I’d say I told you so…

But what’s the point? The people who realize that using Javascript for everything is a bad idea don’t need me lecturing them. The people who want to use Javascript for everything couldn’t create a secure system, much less understand the realities of a hostile environment if their life depended on it. Their fandom precedes the ability for critical thinking.

This is why when I read this, this morning;

This impacts Node at the Buffer to UTF8 String conversion and can cause a process to crash. The security concern comes from the fact that a lot of data from outside of an application is delivered to Node via this mechanism which means that users can potentially deliver specially crafted input data that can cause an application to crash when it goes through this path.

I said, “And nothing will change.” At least, as a minor saving grace, HTTP(S) headers do not fall vulnerable to this particular bug, but that’s mainly the headers there is question to the remainder of the processing.

The fact is, nothing is perfect, nothing is fool-proof, and frankly my hate for Javascript is largely due to the people I find who fall over themselves defending it. Does it serve a purpose? Yup, you bet. Is is a hammer that should be used while seeing every problem as a nail? Absolutely NOT.

 

Tagged , . Bookmark the permalink.

About Barron

Barron is the owner, editor, and principal author at The Minuteman, a competitive shooter, and staff member for Boomershoot. Even in his free time he’s merging his love and knowledge of computers and technology with his love of firearms. He has a BS in electrical engineering from Washington State University. Immediately after college he went into work on embedded software and hardware for use in critical infrastructure. This included cryptographic communications equipment as well as command and control devices that were using that communications equipment. Since then he’s worked on just about everything ranging from toys, phones, other critical infrastructure, and even desktop applications. Doing everything from hardware system design, to software architecture, to actually writing software that makes your athletic band do its thing.

Comments are closed.