Charles M Wood

Vzdělání

Byznys

Jak na to

Technika

JSJ 357: Event-Stream & Package Vulnerabilities with Richard Feldman and Hillel Wayne

JavaScript Jabber

Stay current on JavaScript, Node, and Front-End development. Learn from experts in programming, careers, and technology every week. Become a supporter of this podcast: <a href="https://www.spreaker.com/podcast/javascript-jabber--6102064/support?utm_source=rss&utm_medium=rss&utm_campaign=rss">https://www.spreaker.com/podcast/javascript-jabber--6102064/support</a>.

Sponsors<ul><li><a href="https://triplebyte.com/jsjabber" target="_blank" rel="noreferrer noopener">Triplebyte</a></li><li><a href="http://sentry.io/" target="_blank" rel="noreferrer noopener">Sentry</a> use the code “devchat” for $100 credit</li><li><a href="https://clubhouse.io/jsjabber" target="_blank" rel="noreferrer noopener">Clubhouse</a></li><li><a href="https://www.cachefly.com/" target="_blank" rel="noreferrer noopener">CacheFly</a></li></ul>Panel<ul><li>Aaron Frost</li><li>AJ O’Neal</li><li>Chris Ferdinandi</li><li>Joe Eames</li><li>Aimee Knight</li><li>Charles Max Wood</li></ul>Joined by special guests: Hillel Wayne and Richard FeldmanEpisode SummaryIn this episode of JavaScript Jabber, Hillel Wayne kicks off the podcast by giving a short background about his work, explains the concepts of formal methods and the popular npm package - event-stream, in brief. The panelists then dive into the recent event-stream attack and discuss it at length, focusing on different package managers and their vulnerabilities, as well as the security issues associated with them. They debate on whether paying open source developers for their work, thereby leading to an increase in contribution, would eventually help in improving security or not. They finally talk about what can be done to fix certain dependencies and susceptibilities to prevent further attacks and if there are any solutions that can make things both convenient and secure for users.Links<ul><li><a href="https://shemesh.larc.nasa.gov/iria03/p13-leveson.pdf" target="_blank" rel="noreferrer noopener">STAMP model in accident investigation</a></li><li><a href="https://twitter.com/Hillelogram?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" target="_blank" rel="noreferrer noopener">Hillel’s Twitter</a></li><li><a href="https://www.hillelwayne.com/about/" target="_blank" rel="noreferrer noopener">Hillel’s website</a></li><li><a href="https://twitter.com/rtfeldman?lang=en" target="_blank" rel="noreferrer noopener">Richard’s Twitter</a></li><li><a href="https://www.hillelwayne.com/post/stamping-on-eventstream/" target="_blank" rel="noreferrer noopener">Stamping on Event-Stream</a></li></ul>PicksJoe Eames:<ul><li><a