3 ms·

More reasonably... Most of these are fundamental server side web app best practice that we learnt decades ago and used Perl libraries that mitigated them back

More reasonably... Most of these are fundamental server side web app best practice that we learnt decades ago and used Perl libraries that mitigated them back in the 90s. "Validate your inputs", "escape your outputs", "have good logging", "have brute force protection", "use anti CSRF tokens", "take care parsing http headers" - those are all bits of advice you could find in the comp.lang.perl.misc archives from the late '90s. None of them are NodeJS specific, they're all "inexperienced backend developer" specific bits of advice. Which is scary...

cwilby 5y ago
Question the requirements, they're almost always wrong. Question them even more if you think a smart person wrote them.
- bigiain 5y ago
  ... especially if that smart person was you. Find someone smarter than the requirements writer to review them. Even if they only have time to do a quick skim over them, it'll help. (Yep. I've made that mistake often enough to believe that advice.)
chakkepolja 5y ago
Many people learn web development from short crash courses and half baked youtube videos these days. They are often often don't pay much attention to these. So many times I have seen people concatenate strings to do SQL than use prepared statements or whatever language analog its scary. For HN audience, It sure sounds very old knowledge but for some document intended as cheat sheet / checklist it has place.
- bigiain 5y ago
  > it has place. Yup. Reminding everybody you need to have some adults in the room. If your full stack web team has not one single person who's experienced enough to have ever had to investigate and clean up after an intrusion, its 1) going to happen soon, and 2) its going to go badly. I mean, sure - bootcamp "grads" are cheap and plentiful and have pretty portfolios. But almost none of them should have root on production servers...
- notapenny 5y ago
  If you don't mind, would you recommend some sources these people can go to/should read into? I've had a shortened CS education (2yrs) but I'm mostly self taught outside of that. I'm just starting to do a bit more back-end development and I have the exact same issue with these courses; they focus on "build the cool thing using these popular tools" but never on build it right. I don't really care about the shiny new thing personally, I'm looking for fundamentals.
  - hutzlibu 5y ago
    "I'm looking for fundamentals" Have you heard of this shiny new thing, called printed out books? This is mainly how I learned them. Saves you some screen time as a bonus.
    - chakkepolja 5y ago
      Yep. I prefer books to youtube videos or whatever my peers use for the precise reason that books cover concepts from ground up, whereas tutorial content is geared towards fastly getting some stuff up and running.
  - bigiain 5y ago
    In spite of my Node snark above... Owasp is a really great resource, just don't concentrate only on a quick Node-related cheat sheet (even if you are using node for your backend). The more generic information handout web application security is very good, and will benefit your knowledge across all languages and frameworks, if you care to consume it. (There may be genuinely good current resources to learn web app and platform security from, but I cut my teeth there in the late 90s - including fucking up and needing to clean ups after myself, which sadly is the most powerful learning tool, while also being a very very poor way to achieve that learning...)
evandwight 5y ago
This is exactly the type of document I needed. I have no experience in web development and am making my first site. I knew some of the vulnerabilities but unknown unknowns are always a problem. This list is obviously not complete, but it allows me to catch common errors before I release. The main recommendations that I didn't know was request size limits - though I'll probably set the limit in ngnix.
- bigiain 5y ago
  > I have no experience in web development and am making my first site. Can I very very strongly recommend, that if this site does any collection of PII or handles payments (even if those are 3rd party ones using something like Stripe), that you get a trusted and experienced dev to do a review for you? You acknowledge you have unknown unknowns, you must also realise that there are people out there (quite likely people you count as friends) who's space of unknown unknown in the web platform security area is smaller than yours. There are many unexpected things you likely haven't considered. Where I am, IP addresses are not on their own considered PII, but email addresses are. Somewhat less expectedly though, is that IP addresses that can be linked to another piece of PII then become PII themselves, so if you have a database with an email address and, say, a signup or last login timestamp, suddenly all your web server logs full of IP addresses, request paths (which can identify signups/logins), and timestamps - become linkable via the timestamp/request path to users logging in and their email address in the db, and suddenly the log files become PII with all the duty of disclosure around breaches. (And that's without even considering super common rookie mistakes where PII gets written out win clear text to access or error logs on purpose for debugging reasons.)
  - evandwight 5y ago
    Thanks for the advice. Unfortunately I don't know anyone who would do it. Do you have any good recommendations of services? My goal was to be more secure than an out of date wordpress site - which I think I have achieved. I don't really understand the harm that can come from an email/password/ip leak, besides spam or stolen accounts if they reuse their password. Do you have a link that might impress the seriousness of the situation on me?

