Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Looking at how many sites use vulnerable JavaScript libraries

snyk.io

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Looking at how many sites use vulnerable JavaScript libraries

#21

Post by Fnoord »

irrelative wrote: post #3

One might even say that 100% of 333,410 sites use vulnerable javascript libraries

The information "77% of 433,000" contains the sample size number (433k). "100% of 333,410" does not contain a sample size number. The lack of the sample size number makes the data (and title) less meaningful. I'd go as far saying it makes the data (and title) meaningless.

Re: Looking at how many sites use vulnerable JavaScript libraries

#23

Post by ben_jones »

megaman22 wrote: post #8

If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...

It's a liability thing. If you get hacked after "addressing" all the vulnerabilities, its not your fault - its the scan tool's fault. Utter bull shit, but hey.

Re: Looking at how many sites use vulnerable JavaScript libraries

#24

Post by wesleytodd »

guypod wrote: post #17
wesleytodd wrote: post #4

We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services. For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configuratio…

I think it's an absolute statement about the lack of awareness to this risk. Of course some of these site would not actually be vulnerable, but I would bet the vast majority of them don't even know they're using a library with a known vulnerability.

Agreed, but the tools (nsp) are there to make it simple to know. Devs who are not going to update/patch are not the target here, so making big claims like this does not strongly add to the conversation IMO.

Also, this is nothing new on the web, the amount of wordpress sites with known voulns is probably MUCH higher.

Re: Looking at how many sites use vulnerable JavaScript libraries

#25

Post by jbob2000 »

This means nothing unless they mention what the vulnerabilities are. We do security scans on our front-end javascript code as well; most of the hits we get are for "log injection". Meaning, we have a console.log somewhere and someone could fake our logs by overriding the output. Wow, such vulnerability!

Re: Looking at how many sites use vulnerable JavaScript libraries

#26

Post by JasonFruit »

Is it better for a website to roll its own insecurity? I'd a lot rather people use libraries with significant adoption — hopefully being aware of and avoiding any security problems they may include — than write their own version where the security problems will never be exposed, at least for good.

Re: Looking at how many sites use vulnerable JavaScript libraries

#28

Post by thefreeman »

oneweekwonder wrote: post #15
bastawhiz wrote: post #9

Earlier quoted context omitted.

An XSS issue could make your users' data vulnerable.

But cors[0] headers can mitigate some of the risk? [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.

Re: Looking at how many sites use vulnerable JavaScript libraries

#29

Post by qaq »

wesleytodd wrote: post #4

We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services. For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configuratio…

"viable" is a function of how interesting your production services are to a capable adversary.
Post reply on HN