Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
Nothing wrong with static sites!
but what about vulnerabilities in the web server? 😱
Just staple your website to a telephone pole
That would be the best result if everyone just went back to static sites.
Berkshire Hathaway website is html.
That’s why my site will always be html monke.
Has pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?
I think there’s been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can’t remember any specific times this happened in browsers tho.
How many apocalyptic security flaws can fit into a week?
I never noticed how long the sales guy’s hand is
yes
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.
Uhm. There’s a release called Node2Shell, linked in the article.
I’ll bet this is another “AI found a known vulnerability so people are making a big deal about it” like the PHP one.
Node has literally always been like this. It’s just a risk you accept when you choose to use it.
JavaScript should never have been used that way to begin with.
JavaScript should never have been used
that wayto begin with.
Maybe like… code your backend in a real programming language?
HTML 1.0
cgi-bin
I’ve not heard of any recent COBOL vulnerabilities
This what you get for running JS as your back end!
This always struck me as a rather silly idea, to be honest.
Now we’ve come full circle. I have a vendor who is insisting that I use node.js and pull their code from their NPM repository from the same… For frontend code. Just, have the entire contents of your (their) node_modules folder exposed to the public internet at all times. Isn’t this just Javascript with extra steps?
While it’s a bit opportunistic to blame JS in the backend in this case, I despise JS in the backend enough to happily join you.
Serves you well JS enthusiasts, your programming language is the only one that I despise more the more I learn about it. :P
Static site suprimacy week.
Uh oh, the cracks in our software castles get bigger.
every time the sun rises, shines and sets; a million new node vulnerabilities are discovered
be careful, obviously, but don’t let it turn your entire nervous system into pure crystallized cortisol
you can deal with it on Monday
Yeah, so here’s the thing. People keep trying to bash on PHP as if anything software isn’t manmade and comes baked with flaws that can be exploited. It’s the single reason why cybersecurity products are never going to stop being used because no matter what, it’s based on something somebody made.
It’s going to be flawed or be exploitable by some means. Yesterday it was Log4J, now it’s PHP, tomorrow it will be something else. It will never end. Companies deliberately also use this to force you to upgrade because they’ve abandoned “legacy” products that still work but which they no longer choose to maintain because they want more money and need to stifle you for it somehow.
While the world reels from websites being taken down before critical PHP patches were released
Is it just me or did anyone else not even notice outside of articles lol… It was all resolved by the time I got off work.
It’s not resolved until everyone installs the patch. And there in lies the problem.
Why are people mad? These issues existed and now they don’t. It’s not like the researchers created them
“If you don’t test for them, the numbers will go down” - President Trump on COVID-19.
Imagine working in IT security. How bad a time are you having right now? Are we expecting things to become better or worse the next few months?
Honestly let it burn.
I run a la. Not even a full lamp. Its just a slack box with base apache html.
For years i’ve been mocked. But that bitch has never been compromised and it’s damned near impossible. Who’s laughing now.
What does it do? Serve pictures of cats?
mostly your mum
