Node Security
summary
Covers concrete vulnerabilities and fixes: shows new Buffer zero-fill leak as real memory disclosure, urges zeroing buffers; names tools like NSP and retirejs and an in-house app that monitors GitHub issues for security keywords and works in practice; argues for input validation (recommends the joy module), audit logging and fire‑drills, and using parallelLimit/streams to avoid event‑loop availability failures; notes a six‑month‑old pull request for a node core security release process and demonstrates what gets fixed and what still slips through.
AI-written summary · about
chapters (13)
- 0:00A Security Carol
- 2:12The ghost of security past
- 4:10Confidentiality
- 4:59new Buffer
- 5:46Integrity
- 6:47Input Validation
- 7:51Availability
- 9:38The ghost of security present
- 10:40node-website/pull/27
- 13:32Known Vulnerabilities
- 15:03The ghost of security future
- 17:25Audit Logging
- 18:00Run Fire drills
