Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Looking at how many sites use vulnerable JavaScript libraries

snyk.io

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Looking at how many sites use vulnerable JavaScript libraries

#41

Post by rhizome »

Klathmon wrote: post #11
megaman22 wrote: post #8

If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...

I absolutely hate these kinds of "security" scans. I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high. I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "ma…

In this context it may have been BS, but in general it's a good idea to reduce the attack surface of the entire platform.

Re: Looking at how many sites use vulnerable JavaScript libraries

#42

Post by jacquesm »

mr_toad wrote: post #40
CapacitorSet wrote: post #38

Earlier quoted context omitted.

I don't understand, what were the scammers trying to achieve?

Trying to validate stolen or generated credit card numbers.

That's not always what is going on. In some cases unscrupulous operators will run through large numbers of $1 transactions in order to lower their chargeback rate.

Re: Looking at how many sites use vulnerable JavaScript libraries

#43

Post by dbg31415 »

Of course this is click bait. But of course most companies don't invest what they should in website maintenance, code reviews, security audits, and upgrades. I'm OK with some clickbait if it helps raise awareness of the need for more recurring investment in technology.

Re: Looking at how many sites use vulnerable JavaScript libraries

#44

Post by bigiain »

spurcell93 wrote: post #14
jjnoakes wrote: post #6

Earlier quoted context omitted.

Those means different things. Their wording means "we checked X sites and 77% of them met some criteria", which can be extrapolated to higher values of X (assuming the proper statistical care is taken, etc). Your wording implies the same, but that's not good because you can't extrapolate to a larger X. You chose the sites after knowing they already met the criteria, and that changes the meaning.

I get the sense OP was being a bit snide

The snide version would be "100% of 433,000". (Which is what I initially parsed it as, and nodded in agreement...)

Re: Looking at how many sites use vulnerable JavaScript libraries

#45

Post by mnm1 »

I looked at what it would take to upgrade our Angular 1.5 to 1.6: weeks worth of trying to untangle dependency hell and testing. For a minor version number upgrade. Let's not pretend it's only the consumers of these libraries that are lagging. A lot of these libraries are maintained by teams who have no business maintaining software, open source or not. They can release all the security patches they want, it won't make a difference if their new version isn't backwards compatible (obviously Angular is egregious and by far the worst I know of where even their minor version numbers have huge incompatibilities, not to mention 3 major version releases in 11 months).

Re: Looking at how many sites use vulnerable JavaScript libraries

#46

Post by sakshyamshah »

merb wrote: post #7

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

Only if your front end is SPA and backend just serves through data via api. even in that case, xss in front-end can compromise admin's web sessions to pivot into backend services.

Re: Looking at how many sites use vulnerable JavaScript libraries

#47

Post by sakshyamshah »

merb wrote: post #10
bastawhiz wrote: post #9

Earlier quoted context omitted.

An XSS issue could make your users' data vulnerable.

is still only an issue if you pass untrusted data to your js code.

turns out that most of times, untrusted user supplied data slips through JS codes https://www.owasp.org/index.php/Top_10_2017-Top_10

Re: Looking at how many sites use vulnerable JavaScript libraries

#48

Post by arca_vorago »

JasonFruit wrote: post #26

Is it better for a website to roll its own insecurity? I'd a lot rather people use libraries with significant adoption — hopefully being aware of and avoiding any security problems they may include — than write their own version where the security problems will never be exposed, at least for good.

I'd rather devs stop using JavaScript in so many places where its not even needed. Pure html5 and CSS is where its at.

Re: Looking at how many sites use vulnerable JavaScript libraries

#49

Post by colejohnson66 »

JasonFruit wrote: post #26

Is it better for a website to roll its own insecurity? I'd a lot rather people use libraries with significant adoption — hopefully being aware of and avoiding any security problems they may include — than write their own version where the security problems will never be exposed, at least for good.

Isn’t that just security through obscurity?

Re: Looking at how many sites use vulnerable JavaScript libraries

#50

Post by nicksantamaria »

jacquesm wrote: post #42
mr_toad wrote: post #40

Earlier quoted context omitted.

Trying to validate stolen or generated credit card numbers.

That's not always what is going on. In some cases unscrupulous operators will run through large numbers of $1 transactions in order to lower their chargeback rate.

This sounds interesting - can you explain further?
Post reply on HN