5 ms·

kinda sad that a web app for managing security failures has XSS directly via the UI (you can just copy/paste HTML into it). I'd be extremely hesitant to put se

by tetrep 11y ago

kinda sad that a web app for managing security failures has XSS directly via the UI (you can just copy/paste HTML into it). I'd be extremely hesitant to put sensitive information into an application that lacks even a basic understanding of how to secure itself. https://github.com/certsocietegenerale/FIR/issues/50 https://github.com/certsocietegenerale/FIR/issues/50

andersonmvd 11y ago
Although it's faster to fix a XSS than to build this very system from scratch again. It's better to contribute rather than complain. We all should be thankful because it is open source. Don't you agree?
- toomuchtodo 11y ago
  Just think about the momentum open source would have if each time somebody spent time submitting a comment to complain, they instead did a PR and fixed the issue. #PRsBeforeComplaints, or something like that
  - grub5000 11y ago
    That's not really viable though is it? It's easy enough to spot flaws without knowing how to fix them.
    - toomuchtodo 11y ago
      If you've got the skills, open a PR. If you don't, an Issue is sufficient (unless you're demanding a feature).
- tetrep 11y ago
  > Don't you agree? Nope. I wouldn't want to PR this any more than I would want to patch PHP. I'd rather run the other way very quickly and use a well designed technology. To use an analogy, they didn't forget to lock the front door, they forgot to put locks on the door in the first place. It's more egregious than client-side validation; it's no validation at all. For the sake of being constructive, the application designers should read up about the security of any technologies they're using and make sure they understand the risks involved. They're developing an application that is meant to be used for sensitive information (about security breaches, no less) so they really need to make sure they know what they're doing. They can't rely on PRs from passerbys for their security.

by tetrep 11y ago

andersonmvd 11y ago

Although it's faster to fix a XSS than to build this very system from scratch again. It's better to contribute rather than complain. We all should be thankful because it is open source. Don't you agree?

toomuchtodo 11y ago
Just think about the momentum open source would have if each time somebody spent time submitting a comment to complain, they instead did a PR and fixed the issue. #PRsBeforeComplaints, or something like that
- grub5000 11y ago
  That's not really viable though is it? It's easy enough to spot flaws without knowing how to fix them.
  - toomuchtodo 11y ago
    If you've got the skills, open a PR. If you don't, an Issue is sufficient (unless you're demanding a feature).
tetrep 11y ago
> Don't you agree? Nope. I wouldn't want to PR this any more than I would want to patch PHP. I'd rather run the other way very quickly and use a well designed technology. To use an analogy, they didn't forget to lock the front door, they forgot to put locks on the door in the first place. It's more egregious than client-side validation; it's no validation at all. For the sake of being constructive, the application designers should read up about the security of any technologies they're using and make sure they understand the risks involved. They're developing an application that is meant to be used for sensitive information (about security breaches, no less) so they really need to make sure they know what they're doing. They can't rely on PRs from passerbys for their security.