A Conversation about ZipSlip, NodeJS Security, and BBS Hacking
Earlier this year, the popular Bower package manager was found vulnerable to archive extraction, allowing attackers to write arbitrary files on a user’s disk. As it turns out, the vector attacks used by this exploit have been known since the early days of BBS. InfoQ has taken the chance to speak with Liran Tal to learn more about software security, and NodeJS security in particular.
Google Formalizes Robots Exclusion Protocol in Effort to Make It an Internet Standard
The Robots Exclusion Protocol (REP) has governed the rules defining how to prevent crawlers from accessing a website since 1994. Now, Google has submitted a draft to the Internet Engineering Task Force (IETF) to make it an Internet Standard. In addition, Google has open sourced its implementation of the protocol.
The Road to Removing JQuery from Gov.uk
When the team that maintains the gov.uk website faced the issue of updating their old and outdated jQuery dependency, they decided instead to get rid of it altogether. Among other benefits, they achieved a not negligible performance improvement and, in the process, created a migration guide for other developers to tap into.
Facebook MemLab Helps Finding JavaScript Memory Leaks
While JavaScript runtimes use garbage collection to manage memory, this does not rule out the possibility of leaking memory. To detect all possible cases where memory is leaked, Facebook created and open-sourced MemLab, a tool able to run predefined, automatable test scenarios and analyze heapshot diffs.