quickjs VS mini_racer

You can use it as en embedded scripting language within Python.

[1] https://github.com/PetterS/quickjs

You could run the webextention javascript in quickjs.

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html

This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox.

its not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for example: https://github.com/amol-/dukpy

There's a QuickJS Python wrapper here which offers those limits: https://github.com/PetterS/quickjs

I'm pretty paranoid though any time it comes to security and dependencies written in C, so I'd love to see a Python wrapper around a JavaScript engine that has safe sandbox execution as a key goal plus an extensive track record to back it up!

Some years ago I was on a shitty job - not technically, but the company turned out to be inhumane - at a Ruby shop, and on the side I was toying with mini_racer and I just upgraded to some macOS beta where it failed to build. A shitty +1-1 hack† for a compiler flag later and it was back flying.

A month later I received a cold email from a CTO to chat a bit about that PR, turns out they were using mini_racer heavily and forked it for their own purpose, and also created PyMiniRacer for the Python side of things. Next thing I know I got hired. Two years later the company got acquired.

Of course conditionally adding a compiler flag wasn't what got me hired per se, it only got my profile noticed. Probably side projects such as porting go by example to Ruby by implementing a ~1:1 CSP channel API[1], an Electron desktop client for Mattermost basically on a dare[2], ex mode for the Atom editor so that I could have that frackin' `:w`[3], leveraging Blocks to bolt on object-oriented-ness onto C because "closures are a poor man's object"[4], or reverse-engineering the Xbox One USB gamepad and writing a kext to turn it into a HID device on macOS from scratch on a lonely 7+h train ride with passengers judgementally staring at me sideways[4] probably contributed to it a bit.

My takeaway: luck is when preparation meets opportunity; but don't to side projects to get hired, because if you don't get hired then that time is lost. Rather, of all things, scratch your itch, have fun, embrace whatever quirkiness you fancy; no one can take that away from you.

[0]: https://github.com/rubyjs/mini_racer/commit/2086db1bbf2b5de4...

[1]: https://github.com/lloeki/normandy

[2]: https://github.com/lloeki/matterfront

[3]: https://github.com/lloeki/ex-mode

[4]: https://github.com/lloeki/cblocks-clobj/blob/master/main.c

[5]: https://github.com/lloeki/xbox_one_controller

Cue libv8-node+mini_racer from which PyMiniRacer was born. It is non-trivial but not as hard as one might think.

The most painful part is the libv8 build system and Google tooling, which makes it an absolute PITA for libv8 consumers that are not Chrome.

This is why the libv8 gem was atrocious to keep up to date and to build for several platforms, and why libv8-node was born, because the node build system and source distribution are actually sane.

Disclaimer: worked at Sqreen, now maintainer of libv8-node and collaborator of mini_racer

https://github.com/sqreen/PyMiniRacer

https://github.com/rubyjs/mini_racer

https://github.com/rubyjs/libv8-node

Eventually, we’ll want to call this JavaScript from a Rails controller using ExecJS or MiniRacer or some similar tool. None of the Ruby-to-JavaScript gems I found were sophisticated enough to know how to load npm modules with common.js or ES module syntax, so my solution is to just build the JavaScript with a watcher and have that run as part of bin/dev.

https://github.com/rubyjs/mini_racer/issues/190 has some info an then this PR: https://github.com/rubyjs/mini_racer/pull/210 that has been merged. Hope that all helps!