Node.js Buffer knows everything – your traffic, sources, keys and configs
1–6 of 6 posts
Re: Node.js Buffer knows everything – your traffic, sources, keys and configs
#2This note does not have anything actually new, but I have seen several people who are not aware of that.
Re: Node.js Buffer knows everything – your traffic, sources, keys and configs
#3Sounds like a recipe for disaster. Why not just zero buffers on construction; if you can't afford the performance penalty of memset then you could always manage a pool of pre-allocated Buffers in your super performant module, which would make it even more obvious to a casual reader.
Re: Node.js Buffer knows everything – your traffic, sources, keys and configs
#4Every new Buffer should allocate new sandboxed memset, fulfilled with zeros.
Re: Node.js Buffer knows everything – your traffic, sources, keys and configs
#5And no, switching Buffer(number) to be zero-filled will bring more harm now, even from the security point of view. The best course of action imo is to deprecate Buffer(number) whatsoever and replace it with two separate methods. More info here: https://github.com/nodejs/node/issues/4660#issuecomment-1712...
I will make a separate post about that soon enough.
Re: Node.js Buffer knows everything – your traffic, sources, keys and configs
#6And no, switching Buffer(number) to be zero-filled will bring more harm now, even from the security point of view. The best course of action imo is to deprecate Buffer(number) whatsoever and replace it with two separate methods. More info here: https://github.com/nodejs/node/issues/4660#issuecomment-1712... I will make a separate post about that soon enough.