51–60 of 65 posts
The 'we fixed it' link points to four new lines including these: .replace(/>/g, '<') .replace(/ I can't really tell without more background and context, but I'm surprised this doesn't turn > into > and < into <. Is this a mistake? The same code's still in the HEAD.
.replace(/>/g, '>')
.replace(/The 'we fixed it' link points to four new lines including these: .replace(/>/g, '<') .replace(/ I can't really tell without more background and context, but I'm surprised this doesn't turn > into > and < into <. Is this a mistake? The same code's still in the HEAD.
Yeah, that is very weird. Shouldn't it this? .replace(/>/g, '>') .replace(/
> * We fixed it on February 17th
the fix scares the shit out of me:
https://github.com/isaacs/st/commit/5a0c1886737a20d78ae00b61...
Properly escape all relevant html entities
Avoid problems with files named things like '' and so on.
- var name = f.replace(/"/g, '"')
+ var name = f
+ .replace(/"/g, '"')
+ .replace(/>/g, '<')
+ .replace(/Earlier quoted context omitted.
Thomas could give you better numbers here, but in general, appsec reviews cost as much as getting software development done. (i.e. For a security review worth the paper you print the report on, you're looking at $5k at the lower end if your application is simple or if someone wants to really do you a favor, and they get substantially more expensive than that. You can get someone to run an automated scan for $500 and…
A $4k billable week is incredibly cheap, so much so that I'd worry about the team delivering it. Our rates are high because big firms bid them up. Why are the cheap teams turning down free money? If someone offers you a $4k week, make sure they know they're cutting you a deal.
Hi, i double that. Also I understood your advice better now. Undercharging = making it worse for everyone (consultant profit, work quality, dumping).
can anybody disclose some figures on how much ^lift (or competitors) costs, e.g.: for a 100K-line Python codebase? A rough ballpark would help a lot.
1) app-agnostic bugs, such as XSS/CSRF and other blatant issues
2) app-specific bugs such as access bypass, goto-fails, other obvious bugs like eval(params[:serialized]), security measures switched off, mass assignment :)
3) complex bug chains. Usually I end up with account hijacking or similar severity bugs by chaining few of unrelated and barely exploitable bugs, such as redirects, cookie encodings etc. This requires at least a week (which is $12k if you work with me).
4) infinity. Checking some unpopular ruby gems project uses. Checking popular ones. Checking rails codebase to be sure methods don't have "magic" arguments. Nobody goes that far usually, because attackers will have to do 2-4x more work to get same bugs you may find.
TL;DR, for quick & budget auditing a website like npm $3,200 and one day of work is enough, for any medium sized website people should take 1+ week.
Great job guys and very responsible choices.
Earlier quoted context omitted.
A $4k billable week is incredibly cheap, so much so that I'd worry about the team delivering it. Our rates are high because big firms bid them up. Why are the cheap teams turning down free money? If someone offers you a $4k week, make sure they know they're cutting you a deal.
> Why are the cheap teams turning down free money? Hi, i double that. Also I understood your advice better now. Undercharging = making it worse for everyone (consultant profit, work quality, dumping).
> * Before they could start, we had a very serious security vulnerability responsibly disclosed by Will Farrington and Charlie Somerville > * We fixed it on February 17th the fix scares the shit out of me: https://github.com/isaacs/st/commit/5a0c1886737a20d78ae00b61... Properly escape all relevant html entities Avoid problems with files named things like ' ' and so on. - var name = f.replace(/"/g, '"') + var nam…
Jesus tapdancing christ that is seriously scary to see in something that's allegedly "all totally secure now, for really reals". More so the fact that such simple sanitization was missing for so long.
Well, I guess I'll put off learning node a bit longer then.
Why do they have to apologize for that? Almost every piece of software has security vulnerabilities. Do people now really believe that there are definitely no security vulnerabilities related to the npm registry? Or any other type of registry, or website or application for that matter? People have completely unrealistic expectations about security. Every time you had a significant amount of new functionality, or even…
There are the inevitable almost impossible to fully plan for security vulnerabilities (e.g. in code outside your control) and then there are vulnerabilities due to extremely poor process at a fundamental level (like sql and html injection).
The world would be a little better if every software company could inform its users of security vulnerabilities and bugs as these guys did.