StrangerDanger: Finding Security Vulnerabilities Before They Find You!

on YouTube ↗35m

" summary

A runnable Goof sample app demonstrates real exploits: a marked XSS bypass where browser HTML parsing defeats library sanitization, and a ReDoS in ms/humanize-ms that blocks the Node event loop; data claims back them up—78% of NPM vulnerabilities live in indirect deps, one in four packages get no security testing, only 7% of maintainers enable 2FA—and the pipeline fix shown is Snyk auto-upgrade PRs that open minimal-version patches.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 6:24ss Example: Fetch file & store in s3
3. 7:52ppSec Challenges
4. 13:40Goof TODO
5. 31:40Vhat's the Solution?
6. 33:56Open Source Security Takeaway

" related talks

• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019
• 37mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Node.js Global Summit 2020
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017
• 46mHow to hack a node app?Asim Hussain · The Rolling Scopes Conference 2018