cwilby 5y ago

Question the requirements, they're almost always wrong. Question them even more if you think a smart person wrote them.

bigiain 5y ago
... especially if that smart person was you. Find someone smarter than the requirements writer to review them. Even if they only have time to do a quick skim over them, it'll help. (Yep. I've made that mistake often enough to believe that advice.)

chakkepolja 5y ago

Many people learn web development from short crash courses and half baked youtube videos these days. They are often often don't pay much attention to these. So many times I have seen people concatenate strings to do SQL than use prepared statements or whatever language analog its scary. For HN audience, It sure sounds very old knowledge but for some document intended as cheat sheet / checklist it has place.

bigiain 5y ago
> it has place. Yup. Reminding everybody you need to have some adults in the room. If your full stack web team has not one single person who's experienced enough to have ever had to investigate and clean up after an intrusion, its 1) going to happen soon, and 2) its going to go badly. I mean, sure - bootcamp "grads" are cheap and plentiful and have pretty portfolios. But almost none of them should have root on production servers...
notapenny 5y ago
If you don't mind, would you recommend some sources these people can go to/should read into? I've had a shortened CS education (2yrs) but I'm mostly self taught outside of that. I'm just starting to do a bit more back-end development and I have the exact same issue with these courses; they focus on "build the cool thing using these popular tools" but never on build it right. I don't really care about the shiny new thing personally, I'm looking for fundamentals.
- hutzlibu 5y ago
  "I'm looking for fundamentals" Have you heard of this shiny new thing, called printed out books? This is mainly how I learned them. Saves you some screen time as a bonus.
  - chakkepolja 5y ago
    Yep. I prefer books to youtube videos or whatever my peers use for the precise reason that books cover concepts from ground up, whereas tutorial content is geared towards fastly getting some stuff up and running.
- bigiain 5y ago
  In spite of my Node snark above... Owasp is a really great resource, just don't concentrate only on a quick Node-related cheat sheet (even if you are using node for your backend). The more generic information handout web application security is very good, and will benefit your knowledge across all languages and frameworks, if you care to consume it. (There may be genuinely good current resources to learn web app and platform security from, but I cut my teeth there in the late 90s - including fucking up and needing to clean ups after myself, which sadly is the most powerful learning tool, while also being a very very poor way to achieve that learning...)

evandwight 5y ago

This is exactly the type of document I needed. I have no experience in web development and am making my first site. I knew some of the vulnerabilities but unknown unknowns are always a problem. This list is obviously not complete, but it allows me to catch common errors before I release. The main recommendations that I didn't know was request size limits - though I'll probably set the limit in ngnix.

bigiain 5y ago
> I have no experience in web development and am making my first site. Can I very very strongly recommend, that if this site does any collection of PII or handles payments (even if those are 3rd party ones using something like Stripe), that you get a trusted and experienced dev to do a review for you? You acknowledge you have unknown unknowns, you must also realise that there are people out there (quite likely people you count as friends) who's space of unknown unknown in the web platform security area is smaller than yours. There are many unexpected things you likely haven't considered. Where I am, IP addresses are not on their own considered PII, but email addresses are. Somewhat less expectedly though, is that IP addresses that can be linked to another piece of PII then become PII themselves, so if you have a database with an email address and, say, a signup or last login timestamp, suddenly all your web server logs full of IP addresses, request paths (which can identify signups/logins), and timestamps - become linkable via the timestamp/request path to users logging in and their email address in the db, and suddenly the log files become PII with all the duty of disclosure around breaches. (And that's without even considering super common rookie mistakes where PII gets written out win clear text to access or error logs on purpose for debugging reasons.)
- evandwight 5y ago
  Thanks for the advice. Unfortunately I don't know anyone who would do it. Do you have any good recommendations of services? My goal was to be more secure than an out of date wordpress site - which I think I have achieved. I don't really understand the harm that can come from an email/password/ip leak, besides spam or stolen accounts if they reuse their password. Do you have a link that might impress the seriousness of the situation on me?