News for hackers. Stuff that matters.

A comment on POLA Would Have Prevented the Event-Stream Incident.

Re:POLA Would Have Prevented the Event-Stream Incident by erights on Monday December 03, 2018 @02:47PM (#18592233)
This npm / event-stream incident is the perfect teaching moment for POLA (Principle of Least Authority), and for the need to support least authority for JavaScript libraries.

https://www.youtube.com/watch?v=9Snbss_tawI&list=PLKr-mvz8uv... is my presentation to the Node security team, explaining many of these issues prior to this particular incident.

[ Parent | on HN ]

There are no comments on this comment yet.