href="https://boardgamegeek.com/boardgame/233312/stuffed-fables" target="_blank" rel="noreferrer noopener">Stuffed Fables</a></li></ul>Aimee Knight:<ul><li><a href="https://landing.google.com/sre/sre-book/toc/" target="_blank" rel="noreferrer noopener">SRE book - Google</a></li><li><a href="https://shop.lululemon.com/p/women-pants/In-Movement-78-Tight/_/prod8760192" target="_blank" rel="noreferrer noopener">Lululemon leggings</a></li><li><a href="https://open.spotify.com/artist/1QFYii9jMvldjVBUzBC9t2" target="_blank" rel="noreferrer noopener">DVSR - Band</a></li></ul>Aaron Frost:<ul><li><a href="https://2019.jsconf.us/" target="_blank" rel="noreferrer noopener">JSConf US</a></li></ul>Chris Ferdinandi:<ul><li><a href="https://pawsnewengland.com/" target="_blank" rel="noreferrer noopener">Paws New England</a></li><li><a href="https://vanillajsguides.com/" target="_blank" rel="noreferrer noopener">Vanilla JS Guides</a></li></ul>Charles Max Wood:<ul><li><a href="https://amzn.to/2S6YiQH?ie=UTF8&language=en_US&linkCode=ll1&linkId=f06bfe7482dca8bb751ed6d7cc86e2ab&qid=1548462018&sr=8-1&tag=devchattv-20" target="_blank" rel="noreferrer noopener">Sony Noise Cancelling Headphones</a></li><li><a href="https://classifieds.ksl.com/" target="_blank" rel="noreferrer noopener">KSL Classifieds</a></li><li><a href="https://www.upwork.com" target="_blank" rel="noreferrer noopener">Upwork</a></li></ul>Richard Feldman:<ul><li><a href="https://www.manning.com/books/elm-in-action" target="_blank" rel="noreferrer noopener">Elm in Action</a></li><li><a href="https://boardgamegeek.com/boardgame/102652/sentinels-multiverse" target="_blank" rel="noreferrer noopener">Sentinels of the Multiverse</a></li></ul>Hillel Wayne:<ul><li><a href="https://www.elminthespring.org/" target="_blank" rel="noreferrer noopener">Elm in the Spring</a></li><li><a href="https://www.apress.com/us/book/9781484238288" target="_blank" rel="noreferrer noopener">Practical TLA+</a></li><li><a href="https://www.ninachicago.com/" target="_blank" rel="noreferrer noopener">Nina Chicago - Knitting</a></li><li><a href="https://boardgamegeek.com/boardgame/214879/tomb-trader" target="_blank" rel="noreferrer noopener">Tomb Trader</a></li></ul>Special Guests: Hillel Wayne and Richard Feldman. Support this podcast at — <a href="https://redcircle.com/javascript-jabber/donations" target="_blank" rel="noreferrer noopener">https://redcircle.com/javascript-jabber/donations</a> Privacy & Opt-Out: <a href="https://redcircle.com/privacy" target="_blank" rel="noreferrer noopener">https://redcircle.com/privacy</a> Become a supporter of this podcast: <a href="https://www.spreaker.com/podcast/javascript-jabber--6102064/support?utm_source=rss&utm_medium=rss&utm_campaign=rss">https://www.spreaker.com/podcast/javascript-jabber--6102064/support</a>.

