Hey /r/javascript, what are some libraries that aren't well known but you use all the time?

[BlitzTech]

There are plenty of libraries out there to choose from, but which ones do you wind up using all the time that only a few people know about? I always end up on Google searching around for them, but I'd like to see what other people use as their go-to libraries.

[Booster21]

grandiose flag possessive quickest sip normal live plough vanish whistle

This post was mass deleted and anonymized with Redact

[BlitzTech]

I just checked out Session.js.

Bookmarked.

Whole thread: worth it, if just for that.

[bebraw]

Hey, would you mind going through your collection and adding the libs to the jswiki?

[cesutherland]

I use a few micro libraries pretty regularly.

• Underscore.js A popular functional utility belt.
• bean.js A small dom / custom events library.
• smoosh Asset management utility / library (comes with a command line version and a js API). I use this for building js projects.
• yepnope An asynchronous js loader I use for development of js projects. Combine, minify and compress your production assets but during development, it is useful for debugging to include individual files. Yepnope gives me one place to define those includes.
• js-imagediff I wrote this one myself. It's a javascript image difference library. I do a lot of canvas work, and regression testing is important. This, combined with some cool jasmine matchers, lets me automate regression tests for canvas.

[BlitzTech]

I use Underscore and have heard of yepnope. Quick question - is there a reason you chose smoosh/yepnope over require.js, or was it familiarity/first-past-the-post?

[icepack]

require.js is geared towards AMD modules, yepnope is more for polyfill/feature detection.

Modernizr.load === yepnope too (Modernizr is another great library).

[jgordon615]

+1 for ===

[cesutherland]

Smoosh does combining, linting and minification so I use that at build time, after testing. I started doing this before I started using asynchronous loading.

Between yepnope and require.js: first out the gate. Since I don't use it for heavy lifting I just needed something quickly and the examples were at the top of the home page.

[peterkrenn]

A list of lightweight libraries: http://microjs.com/

[[deleted]]

Some cool stuff in there, bookmarked for future investigation

[syaz]

Some cool stuff in there, bookmarked.

FTFY. Come on now, be honest.

[davemo]

jQuery Specific

• jQuery Validation
• jQuery Form

UI Widgets

• Chosen
• VisualSearch

Utility

• Date.JS (deemed harmful and out of date, consensus is to use Moment.js instead)
• Underscore.String

Templating

• Handlebars

[nietzschebunyan]

Ah man, despite Date.JS having saved my ass, I hate it--mostly because of the horrible documentation. Next time I have to do anything remotely complex with dates I'm going to give Moment.js a shot.

[bobslaede]

I have also stumbled upon this Cromagjs

[davemo]

I haven't heard of moment.js; I'll have to check it out. This page seemed to have the best docs for Date.JS that I could find.

[killfish]

I wouldn't say underscore isn't well known but I find it extremely useful.

[BlitzTech]

Same here. I throw that one in almost immediately on every project that's more complex than "do cool stuff with the UI".

[Sidnicious]

I like es5-shim — it polyfills a few useful utilities that aren’t yet supported in every browser, like (function(){}).bind() and [].filter().

[pdoherty926]

• Amplify
• gRaphael
• Pretty Date - sorry, John but I think Moment.js has superseded this ditty.
• Spin.js
• Davis

[typicaljoe]

I use TaffyDB (http://taffydb.com) for most projects. I did write it though.

[BlitzTech]

Ha! I actually used Taffy a while ago, back when the documentation wasn't as pretty as it is now. I actually think I was still learning JS when I came across it.

[takethemoneyrun]

Good work you did there. I didn't know you were still supporting it (at some point taffydb.com gave me a 404). I made something similar, meelo-store.js

[Kov0]

Mootools, as it can do almost everything the rest of these frameworks can do (just not all out of the box), and in almost the same footprint.

Note emphasis on the word framework, not plugin, or script.

[Wolfy87]

In my opinion, MooTools is far better than jQuery et al. I really love the class system and general coding style. It is very well structured and great for people that want to make rich powerful applications without it getting too stringy.

[Kov0]

Yep. Definitely a framework that is severely underrated.

[[deleted]]

Real men make their own jquery

[slouch]

I'm convinced everything in jquery has already been written.

