2 ms·

Sorry, but that had me laughing out loud. No, they haven't. I should know, I check those companies for a living. This is one of the most often flagged issues:

Sorry, but that had me laughing out loud. No, they haven't. I should know, I check those companies for a living. This is one of the most often flagged issues: unaudited Node.js dependencies. "Oh but we don't have the manpower to do that, think about how much code that is".

DamonHD 1y ago
When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!
- cluckindan 1y ago
  If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.
  - DamonHD 1y ago
    These were all multinationals, with very significant US presence.
  - drw85 1y ago
    In my experience, most devs and companies don't consider the dependencies they load 'their' code. They only look at the code they write, not everything they deploy.
  - jacquesm 1y ago
    In theory there is no difference between theory and practice, but in practice there is. > If they haven’t, it would be ethically dubious for you to not report it. I can report all I want, someone needs to act on that report for it to have an effect. There are people out there who think that some static analysis tool plugged into their CI/CD pipeline is the equivalent of a code audit.
    - cluckindan 1y ago
      But the aforementioned NIST standard requires a lot more from auditing and operations.
      - jacquesm 1y ago
        I know what the standard requires. I also know what happens in practice and typically the auditors are understaffed, overworked and their technical expertise is lower than it should be. As a result a lot of stuff slips through the cracks. What does get flagged though is not getting employee permission for putting photos on the 'team' page. It's good they flag that. I'd rather they also went in much deeper on tech issues. I've reviewed 270 companies to date. I have yet to find a single one that had audited the source code they imported. It's not untypical to find an installation that automatically updates a whole raft of dependencies during the build phase. And absolutely nobody looks at that code until something breaks.

DamonHD 1y ago

When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!

cluckindan 1y ago
If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.
- DamonHD 1y ago
  These were all multinationals, with very significant US presence.
- drw85 1y ago
  In my experience, most devs and companies don't consider the dependencies they load 'their' code. They only look at the code they write, not everything they deploy.
- jacquesm 1y ago
  In theory there is no difference between theory and practice, but in practice there is. > If they haven’t, it would be ethically dubious for you to not report it. I can report all I want, someone needs to act on that report for it to have an effect. There are people out there who think that some static analysis tool plugged into their CI/CD pipeline is the equivalent of a code audit.
  - cluckindan 1y ago
    But the aforementioned NIST standard requires a lot more from auditing and operations.
    - jacquesm 1y ago
      I know what the standard requires. I also know what happens in practice and typically the auditors are understaffed, overworked and their technical expertise is lower than it should be. As a result a lot of stuff slips through the cracks. What does get flagged though is not getting employee permission for putting photos on the 'team' page. It's good they flag that. I'd rather they also went in much deeper on tech issues. I've reviewed 270 companies to date. I have yet to find a single one that had audited the source code they imported. It's not untypical to find an installation that automatically updates a whole raft of dependencies during the build phase. And absolutely nobody looks at that code until something breaks.