Friday JavaScript & Web Dev Links

I'm summing up some reading tips for JavaScript and web development. Just thought you'd like 'em.

JavaScript

Command-Line JavaScript on Rhino
So you want to write command-line JavaScript on Rhino? Here's how you do it on Mac OS:

1. Download Rhino 1.7R2: http://www.mozilla.org/rhino/download.html
2. Unzip Rhino in for instance Applications/Utilities/Java
3. Download JLine: http://jline.sourceforge.net/
4. Unzip JLine in for instance Applications/Utilities/Java
5. Move jline-0.9.94.jar to /Library/Java/Extensions
6. In a shell: cd /Applications/Utilities/Java/rhino_1_7R2
7. In the very same shell: java org.mozilla.javascript.tools.shell.Main

Code away!

Building Large-Scale jQuery Applications

A good read on RIA architecture and links to lib and framework choices, not only for jQuery junkies:

http://addyosmani.com/blog/large-scale-jquery

JavaScript Primitive Types Becoming Objects

About JavaScript's primitive types and how they become objects when their properties are used:

http://javascriptweblog.wordpress.com/2010/09/27/the-secret-life-of-javascript-primitives

Scoping and Hoisting in JavaScript

If you haven't looked into scoping and variable assignments in JavaScript, read this and improve your programs:

http://www.adequatelygood.com/2010/2/JavaScript-Scoping-and-Hoisting

'String'.replace() Only Replaces First Instance

String.prototype.replace, i.e. 'yourString'.replace(), only replaces the first instance of the regexp. So beware. Twitter made the mistake and got vulnerable because of it. Read about it and a suggested patch:

http://www.thespanner.co.uk/2010/09/27/string-replace-javascript-bad-design

Non-Blocking JavaScript Loading (and more) With head.js

With Head JS your scripts load like images - completely separated from page rendering, and in parallel!

http://headjs.com

Web Development

RESTful Design, Patterns and Anti-Patterns

A nice webcast on REST design. For instance brings up the idea of session ids with constant state on the server. But as always, I wonder when the CSRF storm is going to hit all these REST services out there?

http://www.parleys.com/parleysserver/indexing/presentation.form?id=1397

Chrome Web Dev Extensions

Google Chrome is becoming many web developers' favorite browser. The bundled developer tools are good. But check out the extensions too, for instance the CSS reloader:

https://chrome.google.com/extensions/featured/web_dev

iframe Loading Techniques and How They Affect Performance

Want your iframes to stop blocking and allow onLoad to fire earlier? Check these techniques out:

http://www.aaronpeters.nl/blog/iframe-loading-techniques-performance


Did I miss a good resource or read? Just fire away below.

Countdown Challenge for OWASP Summit

The official OWASP Summit Challenge is out – a JavaScript fighting arena where your script should show its name more prominently than its competitors. The first round attracted 8 contestants and "dross" scored the first point. Check out all the scripts and the next round of competition: http://makeXORbreak.com

The challenge starts the countdown to one of the most important meetings in application security history. February 8-11 we invite you all to join round-table discussions with industry and research leaders on how to solve XSS and enhance browser security, which appsec metrics work, security of HTML5 and EcmaScript 5 and more. We truly believe that crucial things can happen in a social, productivity-oriented environment. That's why OWASP is going all-in on the Summit.

Google will be there. Mozilla will be there. Microsoft will be there. Facebook will be there. PayPal will be there. Apache will be there. The world's top appsec companies will be there. The authors of (my) favorite appsec books will be there.

OWASP Summit 2011

Best thing of all? You are most welcome to join!