White House App Is a Terrifying Security Mess
New submitter spazmonkey writes: From a hidden GPS tracker polling your location every 4.5 minutes to JavaScript loaded from a random GitHub account, no SSL certificate pinning, and an in-app browser that silently strips cookie consent dialogs and paywalls from every page you visit, the new White House app seems to have a little bit of everything. A security researcher pulled the APK a … ⌘ Read more
Firefox vs. Chrome: Which Performs Better on a Linux Laptop?
Phoronix staged “a showdown” between Firefox and Chrome, testing them both on an Intel Panther Lake laptop running Ubuntu 26.04.
JetStream 3.0 was announced at the end of March as the latest major web browser benchmark. This updated version of JetStream is focused on intensive portions of modern JavaScript and WebAssembly web applications… Google Chrome … ⌘ Read more
Google Proposes JSIR As A High-Level IR For JavaScript
Google engineers have been developing JSIR as a high-level intermediate representation (JSIR) for JavaScript that they are already using in production at the company code code analysis and transforming other code/bytecode to JavaScript as well as for deobfuscating JavaScript code… ⌘ Read more
Hmm I think it’s a bug in the Javascript. It’s meant to be 
↳
In-reply-to
»
@prologic so...
⤋ Read More
@bender@twtxt.net Correctamundo! In this case, it’s available for the browser as a single (optionally-minified) JavaScript file, or for Node via NPM (as JS) and JSR.io (as “native” TypeScript).
I had to do it that way because I wanted a library I could use in both an Express server (for TwtKpr and TwtStrm) and the browser (for my website and… TwtStrm).
Hopefully, I’ll have more to share about those other projects soon…
↳
In-reply-to
»
New library alert => Last night, I published
⤋ Read More
twtxt-lib, a new isomorphic TypeScript library for parsing and interacting with twtxt.txt files. Check out the demo at https://twtxt-lib.itsericwoodward.com/!
An isomorphic TypeScript library is a codebase, written in TypeScript, that can run in multiple JavaScript environments, most commonly both the web browser (client-side) and a server (like Node.js). The core idea is to share the exact same code across the frontend and backend, avoiding duplication and improving efficiency.
Is AI Impacting Which Programming Language Projects Use?
“In August 2025, TypeScript surpassed both Python and JavaScript to become the most-used language on GitHub for the first time ever…” writes GitHub’s senior developer advocate.
They point to this as proof that “AI isn’t just speeding up coding. It’s reshaping which languages, frameworks, and tools developers choose in the first place.”
Eighty percent of … ⌘ Read more
Fake Job Recruiters Hid Malware In Developer Coding Challenges
“A new variation of the fake recruiter campaign from North Korean threat actors is targeting JavaScript and Python developers with cryptocurrency-related tasks,” reports the Register.
Researchers at software supply-chain security company ReversingLabs say that the threat actor creates fake companies in the blockchain and crypto-trading sectors and publ … ⌘ Read more
Cloudflare Acquires Team Behind Open Source Framework Astro
Cloudflare has acquired the core team behind the open source JavaScript framework Astro, bringing its creators in-house while pledging to keep Astro fully open source. The New Stack reports: Astro is used by major brands like IKEA, Unilever, Visa and OpenAI to build fast, content-driven websites. Search engines prioritize fast-loading and clean pages, the … ⌘ Read more
44% Of GNOME Core Apps Are Written In C, 13% In JavaScript & 10% In Rust
GNOME developer Sophie Herold has shared some interesting end-of-year code stats for the GNOME project. The “GNOME” codebase is up to 6,692,516 lines of code at the end of 2025 with 1,611,526 lines of that being from GNOME apps. Where the data gets interesting is on the programming language breakdown in different areas… ⌘ Read more
Micro QuickJS Engine Compiles & Runs JavaScript With As Little As 10kB Of RAM
Very talented open-source developer Fabrice Bellard who already is well known for his work on QEMU, the Tiny C Compiler, and FFmpeg, has another accomplishment: Micro QuickJS. The Micro QuickJS JavaScript engine can compile and run JavaScript programs with as little as 10 kB of RAM… ⌘ Read more
I’ve rebuilt ntfy with the web interface, though it took me an hour or so of JavaScript dependency hell and a certain library whose native interface doesn’t have support for NetBSD
On Linux:Step 1. Clone ntfy repository as usual
Step 2.
export NODE_ENV=productionStep 3.
make web-buildStep 4. Make a tarball with the generated assets and copy it over
Step 5. Repeat the above mentioned first step
Step 6. Unpack the assets into
server/Step 7. Build backend with
make cli-linux-serverStep 8. Done
↳
In-reply-to
»
Working on day 3 of the Advent of Code 2025: https://adventofcode.com/
⤋ Read More
@itsericwoodward@itsericwoodward.com So you’re found for Javascript eh? 🧐
↳
In-reply-to
»
One day I'll like to elaborate why I'm against the usage of Anubis (and its derivatives) for the rampant crawlers
⤋ Read More
@shinyoukai@neko.laidback.moe I’m mostly against it because it forces Javascript™ on the client(s) at a blanket level. Doing “Proof-of-Work” explicitly IMO is fine™, but not at an Ingress/Edge level IMO – Which is why I haven’t adopted it myself.
ProcessOne: Stop Telling Us XMPP Should Use JSON
We hear this too often: “XMPP uses XML. It should use JSON—it’s more modern.”
The logic seems straightforward: JSON came later, so it must be better. But better for what, exactly?
JSON became successful because it’s the standard serialization format for JavaScript. That made it convenient for browser-based applications.
