A path towards securing every module

Static analysis, npm, and security. Presented at NodeSummit 2015.

Transcript

1. A path Towards
2. A path SECURING EVERY MODULE Towards
3. LETS TALK ABOUT These folks
5. Better CULTURAL REFERENCE
6. Better CULTURAL REFERENCE
8. You Are Probably Thinking HOW DO I SECURITY?
9. SCIENCE CAT SAYS
10. SCIENCE CAT SAYS GOOD QUESTION
12. Sort of like... TRON?
13. Sort of like... TRON? HE FIGHTS FOR THE USER, RIGHT?
15. IT turns out.... IT IS QUITE COMPLICATED
16. FIRST OFF....
17. FIRST OFF.... DISCLOSE RESPONSIBLY!
19. LIKE TO THE GOOD FOLKS AT THE NODE SECURITY PROJECT
21. THE QUESTION IS HOW DO WE FIND THEM?
23. I LED AN ACADEMIC RESEARCH STUDY LAST YEAR
24. SHOW YOUR ALMA MATER SOME LOVE
25. SHOW YOUR ALMA MATER SOME LOVE AND YES
26. SHOW YOUR ALMA MATER SOME LOVE AND YES WE WROTE A FORMAL RESEARCH PAPER AND EVERYTHING
28. ACADEMIC HCI IS A LITTLE SILLY
29. ACADEMIC HCI IS A LITTLE SILLY
    WHY DO LIKERT SCALES HAVE A NAME?
31. YOUR RESEARCH STUDY PLEASE TELL ME ABOUT
32. WE ASKED A A QUESTION LIKE ALL RESEARCH
33. THEIR COMMUNITIES? MODULE AUTHORS HOW DO ANSWER QUESTIONS ABOUT
35. EIGHT PROLIFIC MODULE AUTHORS SMALL GROUP OF
36. USED MOST INFREQENTLY MOST EFFECTIVE THE FEEDBACK MECHANISMS
37. USED MOST INFREQENTLY MOST EFFECTIVE THE FEEDBACK MECHANISMS
    
    
    GITHUB ISSUES
    
    
    WRITE A BLOG POST
    
    
    TWITTER DISCUSSIONS
    
    
    EMAIL A MAILING LIST
38. USED MOST INFREQENTLY MOST EFFECTIVE THE FEEDBACK MECHANISMS
    
    
    GITHUB ISSUES
    
    
    WRITE A BLOG POST
    
    
    TWITTER DISCUSSIONS
    
    
    EMAIL A MAILING LIST HOW DO WE A QUESTION LIKE THIS? BUT ANSWER
39. BY USING OF COURSE
40. MULTI-DEMENSIONAL GRAPH REPRESENTS A
42. FROM NEW YORK I AM
43. FROM NEW YORK I AM AND SO IS
46. ABOUT WAS ALWAYS
47. ABOUT WAS ALWAYS
48. AN ENGINEER BUT I AM ALSO
49. AN ENGINEER BUT I AM ALSO (
    3
    &
    "
    .
50. AN ENGINEER BUT I AM ALSO GRAPHS RULE EVERYTHING AROUND ME
51. AN ENGINEER BUT I AM ALSO GRAPHS RULE EVERYTHING AROUND ME Dolla Dolla Bill Y all ’
53. GRAPHS NOT THESE KINDS OF
54. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E
55. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E GRAPHS THESE KINDS OF
56. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E THESE GRAPHS DIFFERENT, OF COURSE ALL OF ARE
57. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E UNDIRECTED DIRECTECTED WEIGHTED TREES BIPARTITE
58. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E UNDIRECTED DIRECTECTED WEIGHTED TREES BIPARTITE TRANSPORATION NETWORKS INFORMATION NETWORKS MOLECULAR CHEMISTRY WIRELESS NETWORKS MAJOR LEAGUE BASEBALL DEPENDENCY MANAGEMENT
59. A B C D E 1 2 3 4 5 A B C D E F A B C D E A B C D E F G H 6 2 8 7 9 5 7 -3 A B C D E UNDIRECTED DIRECTECTED WEIGHTED TREES BIPARTITE TRANSPORATION NETWORKS INFORMATION NETWORKS MOLECULAR CHEMISTRY WIRELESS NETWORKS MAJOR LEAGUE BASEBALL DEPENDENCY MANAGEMENT SOUNDS COMPLICATED FOR my tastes. DEPENDENCY GRAPHS? I dont know
60. HIPSTER CAT SAYS
61. HIPSTER CAT SAYS ACTUALLY, IT S NOT SO BAD “ ” ’
62. 
    
    
    WITH A PACKAGE.JSON FILE { "name": "pkg-a", "dependencies": { "pkg-b": "~1.0.4", "pkg-c": "~2.1.3" }, "devDependencies": { "pkg-d": "~3.1.2" }, "main": "./index.js" }
63. 
    
