BjornW

Hi,

At my current client I've been doing more and more security related tasks such as audits on external software. Currently the type of software I audit are WordPress plugins. I have more than 15yrs of experience with WordPress and in the past I could fairly easily assess a WordPress plugin's potential security impact(s). Nowadays not so much due to the seemingly increased usage of npm packages included with these plugins.

Often these plugins do not include a package.json, package-lock.json nor are the javascript files readable (bundled & minified). This makes using npm audit near impossible. Good for production, less for audits.

Sometimes I can grab development files such as package.json, package-lock.json from a public repo, but in the case of so-called 'premium' plugins a public repo is usually absent.

So my question is: How do you (security) audit external software depending on npm packages?

I'm wondering if more people have this issue. I was adding items to my wishlist when I noticed that items on the wishlist were always cheaper than the cheapest buy option on the item's page. This seems to be a bug or a really annoying scammy 'feature'.

Reproduce: 1) Pick an item and add it to your wishlist 2) Check the price of the item on it's page 3) Compare the price with the price on the wishlist 4) The price on the wishlist is lower than the actual cheapest buy option.

Example: The User Experience Team of One: A Research and Design Survival Guide [Kindle Edition] http://www.amazon.com/dp/B00DUITE5Q/ item price: $17.53 wishlist price: $12.49

Notes: The items are added to the wishlist and instantaneously checked. I've only checked Kindle ebooks. I'm not residing in the USA and the price difference does NOT equal our VAT.

Public response of Amazon so far: 'Adding an item to your Wish List doesn't reserve the price shown.' https://twitter.com/AmazonHelp/status/414146213764927488

It seems Amazon does not use the current price at all when displaying items on a wishlist. I'm wondering if I am the only one seeing this behaviour. I also wonder if this is a bug or some sort of asshole pricing strategy (I don't think so, but who knows).

I'm refining a concept for a hackers card game with the working title "Smartass". One of the core concepts is answering questions within one of six categories. Currently the categories I'm working on are:

1. Hardware (example question: What is the meaning of the acronym RISC?)

2. Software (example question: Emacs Vs ...)

3. History (example question: Who coined the term 'bit' in 1948?)

4. People (example question: What is the name of the founder of Free Software Foundation?)

5. Jargon (example question: What is a magic byte (magic number)?)

6. Popular Culture (example question: In which movie is nmap being used?)

I have a few questions for you guys & gals: What do you think about these categories & in lesser extent the example questions? Would you want to play a card game specifically dealing with hackers culture? What would you want to pay for this?

Looking forward to your input,

Thanks!

I'm looking for a VPS provider which allows me to download a VM and use it locally. I would like to develop locally and create a new version of the VM which I than could upload to the VPS. This should make it a lot easier to deploy a new system based on several packages, configuration and code. Anyone know of such a service?

Bassel Bassel Khartabil - an open source software contributor to projects such as Creative Commons & Mozilla has been unjustly detained for nearly four months without trial or any legal charges being brought against him.

Read more & sign the support letter: http://freebassel.org/

ps: Help get this on the frontpage of HackerNews