TrendMicro Node.js HTTP server listening on localhost can execute commands

Re:TrendMicro Node.js HTTP server listening on localhost can... by johnmaguire2013 on Monday January 11, 2016 @06:12PM (#10884348)

Languages aren't inherently secure or insecure. In any case, nobody was accusing Node.js of being insecure here.

JS is not "the only language that is secure enough to run universally in every browser on the planet." In fact, JS has had many, many security issues in browsers.

Rather, JS is the only language nearly every browser on the planet has implemented in the browser (hopefully sandboxed!)

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by gragas on Monday January 11, 2016 @06:56PM (#10884591)

>Languages aren't inherently secure or insecure.

This is just not true.

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by kcbanner on Monday January 11, 2016 @09:43PM (#10885252)

Explain?

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by smt88 on Monday January 11, 2016 @09:48PM (#10885270)

A language's specification can forbid you from doing things that you probably didn't intend to do. Rust is an entire language intended to be safer by design (as opposed to C, which is the cause of a lot of secure issues). You can write less safe code in Rust, but you have to tell the compiler that you're doing it on purpose.

It's also much, much easier to introduce bugs in certain languages because of the way they handle errors, or because the syntax is confusing and ambiguous. Even permissive handling of boolean logic, like what you get in PHP/JavaScript ("0" == true, for example) can result in massive security holes.

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by gragas on Tuesday January 12, 2016 @12:33AM (#10885744)

As another example, Go's := makes it much harder to do things you aren't intending to do.

[ Parent | on HN ]