Hacker News Reader

Comment by markvdb | Hacker News Reader

> While WildDuck is more secure by definition than most alternatives > ... > You can run WildDuck on any system that supports Node.js,

Node.js and more secure by definition? That sounds _very_ strange to me...

View on HN

For secure by definition I meant:

* written in memory safe language

* no special permissions needed (besides binding to privileged ports at start but there are workarounds) so no need to be able to chown or spawn workers under different user id's

* no file access for the running daemon, once the daemon starts then it does not read nor write to the local file system

* no spawning shell commands

each of these things is a target for a different attack vector

I get that this is a meme, but v8 is one of the most battle-hardened runtimes out there, plus you don't manage your own memory or concurrency primitives, which are the sources of most security issues.

v8 may be badass. but the quality of many of the libraries in the node ecosystem is .... questionable at best. Lots of newbs with no clues about security throwing out packages that people end up with in their dependency trees and never stop to ponder the security / quality of.

Maybe because "Microsoft: 70 percent of all security bugs are memory safety issues"

I guess they mean “Secure by Design” but it doesn’t inspire confidence indeed..

Do large companies provide data security with very well-known languages?

Reply on news.ycombinator.com