The Buzz at Node.JS Interactive

Key Takeaways

[Music] [Music] so one using no GF I can't take the same general yeah some of the same general safety precautions are usually taken a when I'm working with what a web application web server so you do you know authentication keys make sure you do validation and and sprout a daily scrubbing and make sure that you're that you're at least using some kind of like encryption and decryption for any kind of data that's important that to go back and forth password hashing so these are all kind of like the general things you can i use for like when you're doing dealing especially with a authentication either if its user authentication or education between requests we use the standard express module for security and ND standard node modules and we seem to have we're fairly confident in than we know the node and express keep updating them as as longer will these are found and we were of the mindset that if there's a known vulnerability in a package so a couple of months ago there was a heartbeat attack and it turned out that we needed to upgrade Mongoose so we did that and rectify the situation but in general I think security is pretty much mindset and a company so kind of like what DevOps 50 common in the networking community I think security and I in a general company has to be in mind that we have processes in place and programs programming patterns that you follow in order to make your appt secure we use sneak to monitor the you know dependencies I think that it's becoming people are becoming more aware that not your application code but your dependencies are we're like slalom abilities can lie and even if you're aware of you know all the different types of vulnerabilities in your own code you probably not watching it closely for definir dependencies so having some sort of dependency management using something maybe like greenkeeper to keep your dependencies up to date so you don't fall victim to you know new vulnerabilities to come out they can they come out all the time I think that's pretty fair way to stay secure or at least reasonably secure and that's so we've we've been doing that at CFPB and it's worked out well so far I was one of the early adopters of no jails for years ago and back in the day the modules weren't as mature the frameworks wasn't as mature we have great tooling we have great support from big companies they hiring core contributors and relating people work on open thurs that's amazing that something we didn't have 20 years ago and people were working on Java gel with the mainstream right so I see it will only get better but suddenly the Rays works work to me and needs to be done [Music] our enterprise applications are primarily Python chillin and we're moving more towards web applications for enterprise and to get mobile apps out to our constituents so they can see things like consumption meter alerts outage information and to be able to create it back in like with node.js for instance have a women or whoever interface that takes it in and send that to a mobile application it's kind of what we're trying to go to right and obviously security is a big thing so when you got this board interfacing application security is a big thing so we did talk to some of the vendors here about that and monitoring performance but also security aspects of it there's those sneaky ways that people again I get past security that's already out there now it was really like this I want to call them deep and I guess we call them beat packers you like we just know these very particular security holes for example I never really thought much about regex denial of service until it came up and then when that came out it was like a light bulb went on my head and just like wow I never thought people that I can get through my system that way so it these are these things that's not very commonly talked to policy go to big conferences like these or just very more like a specialized kind of discussions and meetings [Music] one of the main concerns that we find with our clients is actually vetting modules because the ecosystem is vast it's been growing exponentially for several years over 200,000 modules of NPM and the question is which ones do you trust so one of the things that we do is we we help clients select the right modules for them and the modules that are by trusted sources so there's a lot of trust based mechanisms I think that it's sort of implicit and in a way that we work other than that the way that we really deal with security is actually at a talent level for us as a consultancy firm we try to hire the best from the brightest who all of these people are very proficient and aware of of security needs on top of that we do internal reviews as well to catch anything it might have fallen through the gaps beyond that though we always recommend that a client gets software this written by other and collaboration with us over anyone pen tested by a separate party there's the only real ways that you can have the sort of assurance and insurance I suppose for any any vulnerabilities just the platform judge the language by itself is not going to prevent developers from some lazy habits from not validating your data from not applying best practices right so the best framework in the world the best platform of the world's not going to prevent that so it's part that developers need to learn those practices I went to a couple good talks and security today and that's what we need to teach and we need to write more blog posts by them your website about that to someone my courses to educate people and also the not foundation they've been great job in transparent about security leaks right so they need to continue doing that every time there is sound vulnerability they have a patch relatively quick and a few hours right so that's important to keep that kind of emergency mode and quick attach things are friends not to keep it secret and let people know some companies they still run on old versions of note so like you're going 10 well it's not going to have all the security patches if something happens right so they need to keep updating because if you have that technical death of a couple years and then you jump from zero point 10 to version 60 version 8 which we'll have next year so that's a huge jump right a lot of code will break you cannot do that in two days [Music] give them a pleasure