Receive updates from Adventures in Nodeland for free, starting right now.
We can deliver them by email, via your phone or you can read them from a personalised news page on follow.it.
This way you won't miss any new article from Adventures in Nodeland. Unsubscribe at any time.
Site title: Adventures in Nodeland
Is this your feed? Claim it!
Hey Everyone!
This edition is a bit different. I want to talk about something that takes up a surprising amount of my week: triaging security vulnerabilities.
I receive 20-40 reports to triage a week. That's work that must be done, and there are plenty of other people doing it too, but I try to pull my fair share.
Here's the thing that's changed: almost a...
Every few weeks, a security report lands that follows the same template. Someone has found a new gadget: a spot where code reads a property it expected to be absent and does something dangerous with it. child_process picking up a shell it was never passed. A router honouring an option out of nowhere. An ORM resolving a field it should not. Sometimes the gadget is in Node.js c...