Hacker Noon

One very important aspect of authentication is session management. Doing this wrong (or naively), can have catastrophic effects for your app!!

Let me provide an example: It's common knowledge that JWTs are very common. A lot of people who use JWTs, implement them as access tokens for their APIs. JWTs also require a shared secret key - what if this is stolen? Then an attacker can use that to hijack any user's account very trivially, and you may not even realise that it's happened! This is far worse than anyone getting hold of hashed passwords from your database.

That being said, I use the following flow for session management:
- User logs in, the backend issues a short-lived (~1 hour) JWT and a long-lived refresh token and sends them to the frontend.
- The frontend sends the JWT for each API call while it's still valid
- In the event that the JWT has expired, the frontend should then use the refresh token to get a new JWT AND a new refresh token (rotating refresh token - see https://tools.ietf.org/html/rfc6749#section-10.4)
- If the refresh token expires, then the user has to login again.

While this sounds quite straightforward, the key here is to use rotating refresh tokens - that's what actually makes it fare more secure than just using simple refresh tokens (i'd argue that it's almost the same level of security as just using a long lived access token)

Some of the benefits of this approach:
- You can detect token theft! If an attacker gets hold of the refresh / access…

"Property is a burden, we want the experience.

The capitalocommunism way of life is coming, a new political system will be needed. The one-party regime will rule: The Machine.

Digitalization is to put information about us and the world into computers.

The more information we have (IoT, GPS, Cookies…), the more means to share it we have (smartphone, 5G, high-speed Internet) and the more capability of computing we have (Algorithm, IA); the more we can combine them to create new services and to outperform the old ways.
Every bite of our lives tend to be digitalized and businesses build “as a service” whenever it’s possible. It costs less: better allocation of resources. That’s all. No more property, only the experience.

No need to possess anything, your revenue or a basic income will grant you access to the life you need and you want based on what has been digitalized. The algorithm will know better than you do.

You feel that you are losing your freedom? If the algorithm and the digital world can manipulate and serve you for your best interest (or for the best interest of somebody else or something else), maybe it’s because you were never free.

We were never free.

Only, this time it’s the machine we have built that controls the causes of our actions and thoughts, and less and less an unknown environment. But we don’t control the machines, we merely is the cause of their existence.
We haven’t (nobody has) create them, companies have. And the aim of all companies is to…

The 7 transaction per second limit of BTC is completely artificial. It stems in the max size of blocks being capped to 1 MB. This was introduced by Satoshi Nakamoto way back in 2010 as an easy way to keep spam from flooding the blockchain. Keep in mind that back then Bitcoin was basically worthless, so one could spam the network with millions of transactions at very low costs, rendering it unusable to everybody.

Satoshi introduced the 1 MB block size limit as a temporary measure meant to be easily lifted as transaction volume and Bitcoin price increased in the future [1]. However this didn't happen, Satoshi Nakamoto disappeared shortly after and his appointed successor, Gavin Andresen, was ousted from the project and his commit rights revoked in 2016.

A lot of people tried to raise the blocksize, and all of them failed because the developers who took over Bitcoin Core have always refused. Given that consensus failed to raised the block size the Bitcoin ABC implementation split from BTC to create Bitcoin Cash (BCH) on August 1st, 2017. Bitcoin Cash initially supported blocks of up to 8 MB, which was later raised to 32 MB. Mainnet stress tests have proven that the network works fine with blocks of up to 20 MB, making clear that the 1 MB limit of BTC is as artificial as it sounds like. Because of the higher block size accommodating to more transactions the fees in BCH are consistently under 1 cent ($0.01), and the roadmap [2] includes features to keep fees low even as BCH…

And it spawned ExtJS. Which could have been React, but they messed up. Literally they built a faster Facebook app 'Fastbook' in 2012.

Short history lesson:

https://medium.com/hackernoon/the-rise-and-fall-of-ext-js-c9d727131991

In August 2006, a guy by the name of Jack Slocum (now CEO of Alta5) began to blog of his experiments with YUI. Over time, these experiments became more complex and Jack would start to bundle them into what would later be named YUI-ext (Yahoo UI extensions) — the precursor to Ext JS (Extensible JavaScript).

Jack Slocum’s blog was used to communicate his vision for YUI-ext and garnered community support from around the world. The release of the Grid component for YUI-ext would forever change the trajectory of the library and the community as the GridPanel would become the core UI component for many applications to come.

Throughout its early life, Jack continued to build upon YUI-ext by adding features to the framework, such as animations, Modals, Tab Panel, Resizable elements and a layout manager that greatly expanded upon the YUI framework. These components would seldom extend the YUI library and had their own rendering functions.

YUI-ext created a foundation for web programmers unlike anything the world had seen before and many developers flocked to the framework and invested in the newly formed community. The net result was the explosive expansion of YUI-ext.

From YUI-ext to Ext JS In January 2007 we found Jack extremely busy to push out…

Closure compiler was actually one of the biggest influences on the design of TypeScript, and even the early motivation for the approach that TypeScript took.

From https://medium.com/hackernoon/the-first-typescript-demo-905ea095a70f:

> There were many options already available, but none seemed to be resonating well with a broad enough section of the market. Internally at Microsoft, Script# was being used by some large teams. It let them use C# directly instead of JavaScript, but as a result, suffered from the kind of impedance mismatch you get when trying to stand at arms length from the runtime model you are really programming against. And there was Google’s Closure Compiler, which offered a rich type system embedded in comments inside JavaScript code to guide some advanced minification processes (and along the way, caught and reported type-related errors). And finally, this was the timeframe of a rapid ascendancy of CoffeeScript within the JavaScript ecosystem — becoming the first heavily used transpiled-to-JavaScript language and paving the way for transpilers in the JavaScript development workflow. (Aside — I often explained TypeScript in the early days using an analogy “CoffeeScript : TypeScript :: Ruby : C#/Java/C++”, often adding — “and there are 50x more C#/Java/C++ developers than Ruby developers :-)”)

> What we quickly discovered we wanted to offer was a “best of all worlds” at the intersection of these three — a language as close as possible to JavaScript…

This describes what I am currently missing the most in the node ecosystem. Deno is a good approach but it will take some time to see how adoption goes.
I would prefer some fine grained capability-based solution. Approaches similar to this have often been articulated [1].
Many of my concerns are best described here [2]. There even was an article from someone who would have been able to overtake many high profile npm accounts with very little effort some time ago (cannot find it anymore).

With tighter snyk integration into npm and the acquisition of npm through ms one could argue that security bar may have risen/will rise but I (speaking as a js/ts dev) am still sceptical.
I haven't really looked to deep into stuff like selinux/apparmor/firejail [3] maybe someone can give an opinion on this. I'd wish for something that would be codeified on package level to make review easier and give me some peace of mind.

For now my plan is to dockerize most of my projects and it's dependencies. It should give a little more protection against malicious postinstall scripts.

Unfortunately, I depend more and more on npm modules outside of projects (coc-vim comes to mind/for others it may be vscode etc.).

[1] https://medium.com/hackernoon/npm-package-permissions-an-idea-441a02902d9b (2018)
[2] https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 (2018)
[3] https://github.com/netblue30/firejail/blob/master/README.md