JavaScript Vulnerabilities - The State of the Web

In this episode of The State of the Web, Rick and Tim talk about how insecure much of the Web really is. They talk about the various vulnerabilities in Web Security that can leave you open to attack, as well as the challenge of making your organization aware of these risks and how they could be exploited.

[mubelotix]

4:44 The fact that Chrome developers use Firefox as their main browser tells us a lot about Chrome security.

[IPTVJamaica]

The face you make when you detect a vulnerability 2:54 lol

[dandan]

after your code works
after your code performs
we should focus on security
but sadly, if we are working for someone else, it is unlikely to happen

[vinno]

I'm not denying that dependencies bring vulnerabilities to your code, but I'd also argue that most of these vulnerabilities would never have been fixed if they had been written by yourself.
Like 90% of all NPM vulnerabilities that I see are Regex DoS and I don't know many people who touch a Regex after it has been deemed "working". At least with 3th-party packages these bugs get eventually (or occasionally?) found

[orionx]

0:24 "There's so much to say about Web Security and people usually think about "Little Bobby Drop Tables" " 😂😂 he's referencing that XKDC about SQL injections, my professor showed me that, it's hilarious

[CTimmerman]

Fuzz every function in a sandbox and check whether it stays within expected parameters.

[Thytos]

I have the feeling that I only know the basics about security. How could I level up and learn what I should look out for?

[dandan]

having so many great javascript apis today
how feasible do you guys think it is to go back to vanilla js where the experienced devs rely mostly on the language features instead of "that specific framework"?

[adammorait]

Honesttly i would prefer to receive precise info about how to secure my code instead of a whole video talking state of the security on the web.

[pizza]

is this talking about server side or client side?

[KarlAlfredRoemer]

Does it make sense to install addons like noscript ?

[swwqlhw]

snyk always catches a ridiculous amount of development dependency vulnerabillities, which basically have no risk.

[Ramesh]

Expecting some live video for vulnerability attacks please do

[equiman]

Thanks... It's really scarry know this value. What is the web page where I can see it?

[AssemblyWizard]

The title is misleading, these are *WEB* vulnerabilities, unrelated to JS, I was expecting to hear about JS and was disappointed