitious case study of retrofitting in-process sandboxing in a large system.
How Did Node.js Come About?
2 months ago
- Node.js was created by Ryan Dahl in 2009 as a server-side JavaScript platform to solve concurrency and file upload progress issues.
- Dahl initially tried Ruby (with Mongrel) and C but found them inadequate; he chose JavaScript for its nonblocking I/O and large developer community.
- The first public presentation at JSConf EU 2009 led to sponsorship by Joyent, enabling full-time development.
- Native Windows support was added in version 0.6 (November 2011), and npm became an integral part of Node.js from version 0.6.3.
- Dahl retired in 2012, passing development to Isaac Schlueter; version 0.8 improved performance and stability.
- In December 2014, a community fork called io.js was created due to dissatisfaction with Joyent's management.
- Node.js and io.js merged into the Node.js Foundation in June 2015, leading to version 4 and a regular LTS release cycle.
- In 2018, Dahl introduced Deno, a new JavaScript/TypeScript runtime addressing Node.js regrets, and in 2019 the OpenJS Foundation formed from merging JS Foundation and Node.js Foundation.

firstprev0next

javascript

Leaflet.js

EU tells firms to label AI-generated content from Sunday

Recursion is lying to you

Beej's Bit Bucket

Javascript obfuscation tricks

Overview of JavaScript Virtualization Obfuscation

Try-Catch Control Flow Obfuscation

Beej's Bit Bucket

Beej's Bit Bucket

async() => { await }

Making a Shuffle Button

Why Do We Write super(props)? — overreacted

How Does React Tell a Class from a Function? — overreacted

How Does the Development Mode Work? — overreacted

On let vs const — overreacted

Porffor: An ahead-of-time JavaScript-to-native/WASM compiler

An AL mother killed herself to fulfill a ChatGPT prophecy, lawsuit alleges

Pixar lays off over 100 Bay Area workers using ElastiGirl letterhead

Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine

How Did Node.js Come About?