Sponsors<ul><li><a href="https://triplebyte.com/jsjabber" target="_blank" rel="noreferrer noopener">Triplebyte</a></li><li><a href="http://sentry.io/" target="_blank" rel="noreferrer noopener">Sentry</a> use the code “devchat” for $100 credit</li><li><a href="https://clubhouse.io/jsjabber" target="_blank" rel="noreferrer noopener">Clubhouse</a></li><li><a href="https://www.cachefly.com/" target="_blank" rel="noreferrer noopener">CacheFly</a></li></ul>Panel<ul><li>Aaron Frost</li><li>AJ O’Neal</li><li>Chris Ferdinandi</li><li>Joe Eames</li><li>Aimee Knight</li><li>Charles Max Wood</li></ul>Joined by special guests: Hillel Wayne and Richard FeldmanEpisode SummaryIn this episode of JavaScript Jabber, Hillel Wayne kicks off the podcast by giving a short background about his work, explains the concepts of formal methods and the popular npm package - event-stream, in brief. The panelists then dive into the recent event-stream attack and discuss it at length, focusing on different package managers and their vulnerabilities, as well as the security issues associated with them. They debate on whether paying open source developers for their work, thereby leading to an increase in contribution, would eventually help in improving security or not. They finally talk about what can be done to fix certain dependencies and susceptibilities to prevent further attacks and if there are any solutions that can make things both convenient and secure for users.Links<ul><li><a href="https://shemesh.larc.nasa.gov/iria03/p13-leveson.pdf" target="_blank" rel="noreferrer noopener">STAMP model in accident investigation</a></li><li><a href="https://twitter.com/Hillelogram?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" target="_blank" rel="noreferrer noopener">Hillel’s Twitter</a></li><li><a href="https://www.hillelwayne.com/about/" target="_blank" rel="noreferrer noopener">Hillel’s website</a></li><li><a href="https://twitter.com/rtfeldman?lang=en" target="_blank" rel="noreferrer noopener">Richard’s Twitter</a></li><li><a href="https://www.hillelwayne.com/post/stamping-on-eventstream/" target="_blank" rel="noreferrer noopener">Stamping on Event-Stream</a></li></ul>PicksJoe Eames:<ul><li><a href="https://boardgamegeek.com/boardgame/233312/stuffed-fables" target="_blank" rel="noreferrer noopener">Stuffed Fables</a></li></ul>Aimee Knight:<ul><li><a href="https://landing.google.com/sre/sre-book/toc/" target="_blank" rel="noreferrer noopener">SRE book - Google</a></li><li><a href="https://shop.lululemon.com/p/women-pants/In-Movement-78-Tight/_/prod8760192" target="_blank" rel="noreferrer noopener">Lululemon leggings</a></li><li><a href="https://open.spotify.com/artist/1QFYii9jMvldjVBUzBC9t2" target="_blank" rel="noreferrer noopener">DVSR - Band</a></li></ul>Aaron Frost:<ul><li><a href="https://2019.jsconf.us/" target="_blank" rel="noreferrer noopener">JSConf US</a></li></ul>Chris Ferdinandi:<ul><li><a href="https://pawsnewengland.com/" target="_blank" rel="noreferrer noopener">Paws New England</a></li><li><a href="https://vanillajsguides.com/" target="_blank" rel="noreferrer noopener">Vanilla JS Guides</a></li></ul>Charles Max Wood:<ul><li><a href="https://amzn.to/2S6YiQH?ie=UTF8&language=en_US&linkCode=ll1&linkId=f06bfe7482dca8bb751ed6d7cc86e2ab&qid=1548462018&sr=8-1&tag=devchattv-20" target="_blank" rel="noreferrer noopener">Sony Noise Cancelling Headphones</a></li><li><a href="https://classifieds.ksl.com/" target="_blank" rel="noreferrer noopener">KSL Classifieds</a></li><li><a href="https://www.upwork.com" target="_blank" rel="noreferrer noopener">Upwork</a></li></ul>Richard Feldman:<ul><li><a href="https://www.manning.com/books/elm-in-action" target="_blank" rel="noreferrer noopener">Elm in Action</a></li><li><a href="https://boardgamegeek.com/boardgame/102652/sentinels-multiverse" target="_blank" rel="noreferrer noopener">Sentinels of the Multiverse</a></li></ul>Hillel Wayne:<ul><li><a href="https://www.elminthespring.org/" target="_blank" rel="noreferrer noopener">Elm in the Spring</a></li><li><a href="https://www.apress.com/us/book/9781484238288" target="_blank" rel="noreferrer noopener">Practical TLA+</a></li><li><a href="https://www.ninachicago.com/" target="_blank" rel="noreferrer noopener">Nina Chicago - Knitting</a></li><li><a href="https://boardgamegeek.com/boardgame/214879/tomb-trader" target="_blank" rel="noreferrer noopener">Tomb Trader</a></li></ul>Special Guests: Hillel Wayne and Richard Feldman. Support this podcast at — <a href="https://redcircle.com/javascript-jabber/donations" target="_blank" rel="noreferrer noopener">https://redcircle.com/javascript-jabber/donations</a> Privacy & Opt-Out: <a href="https://redcircle.com/privacy" target="_blank" rel="noreferrer noopener">https://redcircle.com/privacy</a> Become a supporter of this podcast: <a href="https://www.spreaker.com/podcast/javascript-jabber--6102064/support?utm_source=rss&utm_medium=rss&utm_campaign=rss">https://www.spreaker.com/podcast/javascript-jabber--6102064/support</a>.

Aplikace Youradio Talk

JSJ 357: Event-Stream & Package Vulnerabilities with Richard Feldman and Hillel Wayne

Poslechněte si podcast