    
    WITH A PACKAGE.JSON FILE na { "name": "pkg-a", "dependencies": { "pkg-b": "~1.0.4", "pkg-c": "~2.1.3" }, "devDependencies": { "pkg-d": "~3.1.2" }, "main": "./index.js" }
64. 
    
    
    WITH A PACKAGE.JSON FILE nb nc nd na { "name": "pkg-a", "dependencies": { "pkg-b": "~1.0.4", "pkg-c": "~2.1.3" }, "devDependencies": { "pkg-d": "~3.1.2" }, "main": "./index.js" }
65. 
    
    
    WITH A PACKAGE.JSON FILE nb nc nd na { "name": "pkg-a", "dependencies": { "pkg-b": "~1.0.4", "pkg-c": "~2.1.3" }, "devDependencies": { "pkg-d": "~3.1.2" }, "main": "./index.js" }
66. 
    
    
    WITH A PACKAGE.JSON FILE nb nc nd na Now imagine this for 100,000+ packages! { "name": "pkg-a", "dependencies": { "pkg-b": "~1.0.4", "pkg-c": "~2.1.3" }, "devDependencies": { "pkg-d": "~3.1.2" }, "main": "./index.js" }
67. ONLINE WITH VIDEOS THESE TALKS ARE ALL ALREADY
68. 5 5 DR. EMMETT OCTOCAT SAYS YOU VE GOT TO COME BACK WITH ME. BACK TO GITHUB! ’ “ ”
69. 5 5 DR. EMMETT OCTOCAT SAYS YOU VE GOT TO COME BACK WITH ME. BACK TO GITHUB! ’ “ ”
    
    
    indexzero/npm-codependencies
    
    
    indexzero/npm-comp-stat-www
    
    
    indexzero/npm-static-stats
    
    
    indexzero/npm-pipeline
70. QUESTIONS THE GRAPH? WHAT OTHER CAN WE ASK FROM
72. THESE QUESTIONS WHETHER YOU KNOW IT OR NOT YOU PROBABLY ASK EVERYDAY
73. NPM OUTDATED IS A PURE GRAPH QUESTION
74. DEPEND ON WHAT OTHER MODULES? WHO DEPEND ON X ALSO PEOPLE
75. USED MORE IN PRODUCTION OR IN DEVELOPMENT? ALSO IS THIS MODULE
76. THIS MODULE? “ ” MOST STABLE Version OF WHAT IS THE
77. STATIC ANALYSIS OTHER QUESTIONS NEED TO BE ANSWERED
78. A PARTICULAR METHOD? DO OTHER MODULES USE HOW OFTEN
79. VERSION X.y.Z SAFELY? BE UPGRADED TO USE CAN MY APP
81. SO Getting BACK TO SECURITY QUESTIONS
82. SHELLSHOCK? ARE VULNERABLE TO HOW MANY MODULES
83. UNSAFE REGULAR EXPRESSIONS? OF THESE MODULES HAVE How many
84. UNTRUSTED USER INPUT? MODULES EVAL WHICH
85. COMPUTE INTENSIVE BUT IT IS INCREDIBLY
86. COMPUTE INTENSIVE BUT IT IS INCREDIBLY WHICH IS TO SAY
87. PRETTY $&#@ SLOW COMPUTE INTENSIVE BUT IT IS INCREDIBLY WHICH IS TO SAY
89. NPM OUTDATED IS REALLY FAST. EVERY DAY THAT S HOW YOU CAN USE IT ’
90. YO DAWG I HEARD YOU LIKE NPM BY USING OF COURSE
91. YO DAWG I HEARD YOU LIKE NPM BY USING OF COURSE ALONG WITH DATA PIPELINE A
92. A B C D E F A B C D E F G H DEPENDENCY GRAPH AST COMPUTATION DOWNLOAD & UnTAR
93. A B C D E F A B C D E F G H DEPENDENCY GRAPH AST COMPUTATION DOWNLOAD & UnTAR DATA PIPELINE ANALYSIS WORK MODULES THE SET OF AND THE SPECIFIC CHANGES BUT, THE Stays the same DATA PIPELINE MAKING IT HIGHLY PARALLELIZABLE
94. 
    
    
    ESPRIMA + RECAST
    
    
    + npm + Data pipeline
    
    
    = npm-pipeline
96. GENERIC WORK TO PERFORM GENERIC MODULE AND A
97. TENS OF SECONDS FROM TENS of Minutes TO ANALYSIS TIME DOWN
98. QUESTIONS THE GRAPH? WHAT OTHER DO YOU HAVE FOR
99. THANKS {github, twitter}.com/indexzero indexzero@nodejitsu.com