3 ms·

> While WildDuck is more secure by definition than most alternatives > ... > You can run WildDuck on any system that supports Node.js, Node.js and more secure

• pictur 7y ago
  Do large companies provide data security with very well-known languages?
• stingraycharles 7y ago
  I guess they mean “Secure by Design” but it doesn’t inspire confidence indeed..
• vince14 7y ago
  Maybe because "Microsoft: 70 percent of all security bugs are memory safety issues"
• Tankenstein 7y ago
  I get that this is a meme, but v8 is one of the most battle-hardened runtimes out there, plus you don't manage your own memory or concurrency primitives, which are the sources of most security issues.
  • masukomi 7y ago
    v8 may be badass. but the quality of many of the libraries in the node ecosystem is .... questionable at best. Lots of newbs with no clues about security throwing out packages that people end up with in their dependency trees and never stop to ponder the security / quality of.
• andris9 7y ago
  For secure by definition I meant: * written in memory safe language * no special permissions needed (besides binding to privileged ports at start but there are workarounds) so no need to be able to chown or spawn workers under different user id's * no file access for the running daemon, once the daemon starts then it does not read nor write to the local file system * no spawning shell commands each of these things is a target for a different attack vector