This year we will prepare you for the Christmas celebration, by giving you small presents of knowledge every day, which will teach you about the world of security.

Welcome to the most important Christmas Calendar you will open this year. The world of security is very large and complex, and it is difficult to comprehend the entire field of security. It may seem unfair, but if you are a developer you need to get everything right, but as a hacker, it can be enough to find a small bug to do a lot of damage. This is why it is important to learn about the most common vulnerabilities to protect your application.

Luckily modern frameworks make the task of security much easier for developers, but it is still very important to know what the challenges are. Throughout these days before Christmas, we will guide you through many of the these challenges. This will give you the knowledge and some tools to find, test and learn about the vulnerabilities.

Security breaches in the news

The last years we have learned that almost all companies, devices and software could possibly have vulnerabilities.

One example came in September, when Facebook released that they had resolved a bug. And this bug made it possible to generate an access token for whoever you wanted at Facebook.

Last year, we learned that smartwatches that parents use to track their kids are vulnerable. An attacker could locate, fake the position, take pictures and more by exploiting the smartwatches.

New vulnerabilities and breaches happen almost every day, and this only emphasizes that security is difficult. Hopefully this calendar will create some awareness, and you can be a security ambassador to reduce the number of vulnerabilities in the future.

Celebrate a more secure Christmas this year

ECMA

ECMA has its origin in the 1960s and the name was at the time the "European Computer Manufacturers Association".

The initiative was started when the need for standarizations appeared because of the growing use of computers. In 1994 the name was changed to ECMA International to reflect an international interest for standarization.

Since its formation, the their mission has been to develop standards of how information systems and technology should be used. Some of these standards include the C# language specification, FAT12/FAT32 file system, Office Open XML and of course ECMAScript.

TC-39

So TC-39 is a so-called "technical committee" (the 39th) of ECMA.

This committee is responsible for the standardization of the JavaScript language, or ECMAScript (ECMA-262 or simply ES) as the spesification of the language is formally known as.

Basically, it's a bunch of super smart JavaScript enthusiasts and language experts who get together to define how JavaScript new versions of should work and what features it should have.

The people of TC-39 represent some of the biggest companies in tech: Google, Intel, Microsoft and Facebook, to name a few. The committee meets regularly, and the meeting notes are available online.

Here is the agenda of the most recent meeting, which ended Thursday this week, hosted by Apple in Cupertino, California.

So how do I propose my cool feature?

Anyone can suggest features and additions to JavaScript! This process consists of 5 stages:

Stage 0 - Strawman: This stage is for proposing features to the specification and no formal criterias are required. A submission to stage 0 has to come from either a member of the committee or a registered contributer.

Stage 1 - Proposal: To enter stage 1 you first have to get yourself a champion. A champion is a member of TC-39 who is responsible for the proposal. You will also need an outline for the problem, examples of usages, a high-level API, as well as having identified challenges and cross-cutting concerns. The point of this stage is to make a case for why the change should be made to the langauge. In addition, by the time you are finished, you will have to have described a shape of a solution and identified potential challenges.

Stage 2 - Draft: You will need to be ready with an intial specification text to enter stage 2. At Stage 2 the precise syntax and semantics are described using formal spec language.

Stage 3 - Candidate: When you have the complete spec text and the designated reviewers have signed off on it you are ready for stage 3. As a candidate the proposal is ready for refinements and feedback from implementations and users.

Stage 4 - Finished: Congrats, your proposal is now ready to be included in the ECMAScript standard! To get to Stage 4 you will have to defined Test262 acceptance tests. You will also need two compatible implementations that passes acceptance test. The proposal should have in-field experience with shipping and implementations. Lastly, a pull-request has been sent to the ecma262 repository on github with integrated spec text.

What's the deal with JavaScript, TC39 and ECMAScript?

Documenting your project can be a pain in the ass and is often neglected. Docusaurus removes the pain of maintaining documentation.

Docusaurus

First of all, I have to say that Docusaurus is a BLAST to work with. I should know, I recently created the documentation websites for React Redux with it!

Like React, Docusaurus is an open source project that originated at Facebook. There are many factors to a successful open source project, such as technology, community and usability. However, documentation is often neglected. Docusaurus was introduced at the end of 2017 to address and reduce the friction of maintaining documentation.

Docusaurus is a site generator designed to make your life easier. You don't have to worry about boring stuff like infrastructure and design details. All you have to do is to provide documentation written in Markdown, write a home page in React and tweak some configuration. After that, your documentation website is ready to launch.

Install Docusaurus

Docusaurus is easily initialised using a script. It will set up all of the infrastructure for you.

Ensure you have the latest Node and your favourite package manager (npm or yarn) installed. Then create a project, if none exists, and change your directory to this project's root.

Then all you have to do is to run the Docusaurus initialisation script.

$ npx docusaurus-init

After running the initialisation script you will have a runnable example website to use as your site's base.

To run the example:

In the root of your project, rename docs-examples-from-docusaurus to docs.

Change directory to the website folder.

Rename blog-examples-from-docusaurus to blog.

To start the local web-server run npm start from within the website folder.

You will now have the example site loaded in your web browser at http://localhost:3000.

Make it your own

Out of the box the example features some built-in React components to personalize the home/root page of your website. The primary color is specified in siteConfig.js and is reflected various places across the website.

You can customise your site with the config in website/siteConfig.js according to the comprehensive siteConfig documentation (pun intended). The documentation markdown files are added to the docs folder. Similarly, you can add your blog posts in the blog folder. sidebars.json is where you specify the layout and content of the sidebar for your documentation using the id of markdown files. You can also create custom pages for your site. This is easily done with React in the pages folder and with static assets (like CSS and images) in the static folder.

Meet Slash

Slash is the official mascot of Docusaurus, a reference to how one would start code documentation in most programming languages with /. The observant reader might spot multiple variations of her on the offical Docusaurus website. At Facebook, they have actual Slash plushies -- and rumors say that you could get one if you create a documentation page with Docusaurus.

Slash will not write your docs, that’s still on you, but she can make the process of doing so a lot less painful.

1-Dec

Today's posts

Celebrate a more secure Christmas this year

What's the deal with JavaScript, TC39 and ECMAScript?

Documentation with Docusaurus