asar

The idea of using SQLite to serve static content based solely on the "35% Faster Than The Filesystem" page from 2017 sounds half-baked, to say the least. Modern web servers like Nginx employ optimal strategies for handling static files, starting with sendfile and extending to io_uring and splice operations, all within well-designed thread pools based on epoll, kqueue, or eventport (whichever suits your needs). Meanwhile, the best SQLite can offer (at least natively) is its memory-mapped I/O support (https://www.sqlite.org/mmap.html). This might work well for single-client services, like locally hosted web apps (see also https://github.com/electron/asar). However, for large websites, as mentioned in other comments, it attempts to solve a problem that doesn't exist.

Since Hop doesn't do compression, the most appropriate comparison would be to asar https://github.com/electron/asar It's not hard being faster than zip if you are not compressing/uncompressing.

> Is it still possible to unpack the asar, rewrite the source, and repackage the asar? Yes, it is still possible — https://github.com/electron/asar

Here's the corresponding issue on Github: https://github.com/electron/asar/issues/123 As you can see from the issue, this exploit has been known for 2 years and probably longer than that. As I said (November 2018) in the linked issue, I believe it's only a matter of time before Skype/Slack/VSCode gets packaged up with malicious code and flies under the radar of SmartScreen and Gatekeeper. It probably won't be downloaded from the official websites but there are plenty of other ways of distributing the software. I get the feeling that the Electron team aren't taking it too seriously. I think this has the potential for a really dangerous exploit. My startup (ToDesktop[1]) uses Electron and I've put a huge effort into securing certificates on HSMs (Hardware Security Modules). But it's mostly a pointless exercise when a hacker can simply edit

Also of interest is the follow-on discussion [1] taking place on the electron/asar repo. [1] https://github.com/electron/asar/issues/123

> what language it was made in HTML + JavaScript + Electron Just download that archive, extract its content, and you will find the "goterminal" script that is basically an ASAR archive [1] with a copy of CEF [2] as the webview for the web application that they (for some unknown reason) decided to create. [1] https://github.com/electron/asar [2] https://bitbucket.org/chromiumembedded/cef

Cloning is as simple as "npm install asar && asar extract app.asar", modify what you want and "asar pack" again. So the packing system is really no protection in itself. See https://github.com/electron/asar