Re:Critical vulnerability of NPM package macaddress
by mrwilhelm on Monday June 11, 2018 @10:20AM
(#17284420)
Programming was a mistake.
Re:Critical vulnerability of NPM package macaddress
by tzahola on Monday June 11, 2018 @10:01AM
(#17284239)
Javascript was a mistake
Edit: Answer to “always_good”:
If a toddler shoots himself with a handgun, we can say that his mistake was pulling the trigger.
While technically correct, it’s not addressing the real issue, that is, how did the toddler get hold of the gun in the first place?
Re:Critical vulnerability of NPM package macaddress
by always_good on Monday June 11, 2018 @10:09AM
(#17284302)
Wrong again.
Passing user input into arbitrary shell commands is the mistake.
Good examples of amateur criticism that plagues our field, though.
Re:Critical vulnerability of NPM package macaddress
by scrollaway on Monday June 11, 2018 @02:48PM
(#17287200)
This isn't a case of JS gun gone wrong. Someone's passing cat inside exec with an arbitrary path instead of using native open&read and path.join. That's a thing possible in almost every modern language.
Stop the nonsense. Seriously. Stop.
Re:Critical vulnerability of NPM package macaddress
by supermdguy on Monday June 11, 2018 @10:24AM
(#17284456)
Having the ability to execute arbitrary commands isn't something that's unique to JavaScript.
Are you sure you understand the issue?