5 ms·

Number of deployments doesn't equate to secure, or Windows 95 would have been considered Secure in 1996. (It's in good shape these days) Most companies get No

by drakaal 13y ago

Number of deployments doesn't equate to secure, or Windows 95 would have been considered Secure in 1996. (It's in good shape these days) Most companies get Node to be "secure" by putting a Proxy in front of it. Doing a lot of packet inspection, and limiting interactions with the server to validated requests. If you set something like this up you can make anything secure. But most people can't do this, they don't know how. Most enterprise don't do this because setting up packet inspection for validation requires a lot of planning, and so unless you are massive scale it isn't worth, so this remains in the realm of things only banks and financial institutions do.

lttlrck 13y ago
That doesn't mean there isn't a net benefit using NodeJS vs. other solutions.
filipedeschamps 13y ago
Ok, great, Node.js seems really insecure. Can you tell me how to hack a Node.js app so easily?
briantakita 13y ago
> If you set something like this up you can make anything secure I'm surprised there isn't an open source "secure" proxy service that you mentioned. It also makes sense to keep on top of updates. Also, if security is an important requirement, then it makes sense for the organization to use someone who knows what they are doing to set up the network and own the security requirement. Audits would also be prudent.
drakaal 13y ago
Since the tree is as deep as it will go... @filipedeschamps "How to Hack a Node.Js" for Send multiple pipelined HTTP requests via a single connection. Find anywhere the developer has used an "Eval" and exploit it. Those are the quick 2 that fit easily in a HN comment.
- briantakita 13y ago
  > Send multiple pipelined HTTP requests via a single connection. That DoS attack vector was fixed. http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/ http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-... Also, some proxy servers will prevent such attacks. > Find anywhere the developer has used an "Eval" and exploit it. Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server. As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.
  - drakaal 13y ago
    @briantakita Node doesn't have a higher concentration of "good developers" that's easy to tell. "Good Developers" flock to research projects, and advancing the art. There isn't a single Node.JS project that is leading the industry in a field. Python, Lisp, Java, all have Language, AI, and Physics projects that are shaping science and advancing humanity, what does Node have? Also a quick Ego Search of yourself would tell pretty quickly where you rank on the "good developer list". I wouldn't normally "bash" a person for their arguments, but when you say the developers make node good and then I search your name to find out if you are totally awesome, RipOff Report doesn't inspire confidence.
    - briantakita 13y ago
      Gee thanks for the attack on my character! Yes, I had a lady extort me when I tried to help out one of my friends in the entertainment industry. She tried to charge for services that she didn't perform. I tried to send her a check for what we agreed on but she wouldn't give me an address and decided to attack me in public instead. I never met this lady nor talked to her before this incident happened. Btw, stay away from the entertainment crowd. Too much drama. Ripoff report also has great SEO. Character assassination is great and totally fair, lol! One thing I have learned from this experience is to spot bullshit and call it out immediately. And some of the things you have said, and now some of your actions, smell like bullshit. I'm sorry it upset you. Now can we stick to our actual discussion? Anyways, I have over 12 years experience and have been contributing to open source for a while. Projects including RSpec & RR. I'm pretty disciplined (automation, testing, good practices, etc) been a lead dev on a number of projects. I've done full stack web development (front end & back end), devops, scaling, scientific computing, & embedded systems. I worked with a number of startups. I've spoken at conferences. Check out my Linked In & Github profile if you want to see my caliber. What I meant by good developer is someone who is on the edge of technological movements. Yes, that even includes open source software. I was an early adopter in the Ruby community. I've been blessed by being around innovative people. I've rubbed elbows with the founders of Github, Ward Cunningham, and the many innovative developers that make up a strong community. It had a great feeling of innovation because there were great people involved. I feel (yes, it's a feeling), that the same spirit of innovation has moved to the node.js community. I agree that there is lots of innovation in the sciences. But that doesn't diminish the contributions of the many open javascript (& node.js) developers out there. What has been done in node.js? Keep your eyes open because it's unfolding before you right now. Yahoo, Google, Github, Walmart Labs, Twitter all seem to like it and they are doing a good job in "advancing the field". Your FUD can't do a thing about it. What have you done? You seem to be the "expert" on this manner, even though you can't even support your argument without ad hominem attacks.
akbar501 13y ago
> Most companies get Node to be "secure" by putting a Proxy in front of it. To build on this, every company I know of runs a proxy in front of every application server (across all languages). Further, there's also SSL termination which also happens before hitting the application server, plus normally the edge of network security sits out in front of the app server. Running these services in front of an app server is par for the course.

