JSConf 2013 Builders vs Breakers

Builders vs Breakers

Saturday, June 1, 13

Hi, I’m Adam


Hi, I’m Adam@adam_baldwin@liftsecurity@nodesecurity


Hi, I’m Adam@evilpacket




Builders Breakers


Builders Breakers


“Fix your captcha so the value isn't actually hidden in the form. (put it in the session and check the post) Friend of the fritz..”

-Adam



“you guys”


Basecamp ClassicSaturday, June 1, 13

“xss is not a feature”Saturday, June 1, 13

Feelings?







Cooperation


Communication


When we listen, really listen, we reveal respect, support, understanding, empathy... We also possess the power to impart a renewed confidence, clarity, and a sense of everything-is-going-to-be-okay when we listen well.

- Stephanie Maier

http://thepot-luck.com/stephaniemaier/all-you-have-to-do-is-listen/




Basecamp ClassicSaturday, June 1, 13

http://37signals.com/security-responseSaturday, June 1, 13

http://37signals.com/security-response








So what can I doas a developer?


SECURITY.md#How to report issue#Expectations#List of humans


http://emberjs.com/security/




Self Disclosureof

VulnerabilitiesSaturday, June 1, 13

Handling a security failure well can build trust.


A new project based on what we’ve learned

aboutbuilders vs breakers


Node Security ProjectSaturday, June 1, 13

andbang.comSaturday, June 1, 13

Node Security Project?


Adam BraultNathan LaFreniereBearMikeal RogersDaniel Shaw

Major ContributorsNeal PooleLuca CarettoniSteven Rivas JrArlo BreaultJacopo Tarantino


Audit every module


31233modules


Fix the broken things


Report Issues we find


Send Pull Requests


Example: Hubot





Publish the results



How to Contribute


nodesecurity.io


- Respect & understand feelings- Proactively communicate & listen- It’s okay to mess up—it can even build trust

Quick Recap


</PRESENTATION>@adam_baldwin | @LiftSecurity


Technology

JSConf 2013 Builders vs Breakers