1. Wednesday, October 2, 13

2. Hi, I’m Adam
Wednesday, October 2, 13

3. Hi, I’m Adam
@adam_baldwin
@liftsecurity
@nodesecurity
Wednesday, October 2, 13

4. Hi, I’m Adam
@evilpacket
Wednesday, October 2, 13

5. Wednesday, October 2, 13

6. Wednesday, October 2, 13

7. Wednesday, October 2, 13

8. Wednesday, October 2, 13

9. Wednesday, October 2, 13

10. Node Security Project
Wednesday, October 2, 13

11. Why
Wednesday, October 2, 13

12. •precommit-hook for linting
•pull requests for peer review
•education / values
Things we had control over
Wednesday, October 2, 13

13. •other peoples code
•the delivery system (npm)
Things we didn’t have control over
Wednesday, October 2, 13

14. npm install altlhethings
Wednesday, October 2, 13

15. npm install fs
Wednesday, October 2, 13

16. npm install http
Wednesday, October 2, 13

17. npm install socketio
Wednesday, October 2, 13

18. 404
Wednesday, October 2, 13

19. ~/analyzer$ node print.js ./output/output.json
buffer: 604
child_process: 2867
dgram: 836
dns: 674
fs: 15036
http: 12084
https: 2819
os: 1311
readline: 909
string_decoder: 65
timers: 230
tty: 335
vm: 354
Wednesday, October 2, 13

20. •Core modules....
•Punctuation is hard
•Improve integrity checking
Conclusions
Wednesday, October 2, 13

21. Wednesday, October 2, 13

22. How
Wednesday, October 2, 13

23. nodesecurity.io/contributors
Wednesday, October 2, 13

24. New Process
Wednesday, October 2, 13

25. Wednesday, October 2, 13

26. Wednesday, October 2, 13

27. Wednesday, October 2, 13

28. Wednesday, October 2, 13

29. Wednesday, October 2, 13

30. Wednesday, October 2, 13

31. Wednesday, October 2, 13

32. child_process.exec
[pid 31152] execve("/bin/sh", ["/bin/sh", "-c", "ls"]
child_process.execFile
[pid 31176] execve("/bin/ls", ["/bin/ls"]
Wednesday, October 2, 13

33. Wednesday, October 2, 13

34. Catalyst for Change
Wednesday, October 2, 13

35. Improved Resources
Wednesday, October 2, 13

36. Private issues
&
Pull Requests
Wednesday, October 2, 13

37. “I wish @github had private issues
and pull requests for open source
projects to improve responsible
disclosure of security issues! Please
RT”
j.mp/lxjs-nsp
Wednesday, October 2, 13

38. nodeschool.io
Wednesday, October 2, 13

39. security.md
Wednesday, October 2, 13

40. github.com/nodesecurity
Wednesday, October 2, 13

41. </presentation>
@adam_baldwin
@liftsecurity
@nodesecurity
@evilpacket
Wednesday, October 2, 13