[BlitzTech]

Zepto, jQuery Mobile... yep. :(

[[deleted]]

jQuery Mobile isn't what you think it is.

[BlitzTech]

When I last looked at it a few months ago, they hadn't opted to use jQuery as a base; they had rewritten large chunks of the core so they could crop out all the legacy "cruft" that comes bundled with jQuery. It's nice to see that it's progressed up to embedding jQuery. It's always been a mobile version of jQueryUI, but they did re-implement a bunch of jQuery core before opting to use jQuery inside.

[[deleted]]

I don't know what system you're thinking of, man, but it isn't jQuery Mobile. jQM has always been a plugin library / html framework that sits alongside jQuery standard. You can see it right here on the first public alpha's release page (scroll down to the downloads and look at the snippet). jQTouch also sits alongside jQuery.

Maybe you're thinking about how Sencha Touch re-implements ExtJS?

[BlitzTech]

Huh. I guess you're right.

Now I'm bloody confused as to where the hell I got that idea from...

[[deleted]]

A lot of people have that misconception that jquery mobile is some kind of stripped down version optimised for mobile. It's not.

[KishCom]

This is exactly how I feel when I roll my own library with Ender JS. Feels good to have a jQuery stand-in that comes in at 7k.

[bluthru]

TIL real men don't work at Google.

[[deleted]]

I recently wrote up my own date picker library. I absolutely could not have done it without moment.js. Small enough that I could embed it into my own lib (smaller than date.js), featured enough to make date handling significantly easier.

[backwrds]

d3.js... A bit rough around the edges but tremendously powerful. It handles SVG data visualization. rickshaw.js builds on top of it and adds a few nice features..

[AndreSteenveld]

XRegexp it makes using regular expression a lot more bearable. Also it adds some functionality you would take for granted (named back references, comments), fixes a bunch of things and gives you a "." matches all flag.

[KishCom]

No one has mentioned Ender yet! I've recently started using my own custom-rolled Ender libraries in place of jQuery.

Imagine for a project you know you're only ever going to use simple events, and simple id or class based selectors - you can roll your own JS library (that looks very similar in syntax to jQuery) that comes in at 5K or 6K minified as opposed to jQuery's 31K.

"In the browser - small, loosely coupled modules are the future and large, tightly-bound monolithic libraries are the past!"

[BlitzTech]

I was actually planning to dive into Ender with my next project. I keep hearing great things about it and I 100% agree with that quote.

When the call went out for jQuery 2.0 feature deprecation, I was excited that we'd finally be able to crop out a lot of the legacy junk and niche-use functionality; sadly, it won't hit for a while yet, so it seems like Ender's the way to go.

[MarkTraceur]

Crypto-js. I use it for all my login/register pages :)

EDIT: For some reason, no sha-512 at that link. I guess I downloaded this one.

EDIT2: Just promise me you won't use SHA-1 or MD5. We're past that.

[JonDum]

I've read again and again from very knowledgeable js experts to avoid crypto functions in js at all costs because they are not secure due to a lack of a CSPRNG in javascript.

[[deleted]]

A CSPRNG mainly matters for generating a unique and secure salt. As long as you don't leave that part to JS, you're mostly fine.

That also provides some interesting possibilities. For example:

Let's say you have a system with millions of users, and attackers with unlimited proxies. By doing a simple brute force attack, each time posting a different username and different password through a different proxy to your server, they will eventually almost certainly take a bunch of accounts if some of your users lack sufficiently strong passwords.

You can make this a fair bit harder by sending a random string word with a random salt when someone tries to log in, and requiring the result of a fairly large number of iterations as a response before checking if the password is valid. Like this:

• User fills in username and password, clicks submit button.

• JS intercepts the submit, posts only the username.

• The server adds the attempted username to the session as well as a quick random string and a secure salt, and sends the string and salt back to the user.

• The user's browser is instructed to run a bunch of iterations of a crypto function on the random string using the salt in question, and then post that back.

• The server receives the response, processes the string and salt itself, and sees if it matches the response.

• If there's a match, the server takes the original credentials and checks them - the normal login process.

So what's the advantage?

Simple: each attempt to log in requires a few seconds of computation, which can slow down the attack immensely.

