[Applause]
hi I'm in focus from mnms today I'm
sorry all of them it's a set of security
tools jump straps
I'm gonna be talking really really fast
so if you don't catch everything please
come a few questions later you won't
want to give that up
otherwise I don't wind up doing ok so if
you is if you're building anything with
JavaScript front-end back-end wallet
yeah anything couple people okay
you really need to understand the
security situation with JavaScript and
dependencies
recently there was the bit days opens
are small that okay a big my mouth was
hacked by independencies and a few of
little girl vulnerable versions of the
well published and there was some loss
associated with that
[Music]
okay so under your talkin a lot of love
no it's a set of security tools for any
JavaScript map to mitigate software
supply chain risk everybody will
dependencies this is the total event for
any jobs from happening to expect
especially relevant for deaf you eyes
and bullets
so let's talk about an event extreme
this is the calm people will attack
immediately
big splash that happened in 20 you deep
essentially so about Jen Palmer number
of goes quickly something that very well
I've been paying essentially trusted all
the upstream dependencies the MPM
communities and their developers to
never inject malicious code into their
wall
so if dependencies can go back how can
you fix that there's much a discussion
right some people say never use
dependencies I think this is kind of
terrible because the the joy of
Technology that builds on technology and
we all look for it and it kind of maybe
ruins the whole like the renewal
maintainer on crypto so humanities can
be nuts and the other cyclists on it all
infinity always and of course this is a
good idea but it's not always practical
especially let's say you have some
potentially lost causing logic in
production and you've got a push a
hotfix do you have time to own all the
dependencies and how they interact with
other dependencies hopefully but we've
done so is there nothing else that we
can do to improve the situation so Mark
Miller from a boring has been working on
security languages for over 30 years
don't work with JavaScript over ten
years if you've heard of promises week
Maps strictmode
you're familiar with some of this work
is this great book don't have security
remove insecurity this is referring to
object abilities sin being less
gracefully remove everything and then
only have what you need to do you know
feature those features in the hands of
bad guys are basically attack vectors so
they don't work being he's for the
cheeks like this attic or been working
on secure atmosphere listen and assess
and it's basically a security Val
statement where you can control what
that coat that's access to with it
divided rates and it works through
frozen physics book freezes down like
things like objects that are raised you
may not know it but you can override it
what a readout map does and that might
ruin your something's about what has
access to what data and so the simple
simple version of the solution is just
appreciate a prime time to save
dependencies right boots or your
dependencies can't mess with things and
then also explicitly thing down it's
like I said when you do you know you get
some packs in what has access to so that
might look like you're evaluating module
you passive just the platform API is
irrelevant okay so love them
builds on top of that and to pray so
runtime collections for bundles so you
give those basics animators for like
object array you get a per package up
for maybe I access controls and you can
protect modules from corrupting each
other through the pensiero and I'm
totally out of time so come ask me about
this more thanks
[Applause]
you