Does that m … ⌘ Read more
How to Identify Sensitive Data in JavaScript Files: (JS-Recon)
A complete guide to uncovering hidden secrets, API keys, and credentials inside JavaScript files
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/h … ⌘ Read more
@arne@uplegger.eu Yeah SSE + HTMX is basically all you need really. The whole complicated/complex JavaScript ecosystem is overkill.
A Beginner’s Guide to Finding Hidden API Endpoints in JavaScript Files
How to discover what others miss in plain sight
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-beginners-guide-to-finding-h … ⌘ Read more
** JavaScript Notebook **
Kartik recently reminded me of my own project playground that I do use from time to time, but that I’ve always been a little frustrated with.
That reminder paired with that frustration lead me to revisit something similar that I’d started a while ago, but hadn’t finished. Notebook is kinda my take on Jupyter Notebooks minus a ton of features and capabilities.
Here is … ⌘ Read more
I finally resolved my issues with hashing twts… with REGEX!
Dates in JavaScript are truly strange creatures.
Working on a project that does Augmented Reality and computer vision object detection and QR code and image recognition inside a Web application. Pretty neat what can be done today with a few thousand lines of JavaScript.
** Answering some questions about Baba Yaga **
My previous post found its way to Hacker News; I don’t have an account there, but a commenter asked a few questions that I thought I could answer in a follow up post.
Baba Yaga uses call-by-value evaluation, not call-by-need (aka“lazy”).
From the interpreter,
”`hljs javascript
function visitFunctionCall(node) {
const callee = visit(node.callee);
// Arguments ar … ⌘ Read more”`
↳
In-reply-to
»
@kat I don’t like Golang much either, but I am not a programmer. This little site, Go by example might explain a thing or two.
⤋ Read More
One of the nicest things about Go is the language itself, comparing Go to other popular languages in terms of the complexity to learn to be proficient in:
- Go:
25keywords (Stack Overflow); CSP-style concurrency (goroutines & channels)
- Python 2:
30keywords (TutorialsPoint); GIL-bound threads & multiprocessing (Wikipedia)
- Python 3:
35keywords (Initial Commit); GIL-bound threads,asyncio& multiprocessing (Wikipedia, DEV Community)
- Java:
50keywords (Stack Overflow); threads +java.util.concurrent(Wikipedia)
- C++:
82keywords (Stack Overflow);std::thread, atomics & futures (en.cppreference.com)
- JavaScript:
38keywords (Stack Overflow); single-threaded event loop &async/await, Web Workers (Wikipedia)
- Ruby:
42keywords (Stack Overflow); GIL-bound threads (MRI), fibers & processes (Wikipedia)
Also spent the morning continuing to think about a new design for EdgeGuard’s WAF. I’m basically going to build an entirely new pluggable WAF that will be designed to only consider Rate Limiting, IP/ASN-based filtering, JavaScript challenge handling, Basic behavioral analysis and Anomaly detection.
The only part of this design I’m not 100% sure about is the Javascript-based challenge handling? 🤔 I’m also considering making this into a “proof of work” requirement too, but I also don’t want to falsely block folks that a) turn Javascript™ off or b) Use a browser like links, elinks or lynx for example.
Hmmm 🧐
️♂️ Unlisted but Not Unseen: How I Found the Admin Panel in a JavaScript Comment
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteu … ⌘ Read more
V8 JavaScript engine gets eager compilation hints, but will devs use sparingly as advised?
Comments ⌘ Read more
** Payloads in Plain Sight: How Open Redirect + JavaScript Led to Full Account Takeover **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/payloads-in-plai … ⌘ Read more
Exposed Secrets in JavaScript Files
🔥Free Article https://medium.com/@Abhijeet_kumawat_/exposed-secrets-in-javascript-files-430a76834952?sk=ffd9ca6c8ede38ac77dcb68a507b9299
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/exposed-secrets-in-javascript-fi … ⌘ Read more
Playing multimedia with Dillo
What if you want to use a web browser like Dillo, which lacks JavaScript support and can’t play audio or video inside the browser? Dillo doesn’t have the capability to play audio or video directly from the browser, however it can easily offload this task to other programs. This page collects some examples of how to do watch videos and listen to audio tracks or podcasts by using an external player program. In particular we will cover mpv with yt-dlp which supports YouTube … ⌘ Read more
i wonder if i could make a little yarn widget for my site to show my last post. that’d be fun. sadly i do not know javascript
Oracle justified its JavaScript trademark with Node.js–now it wants that ignored
Article URL: https://deno.com/blog/deno-v-oracle2
Comments URL: https://news.ycombinator.com/item?id=42939940
Points: 503
# Comments: 129 ⌘ Read more
Run Linux inside a PDF file via a RISC-V emulator
You might expect PDF files to only be comprised of static documents, but surprisingly, the PDF file format supports Javascript with its own separate standard library. Modern browsers (Chromium, Firefox) implement this as part of their PDF engines. However, the APIs that are available in the browser are much more limited. The full specfication for the JS in PDFs was only ever implemented by Adobe Acrobat, and it contains some ridicul … ⌘ Read more
@lyse@lyse.isobeef.org The one in question is more like the javascript version for unwrapping errors when accessing methods.
const value = some?.deeply?.nested?.object?.value
but for handling errors returned by methods. So if you wanted to chain a bunch of function calls together and if any error return immediately. It would be something like this:
b:= SomeAPIWithErrorsInAllCalls()
b.DoThing1() ?
b.DoThing2() ?
// Though its not in the threads I assume one could do like this to chain.
b.Chain1()?.Chain2()?.End()?
I am however infavor of having a sort of ternary ? in go.
PS. @prologic@twtxt.net for some reason this is eating my response without throwing an error :( I assume it has something to do with the CSRF. Can i not have multiple tabs open with yarn?