3 ms·

Why not read the source of whatever you're using before running it?

gingerlime 13y ago
laziness? :) more seriously: 1. Reading the full source code can be quite difficult and time consuming, and being able to spot security issues is even harder. Some experts miss those until someone stumbles upon it, or is dedicated enough to look deeper... 2. there's an underlying assumption that if something is open-source, then the 'many eyes principle' applies, and someone has looked at the code. So whilst it's generally true, it might not always apply to security. Many might have looked at the code, but unless they were specifically looking for security, and were qualified enough to find the more subtle, hidden security issues - those will go unnoticed. The general rule of thumb to look for stability indicators, applies to security to a large extent: activity on the project, number of 'stars' on github, reputation of the core committers etc. But even then there's no guarantee. If you want to stand on shoulders of giants, you'd have to trust those giants to support you.
roryokane 13y ago
Because almost all plugins will have too much code to read carefully in a reasonable amount of time. Malicious behavior such as uploading the contents of files at certain paths might take only three lines of code, and those lines could be spread out at different points in a long function, and have misleading variable names. It would take a prohibitive amount of time for a developer who just wants to use a plugin to spot such errors.
louischatriot 13y ago
It would take too much time to do it yourself, and if you're no security expert you will miss vulnerabilities anyway. This project is a better answer: http://nodesecurity.io/ http://nodesecurity.io/
damon_c 13y ago
I was recently astounded by the sheer number of dependencies and attendant files that get downloaded when starting up a new node.js project. The notion of reading all the source is... quaint!

laziness? :) more seriously: 1. Reading the full source code can be quite difficult and time consuming, and being able to spot security issues is even harder. Some experts miss those until someone stumbles upon it, or is dedicated enough to look deeper... 2. there's an underlying assumption that if something is open-source, then the 'many eyes principle' applies, and someone has looked at the code. So whilst it's generally true, it might not always apply to security. Many might have looked at the code, but unless they were specifically looking for security, and were qualified enough to find the more subtle, hidden security issues - those will go unnoticed. The general rule of thumb to look for stability indicators, applies to security to a large extent: activity on the project, number of 'stars' on github, reputation of the core committers etc. But even then there's no guarantee. If you want to stand on shoulders of giants, you'd have to trust those giants to support you.

roryokane 13y ago

Because almost all plugins will have too much code to read carefully in a reasonable amount of time. Malicious behavior such as uploading the contents of files at certain paths might take only three lines of code, and those lines could be spread out at different points in a long function, and have misleading variable names. It would take a prohibitive amount of time for a developer who just wants to use a plugin to spot such errors.

louischatriot 13y ago

It would take too much time to do it yourself, and if you're no security expert you will miss vulnerabilities anyway. This project is a better answer: http://nodesecurity.io/ http://nodesecurity.io/

damon_c 13y ago

I was recently astounded by the sheer number of dependencies and attendant files that get downloaded when starting up a new node.js project. The notion of reading all the source is... quaint!