Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repair demo console and challenge pages #590

Merged
merged 8 commits into from
Mar 1, 2021
Merged

Conversation

erights
Copy link
Contributor

@erights erights commented Feb 28, 2021

The old demo console and challenge pages were nice simple demonstrations of using SES in a browser. The challenge page in particular was rhetorically powerful to explain how ocaps can help defend against side channels. It is pleasing how little needed to change to update this to work in modern SES.

Fixes #203
Will help diagnose #525

@erights erights self-assigned this Feb 28, 2021
@erights erights marked this pull request as ready for review February 28, 2021 05:31
@erights
Copy link
Contributor Author

erights commented Feb 28, 2021

With rawgit gone, what's the best way to turn this into a live web page?

@kriskowal
Copy link
Member

With rawgit gone, what's the best way to turn this into a live web page?

I’ve set up an account for Agoric on Vercel, which I’ve enjoyed as a Github pages alternative in general. Vercel sets itself up for continuous deployment, so every PR would have a link to the demo as deployed off the PR branch that we could use for manual and automated validation.

https://vercel.com/agoric

I’ve kicked off the process.

@erights
Copy link
Contributor Author

erights commented Mar 1, 2021

With rawgit gone, what's the best way to turn this into a live web page?

I’ve set up an account for Agoric on Vercel, which I’ve enjoyed as a Github pages alternative in general. Vercel sets itself up for continuous deployment, so every PR would have a link to the demo as deployed off the PR branch that we could use for manual and automated validation.

https://vercel.com/agoric

I’ve kicked off the process.

Why does it need "write access to administration, ..." ? I am reluctant to grant that if there is another way.

Screen Shot 2021-02-28 at 6 08 33 PM

@kriskowal
Copy link
Member

kriskowal commented Mar 1, 2021 via email

@erights
Copy link
Contributor Author

erights commented Mar 1, 2021

Please do. What are other good options?

@kriskowal
Copy link
Member

kriskowal commented Mar 1, 2021 via email

@dckc
Copy link
Contributor

dckc commented Mar 1, 2021

I'm not quite sure what we're trying to do, but if it's to have a static web site that gets updated on push, I've had good luck with netlify.

Copy link
Contributor

@dckc dckc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I haven't studied the security properties of the challenge code before this change, I would be an expensive reviewer.

I see #203 in the icebox, so I'm going to leave this to others to review.

Copy link
Contributor

@warner warner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Yeah, this is a lot simpler now that we can just provide/withhold the real Date as an endowment.

@warner
Copy link
Contributor

warner commented Mar 1, 2021

For the deployment question.. hm. GitHub Pages could work, but would require some changes. You only get one Pages site per repo, and it kinda wants to live in the top of the repository, so we'd have to move this demo out of packages/ses/ and into a location that would be better used for a "what is the SES shim" docs tree. Plus GitHub Pages always go through a rendering step (Jekyll or similar), so we have to find a way to include the challenge scripts as raw files, which I think is possible but not trivial.

In the intersection between the tools that have been proposed, and the ones I have used, I think Heroku may be the easiest. We'd need a few files at the directory root that know where the HTML lives, and we'd need some sort of deployment script to auto-push to Heroku every time we push to trunk here. I don't have a lot of cycles to build that right now, though, so if someone else does (or if someone else knows some different tool well enough to implement it in their sleep), I'm not wedded to the Heroku option.

@dckc
Copy link
Contributor

dckc commented Mar 1, 2021

netlify took a couple minutes to set up: https://eager-turing-52622a.netlify.app/demos/console/
it can automatically do a preview build for each PR too... maybe only for new PRs starting now? I should be able to get a preview for this branch, though...

Copy link
Member

@michaelfig michaelfig left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just one case of baby vs. bathwater. Otherwise LGTM.

packages/ses/demos/challenge/main.js Show resolved Hide resolved
@dckc
Copy link
Contributor

dckc commented Mar 1, 2021

https://eager-turing-52622a.netlify.app/demos/ is now on this branch, sort of temporarily. But it should pick up changes to master going forward, and we should get previews of all PRs going forward.

Obviously, if we like this service, we'll want a nicer domain name. I can change to *.netlify.app for the price of one form submit, or we can add a custom domain.

@dckc
Copy link
Contributor

dckc commented Mar 1, 2021

netlify wants/needs only:

  • Read access to code and metadata
  • Read and write access to checks, commit statuses, and pull requests

The write access is to make links from PRs to deploy previews. It doesn't get write access to the code.

Screenshot at 2021-03-01 13-07-53

packages/ses/demos/challenge/main.js Outdated Show resolved Hide resolved
@erights erights enabled auto-merge (squash) March 1, 2021 22:46
@erights erights merged commit e70171c into master Mar 1, 2021
@erights erights deleted the markm-repair-demo-console branch March 1, 2021 22:48
@kriskowal
Copy link
Member

Netlify looks good to me! Let’s carve out a domain.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Reconnect the challenge demo
5 participants