Stranger Danger: Finding Security Vulnerabilities Before They Find You!
summary
Open source supply chain risk is concrete: the NPM registry spans ~1,000,000 packages with 250,000 added in 2018, and 78% of found vulnerabilities live in indirect dependencies. Live demos exploit marked XSS via browser-semicolon quirks, dust template injection through HTTP parameter pollution and a ReDoS in ms/humanize-ms that pins CPU. Incidents include croissant stealing env vars and event-stream’s malicious subtree; 70% of maintainers lack high security knowledge, one in four skip security testing, and only 7% enable 2FA. Tools that open PRs to bump minimal semver and re-lock dependencies are shown as the practical fix.
AI-written summary · about
chapters (12)
- 0:00Open source security intro
- 5:02Real-world security incidents
- 7:08Dependency risks
- 8:13App security challenges
- 11:26Live hacking begins
- 12:28XSS in markdown parsers
- 17:19Code injection via templating
- 23:38Regular expression denial-of-service
- 30:19Vulnerabilities summary
- 31:00Why attackers target open source
- 32:25Developer-friendly security
- 34:09Closing & Q&A
related talks
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
37mThe State of Open Source Security
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...