3 ms·

I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it ins

by FpUser 4y ago

I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. I think what you are saying is simply FUD when taken as a blanket statement.

x3n0ph3n3 4y ago
Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.
- FpUser 4y ago
  As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update. But thanks for trying anyways.
smt88 4y ago
> I use an ancient library to perform some math. Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day. The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security. > Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. You didn't specify the language or library. Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities. The mathjs package in NPM, for example, has had tons of vulnerabilities[1]. 1. https://security.snyk.io/package/npm/mathjs https://security.snyk.io/package/npm/mathjs
- FpUser 4y ago
  C++ Library, forgot the name, need to look. NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".

by FpUser 4y ago

x3n0ph3n3 4y ago

Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.

FpUser 4y ago
As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update. But thanks for trying anyways.

smt88 4y ago

> I use an ancient library to perform some math. Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day. The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security. > Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation. You didn't specify the language or library. Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities. The mathjs package in NPM, for example, has had tons of vulnerabilities[1]. 1. https://security.snyk.io/package/npm/mathjs https://security.snyk.io/package/npm/mathjs

FpUser 4y ago
C++ Library, forgot the name, need to look. NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".