Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Frequency of Known Vulnerabilities in JavaScript

snyk.io

Post reply on HN
Print view View original

11–20 of 58 posts

Re: The Frequency of Known Vulnerabilities in JavaScript

#11

Post by guypod »

ghiculescu wrote: post #3

In ruby land, there's a great gem - https://github.com/rubysec/bundler-audit - that lets you know when specific gem versions have a known security vulnerability. We run it as part of our CI. When a vulnerability drops, it gets fixed pretty quickly since otherwise everyone's build fails. Does anyone know of any equivalents for the JS world? A quick google finds https://github.com/nodesecurity/nsp but keen to hear what…

Rubysec is awesome but outdated, lacks many of the vulnerabilities in https://Snyk.io/

Also, Snyk covers JS issues, both Nodd and client side

Re: The Frequency of Known Vulnerabilities in JavaScript

#13

Post by godmodus »

kleiba wrote: post #12

Is "vuln" a word now? (Non-native speaker here, actually interested, not trying to troll.)

been a "word" since forever mate, i even remember using it in the 90s. and it's alright, you might just be young or haven't forayed much into the deeper corners of the web where 'vulns' get discussed.

Re: The Frequency of Known Vulnerabilities in JavaScript

#16

Post by narsil »

ghiculescu wrote: post #3

In ruby land, there's a great gem - https://github.com/rubysec/bundler-audit - that lets you know when specific gem versions have a known security vulnerability. We run it as part of our CI. When a vulnerability drops, it gets fixed pretty quickly since otherwise everyone's build fails. Does anyone know of any equivalents for the JS world? A quick google finds https://github.com/nodesecurity/nsp but keen to hear what…

Nice. Is there an equivalent for Python? A quick Google search doesn't seem to pull up anything obvious.

Re: The Frequency of Known Vulnerabilities in JavaScript

#19

Post by scandox »

I'd like to see some practical examples of exploited vulnerabilities in client side JS libraries. I always think of everything client side as happening in a context of total insecurity- in the sense that I make no assumptions of what the client will do in relation to the server.

Is this more about libraries that expose the client to attacks from code on other sites?

Perhaps I'm complacent about this but I often think of this as the responsibility of the browser...

Post reply on HN