Looking at how many sites use vulnerable JavaScript libraries

Re:Looking at how many sites use vulnerable JavaScript libra... by wesleytodd on Wednesday November 22, 2017 @02:40PM (#15759835)

We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services.

For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configurations.

So needless to say, I think this is a sensationalist headline.

[ Parent | on HN ]

Re:Looking at how many sites use vulnerable JavaScript libra... by guypod on Wednesday November 22, 2017 @03:51PM (#15760506)

I think it's an absolute statement about the lack of awareness to this risk.

Of course some of these site would not actually be vulnerable, but I would bet the vast majority of them don't even know they're using a library with a known vulnerability.

[ Parent | on HN ]

Re:Looking at how many sites use vulnerable JavaScript libra... by wesleytodd on Wednesday November 22, 2017 @04:24PM (#15760793)

Agreed, but the tools (nsp) are there to make it simple to know. Devs who are not going to update/patch are not the target here, so making big claims like this does not strongly add to the conversation IMO.

Also, this is nothing new on the web, the amount of wordpress sites with known voulns is probably MUCH higher.

[ Parent | on HN ]

Re:Looking at how many sites use vulnerable JavaScript libra... by wesleytodd on Wednesday November 22, 2017 @02:42PM (#15759846)

NOTE: I am NOT saying we have had no security voulns. Just that the snyk and nsp disclosures on packages do not mean that those applications are vulnerable.

[ Parent | on HN ]

Re:Looking at how many sites use vulnerable JavaScript libra... by qaq on Wednesday November 22, 2017 @04:52PM (#15761022)

"viable" is a function of how interesting your production services are to a capable adversary.

[ Parent | on HN ]