Douglas Wilson retweeted
Anyone can raise a CVE, so many do it without a valid reason other then trying to beef up their CV.
This issue github.com/mvel/mvel/issu… and the corresponding CVE nvd.nist.gov/vuln/detail/CV… are a clear example of this situation and at this point the whole process is becoming a joke.
This issue github.com/mvel/mvel/issu… and the corresponding CVE nvd.nist.gov/vuln/detail/CV… are a clear example of this situation and at this point the whole process is becoming a joke.
5
9
21
8,931
What is it that right in the end of the year holidays is when there is an uptick in security vulnerability reports? It is the hardest time of the year to assess and fix things. I received two just today, and 10 now since Nov 1.
0
0
3
449
Somehow the cyber security team @EY_US manages to be even worse, not only disingenuous, but even sending out the information with incorrect conclusions to all kinds of third parties before even confirming the issue with the project. So much for even private disclosure.
.@jfrog has a security team who will contact you stating they have potentially found a security vulnerability and let them know if you think it is, but assign a CVE prior to contact and argue that it is. My experience shows that their reports are disingenuous.
0
0
3
.@jfrog has a security team who will contact you stating they have potentially found a security vulnerability and let them know if you think it is, but assign a CVE prior to contact and argue that it is. My experience shows that their reports are disingenuous.
1
0
4
Douglas Wilson retweeted
The only goal of some security researchers is to rank up a high number of CVE against OSS projects.
They could not care less about users or the OSS project themselves.
They could not care less about users or the OSS project themselves.
4
2
22
I am currently a Principal Software Engineer working on an internal compute platform on the look out for new employment to grow myself and my career. Work on dev tools, microservices, product integrations, Kubernetes, product security, Node.js, C#, Golang, and more.
5
2
11
Heavily enjoy using and contributing to open source (github.com/dougwilson), web technologies and protocols are my life blood 😃 HTML5+, JavaScript, WebSocket, TLS, Kerberos, OAuth, HTTP 1/2/3, TCP/UDP, IPSec, etc. etc. Dissenting binary protocols. Testing! Code quality!
0
0
5
I remember implementing the fix for CVE-2014-6393 in Express. The code to enforce the charset in content types is one of the factors that affects the simple benchmarks against Express. Satisfying the security community is a cost Express pays for being the most popular...
0
0
7
Why do I care if @sourceclear categorizes security issues on my modules? Some say I should not care and not my problem. But I can't help but think about those who use my modules. I publish them so folks can use them, and evaluate them how I would other modules. cc @manicode
0
0
5
Why do I spend so much time in open source? For fame? Ha, I would rather be left alone. Money? I don't take money for it. I guess the reason is because I like to code and want it to be "meaningful" in some way versus just writing code only myself will use.
2
6
43
Why can security researchers and developers not perform more of a partnership instead of being hostile towards each other? For example, a developer who does not understand CSP should not accept pull requests according to security researcher? Why not educate instead?
5
0
11
Douglas Wilson retweeted
Mocha v4 will have breaking changes for some: boneskull.com/mocha-v4-nears… #nodejs #javascript #mochajs #mocha #tdd #bdd #testing
0
23
23
Douglas Wilson retweeted
🙌 Retweet if you use ExpressJS 🌟 and are grateful to @blipsofadoug for his excellent and tireless work maintaining it over the years. 🏆
11
262
257
Douglas Wilson retweeted
I replaced the whole file sending mechanism in `serve` with the "send" package from @blipsofadoug: github.com/zeit/serve/com…
1
1
3
Douglas Wilson retweeted
@blipsofadoug Nice to meet you yesterday! Super interested in response pipelines for Express and H2 support. Been using the `spdy` package.
0
1
2
Douglas Wilson retweeted
Glad to see #expressjs is alive and well! I am grateful to @blipsofadoug for his awesome work on this ubiquitous web framework! #Nodejs
Roadmap to Express 5.0 at #NodeInteractive
1
8
13