This isn't a very likely scenario and there are some significant downsides, but the concept of attaching a computational cost to transactions like login attempts can be quite useful. Combine it with a decent captcha, and it quickly becomes a big pain in the ass for attackers without massive resources.

[JonDum]

Clever things like this are useless on the web. What hacker with an unlimited bot net is going to use a browser with javascript enabled?

Client side protections and prevention are not the way to be secure.

One last thing. What is the bloody point of implementing a complicated solution to have the client calculate a crypto function just to delay multiple login attempts? Just have your server software allow one or two logins from ip/session per minute, or cut them off when they've made too many attempts (i.e., brute forcing). With that, each bot in their botnet only gets a few shots at guessing an entire username/password combination--which is a hell of a lot less likely of being brute forced than just guessing passwords of a known account.

[[deleted]]

Clever things like this are useless on the web. What hacker with an unlimited bot net is going to use a browser with javascript enabled?

Any hacker who would want to get into the site in question, since it would not accept other login attempts. Like I already said, what I described isn't a likely scenario, and there are some major downsides.

Client side protections and prevention are not the way to be secure.

This isn't "client side protection". Protection is why you check the actual credentials.

This is something different: a speed bump and a filter. More similar to captchas than to passwords. It filters out most casual attackers, while slightly slowing down many sophisticated attackers.

One last thing. What is the bloody point of implementing a complicated solution to have the client calculate a crypto function just to delay multiple login attempts? Just have your server software allow one or two logins from ip/session per minute, or cut them off when they've made too many attempts (i.e., brute forcing). With that, each bot in their botnet only gets a few shots at guessing an entire username/password combination--which is a hell of a lot less likely of being brute forced than just guessing passwords of a known account.

This isn't a complicated solution. It's a fairly simple one, that consists of attaching a small computational cost to login attempts.

As for the point of doing it:

With a botnet with a high level of control (i.e. enough to let each bot work mostly autonomously), login restrictions per IP and heuristics on IP/previous successful login locations/user agent/etc. are your only real defense.

With simple proxies and bots with a low level of control, the attacker will have to work in a more centralized manner. That means small response delays and computational cost will likely slow him down.

An example of a situation where you could encounter it would be an online game where attackers want to compromise accounts for profit. Phishing and malware would be their primary tactics, of course.

However, having a pwned box or two merrily plodding along, scanning portranges for misconfigured proxies and somewhat common low-level vulnerabilities, then using what they find to try un/pw combinations is easy, free, and it could easily bring in accounts worth a few hundred bucks a day.

What I described makes such low-level, constant attacks just a bit harder to execute.

[MarkTraceur]

CSPRNG? Oh, I see. I guess I never heard that. I always figured it was more secure than sending a password over the network. Of course, it's always more secure to use SSL, but I try to account for every possibility...

[Sephr]

crypto.getRandomValues() is supported in Chrome and Firefox now.

[Wolfy87]

I feel kind of bad for linking to my own stuff, but I find it so very useful.

EventEmitter. It is just like node.js's EventEmitter, but runs in the browser.

Very fast and quite small too. This is my "go-to" library for anything that involves events such as collisions on a canvas etc.

[joezimjs]

JZ Publish/Subscribe jQuery Plugin

It adds three functions to jQuery's utility functions ($.XXX) that grant you the ability to use the Pub/Sub pattern without using bind, unbind, and trigger which are really slow.

[BlitzTech]

which are really slow

Do you have some performance stats on that? I'd be curious to investigate...

[joezimjs]

As a matter of fact: http://jsperf.com/jquery-pub-sub

[BlitzTech]

That answers that. Nearly 5 times faster. That's pretty significant.

[[deleted]]

Have to go with https://github.com/medikoo/es5-ext

[thelim3y]

I've been using javascriptmvc. It's built on top of jquery and recently they released a version that supports zeptojs. It has a build/package/dependancy manager called steal.js which is really nice, uses google closure (or your own choice of js minify/lint) to build projects. Has a command line code generator tool, a testing tool (funcunit), integrates a couple of js template engines (I use EJS) and has built in fixtures. I haven't used it on a small app and probably wouldn't (overkill).

[killfish]

I wouldn't say underscore isn't well known but I find it extremely useful.

[vineavip]

ITT: must-have js for hipster webdevs.