Builders vs Breakers
summary
An account takeover in Basecamp Classic and a string of web reports from evilpacket.net motivate building a different response: an audit of roughly 31,000 modules as part of the node security project that combines automated checks, maintainers contact and submitted pull requests so vulnerabilities ship with fixes, not just advisories; an example merge on Hubot shows the workflow works and the project needs contributors to write the short patches that close issues.
AI-written summary · about
chapters (6)
- 0:00Start
- 16:18SECURITY.md #How to report issue #Expectations #List of humans
- 17:40Self Disclosure of Vulnerabilities
- 18:06Handling a security failure well can build trust.
- 18:54A new project based on what we've learned about builders vs breakers
- 27:42Quick Recap - Respect & understand feelings - Proactively communicate & listen - It's okay to mess up-it can even buil trust
related talks
56mHow Building a Better Hacker Accidentally Built a Better Defender
27mPanel: Building A Secure Ecosystem for Node.js
48mImproving the Security of a Large Open Source Project One Step...
22mEngineering under the watchful eyes of hackers
38mFinding Security Issues in Open Source
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
51mProtecting your organisation against attacks via the build system
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages