Security: Your Application's Vulnerabilities
summary
The talk reviews real-world XSS and supply-chain attacks, citing statistics (over 20% of attacks, 30+ XSS attempts per site in Q1 2017) and incidents like the Samy worm and a service‑worker cryptominer that hit 220/100k sites. It recommends concrete defenses: CSP nonces, vetted sanitizers (xss, DOMPurify), dependency scanners (npm audit, Snyk, Retire), and automated dynamic scanning (OWASP ZAP integrated with Jenkins).
AI-written summary · about
chapters (20)
- 0:00Introduction
- 3:30What is XSS
- 6:37Active vs passive XSS
- 8:24DOM vulnerabilities
- 11:11Attacker motives
- 13:40What hackers steal
- 15:22Framework vulnerabilities
- 18:14Outdated libraries
- 20:24Malicious npm packages
- 22:10Client-side data threats
- 22:52SPA risks
- 23:33Service Worker dangers
- 26:21How ad blockers work
- 27:27Extension vulnerabilities
- 28:29Fighting vulnerabilities
- 33:27Security tools
- 36:57Static vs dynamic analysis
- 38:43Dependency checks
- 40:10Developer security tips
- 40:57Q&A
related talks
02h 18mWeb application security (Part 2)
02h 14mWeb application security (Part 1)
01mVelocity Conference 2017 - San Jose, CA
39mA landscape of unintended consequences
14mKeynote: What We Learned Dissecting the World’s Most Popular Containers
41mWake Up, Neo
42mPrivacy Toolkit: Privacy Awareness In The Digital Age
01h 04mJavaScript's Most Wanted