Node Security Project - LXJS 2013
1 like2,358 views
The document discusses the Node Security Project and responsible security disclosures. It notes that while they had control over code linting and peer review, they lacked control over third party code and the npm delivery system. It suggests improvements like private issues/pull requests could help security research. The document advocates for better security education and resources through initiatives like NodeSchool.
![child_process.exec
[pid 31152] execve("/bin/sh", ["/bin/sh", "-c", "ls"]
child_process.execFile
[pid 31176] execve("/bin/ls", ["/bin/ls"]
Wednesday, October 2, 13](https://image.slidesharecdn.com/lxjs2013-nodesecurityproject-131002083515-phpapp01/85/Node-Security-Project-LXJS-2013-32-320.jpg)
Node Security Project - LXJS 2013
- 1. Wednesday, October 2, 13
- 2. Hi, I’m Adam Wednesday, October 2, 13
- 3. Hi, I’m Adam @adam_baldwin @liftsecurity @nodesecurity Wednesday, October 2, 13
- 4. Hi, I’m Adam @evilpacket Wednesday, October 2, 13
- 5. Wednesday, October 2, 13
- 6. Wednesday, October 2, 13
- 7. Wednesday, October 2, 13
- 8. Wednesday, October 2, 13
- 9. Wednesday, October 2, 13
- 10. Node Security Project Wednesday, October 2, 13
- 11. Why Wednesday, October 2, 13
- 12. •precommit-hook for linting •pull requests for peer review •education / values Things we had control over Wednesday, October 2, 13
- 13. •other peoples code •the delivery system (npm) Things we didn’t have control over Wednesday, October 2, 13
- 14. npm install altlhethings Wednesday, October 2, 13
- 15. npm install fs Wednesday, October 2, 13
- 16. npm install http Wednesday, October 2, 13
- 17. npm install socketio Wednesday, October 2, 13
- 18. 404 Wednesday, October 2, 13
- 19. ~/analyzer$ node print.js ./output/output.json buffer: 604 child_process: 2867 dgram: 836 dns: 674 fs: 15036 http: 12084 https: 2819 os: 1311 readline: 909 string_decoder: 65 timers: 230 tty: 335 vm: 354 Wednesday, October 2, 13
- 20. •Core modules.... •Punctuation is hard •Improve integrity checking Conclusions Wednesday, October 2, 13
- 21. Wednesday, October 2, 13
- 22. How Wednesday, October 2, 13
- 24. New Process Wednesday, October 2, 13
- 25. Wednesday, October 2, 13
- 26. Wednesday, October 2, 13
- 27. Wednesday, October 2, 13
- 28. Wednesday, October 2, 13
- 29. Wednesday, October 2, 13
- 30. Wednesday, October 2, 13
- 31. Wednesday, October 2, 13
- 32. child_process.exec [pid 31152] execve("/bin/sh", ["/bin/sh", "-c", "ls"] child_process.execFile [pid 31176] execve("/bin/ls", ["/bin/ls"] Wednesday, October 2, 13
- 33. Wednesday, October 2, 13
- 34. Catalyst for Change Wednesday, October 2, 13
- 35. Improved Resources Wednesday, October 2, 13
- 36. Private issues & Pull Requests Wednesday, October 2, 13
- 37. “I wish @github had private issues and pull requests for open source projects to improve responsible disclosure of security issues! Please RT” j.mp/lxjs-nsp Wednesday, October 2, 13