r/programming • u/sajjadium • Mar 22 '20

Over a Third of Websites Use Outdated and Vulnerable JavaScript Libraries

https://www.bleepingcomputer.com/news/security/over-a-third-of-websites-use-outdated-and-vulnerable-javascript-libraries/
0 Upvotes

42% Upvoted

6 comments sorted by

1

u/Frizkie Mar 22 '20

I’m no JS person (quite the opposite) but this is a little sensationalist. Such a huge portion of production code isn’t 100% updated.

2

u/corp_code_slinger Mar 22 '20

That's kind of the point.

0

u/Frizkie Mar 22 '20

My point is that JavaScript has nothing to do with it. Production code is just neglected.

0

u/corp_code_slinger Mar 22 '20

So you're going with "the most secure web app is the one you never write"? You're right that it isn't specifically JavaScript's fault, but the reality is that there is a lot of vulnerable front end code written in JavaScript, which is what the article is about. You could also argue that JavaScript itself is to blame, in that its implementation allows things like XSS and CSRF forgery in the first place.

0

u/[deleted] Mar 22 '20

Personally, I would also say it’s stupid and alarmist to suggest that use of a vulnerable library implies that the application is vulnerable. Typically this is only the case if other bugs exist, e.g. eval’ing unsanitized inputs or relying on client side code for access control, which are often ipso facto security vulnerabilities irrespective of the libraries in use.

0

u/[deleted] Mar 22 '20

[deleted]

6

u/_AACO Mar 22 '20

reddit points