Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
YouTube Security VideosBuilding AMD Helios: Testing and Validating Rackscale AI Solutions(24.09.2026 um 17:30 Uhr)
•
Podcasts & Audio Briefings9to5Google: The Googlebook could do something insane.(24.09.2026 um 17:30 Uhr)
•
YouTube Security VideosBack to School Raspberry Pi Quiz! #bermonths #quiz #raspberrypi(24.09.2026 um 17:24 Uhr)
•
YouTube Security VideosPC-WELT: Endlich hat die 2. RTX 5090 Sinn - lokale KI auf HMX 6!(24.09.2026 um 17:30 Uhr)
••
Windows Tipps & SecurityuBlock Origin broke on Edge, so I finally quit the browser(24.09.2026 um 17:24 Uhr)
•
Windows Tipps & SecurityHMX 6: Wir müssen reden(24.09.2026 um 17:30 Uhr)
•
Windows Tipps & SecurityWinamp Community Update Project(24.09.2026 um 16:40 Uhr)
•••
YouTube Security VideosBuilding AMD Helios: Testing and Validating Rackscale AI Solutions(24.09.2026 um 17:30 Uhr)
•
Podcasts & Audio Briefings9to5Google: The Googlebook could do something insane.(24.09.2026 um 17:30 Uhr)
•
YouTube Security VideosBack to School Raspberry Pi Quiz! #bermonths #quiz #raspberrypi(24.09.2026 um 17:24 Uhr)
•
YouTube Security VideosPC-WELT: Endlich hat die 2. RTX 5090 Sinn - lokale KI auf HMX 6!(24.09.2026 um 17:30 Uhr)
••
Windows Tipps & SecurityuBlock Origin broke on Edge, so I finally quit the browser(24.09.2026 um 17:24 Uhr)
•
Windows Tipps & SecurityHMX 6: Wir müssen reden(24.09.2026 um 17:30 Uhr)
•
Windows Tipps & SecurityWinamp Community Update Project(24.09.2026 um 16:40 Uhr)
•••
Intelligence View
⚡ tsecurity.de Intelligence

Why `new Date(garbage) === "Invalid Date"` is always false (a timestamp converter taught me this the hard way)

I built a small Unix timestamp converter — paste in seconds or milliseconds, get a date back, or go the other way. Simple enough that I figured the only real work would be the date math. Then I went to add "tell the user when they typed g…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I built a small Unix timestamp converter — paste in seconds or milliseconds, get a date back, or go the other way. Simple enough that I figured the only real work would be the date math. Then I went to add "tell the user when they typed garbage" and ran straight into a JavaScript gotcha that's been quietly living in more codebases than anyone wants to admit.






The unit dropdown is secretly a multiplier, not a branch



The converter has a unit selector next to the input — "Seconds" or "Milliseconds." The tempting way to wire that up is an if/else: if seconds, do this math; if milliseconds, do that math. That's not what's in the actual component. The <a-select> options are bound directly to the numbers 1 and 1000, and those numbers get used as literal arithmetic operands everywhere downstream:




const unixToNoraml_getOutput = () => {
let unix = data.unixToNoraml.unix;
let unit = data.unixToNoraml.unit; // 1 or 1000
let output = new Date(Math.floor((unix * 1000) / unit));
data.unixToNoraml.output = output;
};






If unit is 1 (seconds), that's unix * 1000 / 1 — converts seconds to the milliseconds Date wants. If unit is 1000 (milliseconds), it's unix * 1000 / 1000, which cancels out and leaves the value untouched, because it was already in milliseconds. Same one-liner handles both cases with no conditional at all.



The reverse direction does the same trick in reverse — compute the answer in seconds, then multiply by the unit to get either seconds or milliseconds back out:




const normalToUnixOutputFormat = computed(() => {
if (!data.normalToUnix.output) return "";
return data.normalToUnix.output * data.normalToUnix.unit;
});






It's a small thing, but reusing the dropdown's raw value as a multiplier instead of introducing a "seconds" | "milliseconds" enum saved a branch in four separate places in the component.






