menduz

In-Application Sandboxing with Web Workers

A design rationale.

For the past fews years, the Web has been shifting control to the client. Given the limitations of remote services, developers are now looking for ways to "unhost" static applications – that is, break the dependency on remote servers while still using the Web platform.

One untapped technology for client-side control is the Web Worker Sandbox. This API lets the Page load, execute, and destroy separate Worker threads which use their own Virtual Machines. By using Worker Sandboxes to drive behavior, the Web can give users the choice of which software they run together, shifting development from a centralized SaaS model into a distributed and free (as in freedom) script-sharing model.

Worker Sandboxes can Execute Arbitrary Code

menduz

ab -n 1000 -c 100 http://localhost:9615/

menduz

["-99,-29","-94,-29","-93,-29","-90,-29","-89,-29","-87,-29","-51,-29","-150,62","-150,61","-150,33","-150,27","-150,0","-150,-20","-50,-29","0,-29","1,-29","15,-29","16,-29","17,-29","18,-29","20,-29","21,-29","-149,-20","22,-29","23,-29","24,-29","25,-29","26,-29","27,-29","28,-29","29,-29","30,-29","33,-29","41,-29","50,-29","51,-29","150,-29","-87,-30","-51,-30","-50,-30","0,-30","1,-30","27,-30","-149,62","-149,61","-149,33","-149,27","-149,0","29,-30","30,-30","31,-30","32,-30","33,-30","34,-30","35,-30","36,-30","37,-30","38,-30","39,-30","40,-30","41,-30","42,-30","43,-30","44,-30","45,-30","46,-30","47,-30","48,-30","49,-30","-148,-70","-148,-74","-148,0","-148,-20","50,-30","51,-30","150,-30","19,-144","20,-144","21,-144","22,-144","72,-144","73,-144","150,-144","-13,-145","0,-145","1,-145","14,-145","-148,62","-148,61","-148,33","-148,27","-148,26","-148,25","-148,24","-147,-70","-87,-31","-51,-31","-50,-31","0,-31","1,-31","20,-31","21,-31","22,-31","23,-31","24,-31","25,-31","26,-31","-147,33","-

menduz

Keybase proof

I hereby claim:

• I am menduz on github.
• I am menduz (https://keybase.io/menduz) on keybase.
• I have a public key ASAaLUmgV8Es9SZ8DahB2-9FgfNOtqGo0hUr_dicrchZoQo

To claim this, I am signing this object:

menduz

// tslint:disable:ter-indent
import { ScriptableScene, createElement } from 'metaverse-api'

export default class SharkAnimation extends ScriptableScene {
  state = {
    bitestate: 0
  }

  async sceneDidMount() {
    this.eventSubscriber.on(`muhshark_click`, xxx => {

menduz

environment = {{}}
target = "lua"
function nil63(x)
  return(x == nil)
end
function is63(x)
  return(not nil63(x))
end
function no(x)
  return(nil63(x) or x == false)

menduz

gpg-connect-agent <<EOF
/hex
scd serialno
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40

menduz

const bb = require("./bytebuffer");
const fs = require("fs");

function loadBB(src) {
  return bb.wrap(fs.readFileSync(src));
}

function loadCabecera(bb) {
  bb.skip(255 + 4 + 4);
}

menduz

// This configuration is passed when we create a new peer connection object.
// It provides a set of servers used to establish a connection. STUN servers
// are used to discover our external IP address, and TURN servers (none listed
// here) are used to proxy a connection when a peer is behind a restrictive
// firewall that prevents a direct connection.
var peerConnectionConfig = {
  iceServers: [
    { urls: "stun:stun.l.google.com:19302" },
    { urls: "stun:stun1.l.google.com:19302" },
    { urls: "stun:stun2.l.google.com:19302" },

menduz

export enum NatType {
  Other = 0,
  SymmetricNAT = 1,
  NoNAT = -1 // No NAT (Open Internet, Blocked, Symmetric UDP Firewall)
}

export async function detectNat(): Promise<NatType> {
  const candidates = new Map<number, number[]>();
  const pc = new RTCPeerConnection(peerConnectionConfig);