Synode: understanding and automatically preventing injection attacks on Node.js

Re:Synode: understanding and automatically preventing inject... by wesleytodd on Monday March 12, 2018 @10:36PM (#16573526)

Re-writing dependency source files with another dependency is a much worse idea than vetting your dependencies before you add them to your project IMHO

[ Parent | on HN ]

Re:Synode: understanding and automatically preventing inject... by calibas on Tuesday March 13, 2018 @01:06AM (#16573966)

If the only other solution is creating your own custom version of a vulnerable dependency, I can see how this could be useful. Not the "best" solution, but certainly practical as far as making code more secure.

[ Parent | on HN ]

Re:Synode: understanding and automatically preventing inject... by jessaustin on Monday March 12, 2018 @10:54PM (#16573599)

Maybe there's a setting to roll back the install if it finds vulnerable dependencies, rather than trying to fix them?

[ Parent | on HN ]