The validation check that doesn't actually validate anything



Here's the one that got me. When you type a date string into the "normal time" field and hit convert, the code tries to reject bad input before doing math on it:




if (new Date(normal) === "Invalid Date") {
return Swal.fire({
title: t("timestamp.error"),
icon: "warning",
confirmButtonColor: "#1890ff",
});
}
let output = new Date(normal).getTime() / 1000;






new Date("not a real date") doesn't throw and doesn't return the string "Invalid Date" — it returns an actual Date object whose internal time value is NaN. Calling .toString() on that object prints "Invalid Date", but the object itself is never, ever === to a string, no matter what garbage you feed it. So that guard clause is dead code. It will never fire, for any input, ever.



What actually keeps the tool from displaying literal "NaN" to the user is something else entirely, three lines away in a computed property:




const normalToUnixOutputFormat = computed(() => {
if (!data.normalToUnix.output) return "";
return data.normalToUnix.output * data.normalToUnix.unit;
});






NaN / 1000 is still NaN, and !NaN evaluates to true in JavaScript — so the falsy check blanks the output field instead of the intended validation ever running. The tool behaves correctly, but by accident: the real safety net is a coincidental side effect of how NaN interacts with !, not the Swal.fire() warning dialog that was written to handle exactly this case. The correct check would be isNaN(new Date(normal).getTime()), but that's not what's in the file.






The live clock ticks in your local time, not UTC



The page also has a running "current timestamp" display that updates once a second, with pause/continue buttons:




const init_clock = () => {
if (data.timer) return;
data.timer = setInterval(() => {
let now = new Date();
data.currentUnix = Math.round(now.getTime() / 1000);
data.currentLocalString = DateTime.fromSeconds(data.currentUnix).toFormat(
"yyyy/MM/dd HH:mm:ss",
);
}, 1000);
};
const pause_clock = () => {
clearInterval(data.timer);
data.timer = null;
};






Two things worth calling out. First, setInterval(..., 1000) doesn't guarantee a tick every exact second — it just re-reads Date.now() and rounds each time it fires, so under heavy main-thread load a tick can land late; the displayed number just catches up rather than drifting permanently. Second, DateTime.fromSeconds() from Luxon defaults to the local system time zone when you don't pass one — so the human-readable clock next to the raw Unix number is your machine's local time, not UTC, even though a Unix timestamp is by definition timezone-independent. There's no UTC toggle for it. If you're in Tokyo and I'm in Berlin, we see the same integer but a different clock face next to it.






Limitations, honestly





  • No digit-count auto-detection. I assumed a paste-in converter like this would sniff "10 digits, must be seconds" vs "13 digits, must be milliseconds." It doesn't — the unit is a manual dropdown. Paste a 13-digit millisecond value while "Seconds" is still selected and you silently get a date several thousand years in the future. No warning, no clamp.


  • Everything renders in local time. The seconds-since-epoch value is timezone-agnostic by definition, but every human-readable output on the page — the live clock, the converted date — is displayed in whatever timezone the browser is set to, with no UTC option. If you're debugging a server log recorded in UTC, you have to do the offset math yourself.


  • The "type a date manually" field parses whatever new Date(string) accepts, which is a browser-implementation detail, not a fully spec'd format. It works fine for the YYYY/MM/DD HH:MM:SS shape the placeholder suggests, but it's not the same guarantee you'd get from an explicit parser.


  • The Invalid Date check discussed above never runs. It's harmless here because NaN's falsiness happens to save it, but it means the warning dialog telling you "please enter a valid time" is unreachable code.



I turned the cleaned-up version into a small free tool: Unix Timestamp Converter. No sign-up, works entirely in the browser.









Available in other languages



CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
title: Detect Exploitation - Why `new Date(garbage) === "Invalid Date"` is always false (a timestamp converter taught me this the hard way)
id: eed681a3-bf0c-49eb-8130-791cb1e52b51
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Why `new Date(garbage) === \"In" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Why `new Date(garbage) === &quot;Invalid Date.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-79764 | Termix is a web-based server management platform with SSH terminal, tunn…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle