Status of code

[zuliandres]

Hey Ryan! I was looking for some implementations for hashcash with JS and PHP. Yours is kind of what I was looking for but it's 8 years old. I was wondering what changes you would make to it to make it more current? It also seems like the code is not complete, like there are trails of tests and debugging...
Or if you have suggestions of other implementations that might be more current?

[007]

Let me start by saying this is terrible code.

The good news is that it's terrible mostly because it's 8 years old. Fundamentally it's not that bad, it just needs some a lot of love. You'd do better to start with something more recent / complete, but if you want to roll your own here's where to start.

I haven't looked at any of these extensively, so YMMV. The OG hashcash page has a version for WordPress, that's probably a safe bet if that's what you're looking for. TheFox/hashcash looks decent for the PHP side. It requires a DB and doesn't include the JS side since it's aiming for email hashcash compatibility. University of Rhode Island has a full implementation, but I haven't seen the code since it's a zip vs a repo.

The most obvious improvement you've already noted: cleaning it up to not-toy-code state. After that, the things I would look at are:

• Make it easier to use. Right now you have to manually hook it up everywhere you want to use it, it would be much better to have a single JS include that hooks itself up to all forms on a page, or to all forms with some attribute defined. That's the biggest bang-for-buck improvement.
• Switch to TOTP for the salt calculation. That still won't require a DB, and makes the code a lot more secure than the arbitrary scheme it uses now.
• Use a proper hash. Modern browsers are a ton faster and there are good hash implementations all over, that should be swapped out in place of the current "hash" function.
• Write it in modern PHP and JS. This was before I knew OOP in PHP, and before namespaces existed. It's also before modern JS, and modern JS standards. Yet another reminder that the existing code is REALLY BAD.

If you'd like to poke at this code feel free. I can add a license if you need to use it for business purposes, but I'd recommend against doing so until most / all of the above improvements are done.