by drakaal 13y ago

lttlrck 13y ago

That doesn't mean there isn't a net benefit using NodeJS vs. other solutions.

filipedeschamps 13y ago

Ok, great, Node.js seems really insecure. Can you tell me how to hack a Node.js app so easily?

briantakita 13y ago

> If you set something like this up you can make anything secure I'm surprised there isn't an open source "secure" proxy service that you mentioned. It also makes sense to keep on top of updates. Also, if security is an important requirement, then it makes sense for the organization to use someone who knows what they are doing to set up the network and own the security requirement. Audits would also be prudent.

drakaal 13y ago

Since the tree is as deep as it will go... @filipedeschamps "How to Hack a Node.Js" for Send multiple pipelined HTTP requests via a single connection. Find anywhere the developer has used an "Eval" and exploit it. Those are the quick 2 that fit easily in a HN comment.

briantakita 13y ago
> Send multiple pipelined HTTP requests via a single connection. That DoS attack vector was fixed. http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/ http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-... Also, some proxy servers will prevent such attacks. > Find anywhere the developer has used an "Eval" and exploit it. Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server. As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.
- drakaal 13y ago
  @briantakita Node doesn't have a higher concentration of "good developers" that's easy to tell. "Good Developers" flock to research projects, and advancing the art. There isn't a single Node.JS project that is leading the industry in a field. Python, Lisp, Java, all have Language, AI, and Physics projects that are shaping science and advancing humanity, what does Node have? Also a quick Ego Search of yourself would tell pretty quickly where you rank on the "good developer list". I wouldn't normally "bash" a person for their arguments, but when you say the developers make node good and then I search your name to find out if you are totally awesome, RipOff Report doesn't inspire confidence.
  - briantakita 13y ago
    Gee thanks for the attack on my character! Yes, I had a lady extort me when I tried to help out one of my friends in the entertainment industry. She tried to charge for services that she didn't perform. I tried to send her a check for what we agreed on but she wouldn't give me an address and decided to attack me in public instead. I never met this lady nor talked to her before this incident happened. Btw, stay away from the entertainment crowd. Too much drama. Ripoff report also has great SEO. Character assassination is great and totally fair, lol! One thing I have learned from this experience is to spot bullshit and call it out immediately. And some of the things you have said, and now some of your actions, smell like bullshit. I'm sorry it upset you. Now can we stick to our actual discussion? Anyways, I have over 12 years experience and have been contributing to open source for a while. Projects including RSpec & RR. I'm pretty disciplined (automation, testing, good practices, etc) been a lead dev on a number of projects. I've done full stack web development (front end & back end), devops, scaling, scientific computing, & embedded systems. I worked with a number of startups. I've spoken at conferences. Check out my Linked In & Github profile if you want to see my caliber. What I meant by good developer is someone who is on the edge of technological movements. Yes, that even includes open source software. I was an early adopter in the Ruby community. I've been blessed by being around innovative people. I've rubbed elbows with the founders of Github, Ward Cunningham, and the many innovative developers that make up a strong community. It had a great feeling of innovation because there were great people involved. I feel (yes, it's a feeling), that the same spirit of innovation has moved to the node.js community. I agree that there is lots of innovation in the sciences. But that doesn't diminish the contributions of the many open javascript (& node.js) developers out there. What has been done in node.js? Keep your eyes open because it's unfolding before you right now. Yahoo, Google, Github, Walmart Labs, Twitter all seem to like it and they are doing a good job in "advancing the field". Your FUD can't do a thing about it. What have you done? You seem to be the "expert" on this manner, even though you can't even support your argument without ad hominem attacks.

akbar501 13y ago

> Most companies get Node to be "secure" by putting a Proxy in front of it. To build on this, every company I know of runs a proxy in front of every application server (across all languages). Further, there's also SSL termination which also happens before hitting the application server, plus normally the edge of network security sits out in front of the app server. Running these services in front of an app server is par for the course.