Node.js security advisories
nodesecurity.io
Node.js security advisories
1–10 of 14 posts
Re: Node.js security advisories
#2I like the idea of having a centralized repository of these advisories, but I need a better way of watching for changes for this to be effective. I was hoping that the Twitter feed would be that (I would just turn on SMS notification), but the Twitter feed is full of general low-value tweets like "Thanks @espreto for being our 1000th follower!". Perhaps a separate Twitter feed could be created (@nodesecurityadvisories?) that only tweets when new advisories are posted on the site?
Re: Node.js security advisories
#3I like the idea of having a centralized repository of these advisories, but I need a better way of watching for changes for this to be effective. I was hoping that the Twitter feed would be that (I would just turn on SMS notification), but the Twitter feed is full of general low-value tweets like "Thanks @espreto for being our 1000th follower!". Perhaps a separate Twitter feed could be created (@nodesecurityadvisorie…
I think the security checker from Sensio labs is the best approach to this. You can upload your composer file, which is really the list of packages you use and they'll check it against the known reports for various Symfony modules. It's got both the API and its own module with a CLI tool, so you can easily integrate it into monitoring. https://security.sensiolabs.org/
I really wish other projects had something like that (rubygems, pypi, etc.)
Re: Node.js security advisories
#4Can't this be made simpler. Something like a cli call
npm vulnerable
This could take the package.json and list which of my packages need to be upgraded or downgraded to be secure as per the known issues database.
Re: Node.js security advisories
#5At least a RSS stream will be needed ?!
Re: Node.js security advisories
#6I like the idea of having a centralized repository of these advisories, but I need a better way of watching for changes for this to be effective. I was hoping that the Twitter feed would be that (I would just turn on SMS notification), but the Twitter feed is full of general low-value tweets like "Thanks @espreto for being our 1000th follower!". Perhaps a separate Twitter feed could be created (@nodesecurityadvisorie…
I think the security checker from Sensio labs is the best approach to this. You can upload your composer file, which is really the list of packages you use and they'll check it against the known reports for various Symfony modules. It's got both the API and its own module with a CLI tool, so you can easily integrate it into monitoring. https://security.sensiolabs.org/ I really wish other projects had something like t…
There actually does exist one for Ruby. Check out gemcanary https://gemcanary.com/
Re: Node.js security advisories
#7How does node.js have security advisories? Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with? Shouldn't we start with JavaScript security advisories first?
Honest question, have you ever seen a public Javascript security advisory?
Re: Node.js security advisories
#8Can't this be made simpler. Something like a cli call npm vulnerable This could take the package.json and list which of my packages need to be upgraded or downgraded to be secure as per the known issues database.
That's brilliant, but the search operates on titles, the /package/:name route appears to be broken and there's no RSS. I give up.
Re: Node.js security advisories
#9How does node.js have security advisories? Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with? Shouldn't we start with JavaScript security advisories first? Honest question, have you ever seen a public Javascript security advisory?
>> Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with
No.
>> Shouldn't we start with JavaScript security advisories
Its a language, not a specific implementation of a language. Chromes javascript engine is what would have security vulnerabilities, no javascript itself.
This isn't security advisories for node itself, it is for node modules. the node security project is auditing all of the modules in npm for security issues, and posting about them there.
Re: Node.js security advisories
#10How does node.js have security advisories? Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with? Shouldn't we start with JavaScript security advisories first? Honest question, have you ever seen a public Javascript security advisory?
>> Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with No. >> Shouldn't we start with JavaScript security advisories Its a language, not a specific implementation of a language. Chromes javascript engine is what would have security vulnerabilities, no javascript itself. This isn't security advisories for node itself, it is for node modules. the node secu…
>> Its a language, not a specific implementation of a language.
It's not even that, it's a dialect of ECMAScript.