All work and no play makes Jack a dull boy

Untrusted is a fun and quite different browser game. You play by modifying parts of the game's source code, in order to create a path from your characters position to the level goal. It starts out easy enough, on a map where only a single wall is blocking your path to victory. On the later stages, you'll probably have a harder time one-shotting your way through the maps (unless you're some sort of genius).

We promise it's a perfect time sink for lazy, December Sundays. Let us know on Twitter when (if) you get to the very end (#dotchristmas).

Happy playing!

JavaScript For Fun And Profit

Managing certificates, and rotating them in due time can quickly get out of hand.

As a follow-up to Tia Firings article on certificates we present an article on how to manage the certificates when they are issued.

Managing certificates and keys is a difficult task with many pitfalls. Without proper lifecycle management it will quickly scale to something that is unmanageable. An old saying is that If a certificate got issued, it will have to be rotated. Cisco has stated that they use on average more than four hours per certificate , just maintaining and rotating it. This is on top of the fact that manual management is more prone to human error, which in turn results in security and operational risk.

So why do we need to rotate certificates? Some of the reasons can be that the certificate is nearing its expiration date, or that the private key that signed the certificate has been compromised, and has to be revoked. Previous practices for revoking a certificate involved using a certificate revocation list (CRL) to hold a list of all revoked certificates. The nature of this list is to grow in size, and what do developers do when things grow? We cache them! So now users are making security decisions based on stale data.

There has been done attempts at fixing revocation. We have OCSP, OCSP Stapling, and OCSP must-staple. All of which are prone to MITM-attacks. If an attacker can block the OCSP lookup, the lookup will soft-fail, and a revoked certificate will be accepted.

As early as in 1998 elimination of certificate revocation was proposed. And if we absolutely must do revocation, we should use OCSP must-staple. But what is OCSP must-staple? In short terms: OCSP Stapling eliminates the need for the browser having to perform an OCSP request by piggybacking the OCSP response along with the certificate. The reason behind the name is the same as when the cashier staples the note from the payment terminal to the payment receipt. In the same way the server 'staples' the OCSP Response to the certificate.

OK, so we don't want to do revocation, it's complicated and prone to errors. What should we do insted? We should use short lived certificates. A short lived certificate is a certificate that has an expiration data of < 1 year. Because expiration is revocation in it self. So what is a short lived certificate? A certificate has an expiration date, the same way as the milk in your fridge has one. Today certificates live for years, but why should they? Often are certificate problems related to a mismatch between the certificate expiration date and the clients clock. Everyone knows that fresh milk tastes better!

The solution is to automate the certificate rotation of certificates, and with it, we get short lived certificates. Let's Encrypt supports automatic renewal, and their certificates are fairly short lived at 90 days.

Revoking of certificates

Today we’re going to talk a little bit about memoization. And no, that’s not a spelling error. And even better, is sounds a lot more complicated than it really is.

So, what is memoization? First, we need to be able to identify deterministic or pure functions as they are sometime referred to in the react world. Basically, what that means is that the function will, given the same input always return the same output. A simple example of this would be a function called add. Given 2 and 3 as input, it will always return 5 as shown below.

Example

Now, since the function always returns the same value given the same input, what we can do is cache or store the result and the next time the function is called with the same input parameters, return the stored result instead of actually executing the function. That is memoization!

This doesn’t make much sense though if the function is just adding two numbers, but if the function has some time-consuming logic, this can result in huge performance gains.

There are some things you need to keep in mind when using memoization. If the same function is called with called with lots of different input parameters, you risk ending up using a lot of memory since every result is stored. A workaround for this could be either removing results from memory after a certain time period or, in many cases, just storing the last result, like Reacts pure component.

In React

So how does this translate into the react world? If you use a react class component, you have the option of extending React.PureComponent instead of React.Component. If you do so, React will check the state and props and only re-render the component if they have changed, basically giving you a simplistic memoization function with limited history. If you use functional components however, react will call the function on every render.

Resources

As you now are an expert on memoization, you should be able to write your own memoization function or component for React. However, it is usually not a good idea to reinvent the wheel, so here are a few libraries, in no particular order, that can help you along.



memoize-one
This is a simple and very small library that, as mentioned earlier, only remembers the latest input parameters and result of a function. This means you don’t have to worry about memory issues etc.



react-memoize
This is a react library with a more advanced functionality that should cover most of your needs when using memoization in an React application.



Lodash
If all you need is a simple memoization function, keep in mind that lodash has one built in.



Moize
Moize is a very feature rich generic javascript library for memoization. It also has built in support for React.

Going forward

Reacts next big thing seems to be hooks, coming early year. The alpha version is already out and it contains two hooks intended for memoization, useCallback and useMemo.

If your using Redux and find this interesting I would also recommend you take a look at the reselect library which basically enables you to easily create computed state which both helps you reduce the amount of state you need to store and at the same time leverages the advantages of memoization for excellent performance.

9-Dec

Today's posts

JavaScript For Fun And Profit

Revoking of certificates

Introduction to memoization