dependencies
6 articles with this tag
What is OpenSSL — the library under HTTPS, and how to defend it
OpenSSL = the open-source library that powers HTTPS (TLS/SSL) and crypto. Most people never write it directly — they inherit it via the web server, OS, or language runtime. That's why one bug has an enormous blast radius (Heartbleed is the classic case). Defense: know which OpenSSL your stack uses, don't run EOL versions, include foundational libraries in CVE monitoring, and patch promptly. Even the certificates this site serves run crypto through an OpenSSL-family implementation underneath.
Fixing dependency CVEs for real: scan, fix, isolate, and keep watching
Vulnerability work isn't done when you 'fix it.' Done = 1) scan, 2) fix, 3) isolate/hand off, 4) monitor. Until monitoring (daily change-detection) is in place, it's incomplete — dependencies turn vulnerable again tomorrow. A perfect fix that the next deploy overwrites is worth zero. Small teams stay safe with two disciplines: automated change-detection and 'local→push→deploy.'
Installing and using osv-scanner: find CVEs in your dependencies
osv-scanner scans lockfiles and containers to surface CVEs in your dependencies, free. This walks through install, run, and CI integration, plus when to use it vs npm/pnpm audit vs Dependabot. This site's view: the right tool is decided by YOUR setup — reach for osv-scanner on multi-ecosystem or GitHub-free projects, and the bundled pnpm audit for a single npm tree.
Log4Shell (CVE-2021-44228) — the night the world feared a bug it couldn't even confirm it had
Log4j's CVSS 10.0 bug. The real fear was the transitive dependency — being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four pillars: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: indie devs lose not on knowledge but on operational continuity — win with a system that doesn't miss, not with speed.
The XZ Utils backdoor (CVE-2024-3094) — when trust itself was the target
A trusted maintainer planted a backdoor in xz — a supply-chain attack. One engineer's 'this feels slow' caught it just before stable. Code wasn't the target — people and trust were. Minimize dependencies, pin versions, build reproducibly, chase anomalies, and support maintainers.