LavaMoat: MetaMask's Approach to Secure App by Aaron Kumavis (Devcon5)

Transcript

[Applause] hi I'm in focus from mnms today I'm sorry all of them it's a set of security tools jump straps I'm gonna be talking really really fast so if you don't catch everything please come a few questions later you won't want to give that up otherwise I don't wind up doing ok so if you is if you're building anything with

JavaScript front-end back-end wallet yeah anything couple people okay you really need to understand the security situation with JavaScript and dependencies recently there was the bit days opens are small that okay a big my mouth was hacked by independencies and a few of little girl vulnerable versions of the well published and there was some loss associated with that [Music] okay so under your talkin a lot of love

no it's a set of security tools for any JavaScript map to mitigate software supply chain risk everybody will dependencies this is the total event for any jobs from happening to expect especially relevant for deaf you eyes and bullets so let's talk about an event extreme this is the calm people will attack immediately big splash that happened in 20 you deep essentially so about Jen Palmer number of goes quickly something that very well I've been paying essentially trusted all the upstream dependencies the MPM communities and their developers to never inject malicious code into their wall

so if dependencies can go back how can you fix that there's much a discussion right some people say never use dependencies I think this is kind of terrible because the the joy of Technology that builds on technology and we all look for it and it kind of maybe ruins the whole like the renewal maintainer on crypto so humanities can be nuts and the other cyclists on it all infinity always and of course this is a good idea but it's not always practical especially let's say you have some potentially lost causing logic in production and you've got a push a hotfix do you have time to own all the dependencies and how they interact with other dependencies hopefully but we've done so is there nothing else that we can do to improve the situation so Mark

Miller from a boring has been working on security languages for over 30 years don't work with JavaScript over ten years if you've heard of promises week Maps strictmode you're familiar with some of this work is this great book don't have security remove insecurity this is referring to object abilities sin being less gracefully remove everything and then only have what you need to do you know feature those features in the hands of bad guys are basically attack vectors so they don't work being he's for the cheeks like this attic or been working on secure atmosphere listen and assess and it's basically a security Val statement where you can control what

that coat that's access to with it divided rates and it works through frozen physics book freezes down like things like objects that are raised you may not know it but you can override it what a readout map does and that might ruin your something's about what has access to what data and so the simple simple version of the solution is just appreciate a prime time to save dependencies right boots or your dependencies can't mess with things and then also explicitly thing down it's like I said when you do you know you get some packs in what has access to so that might look like you're evaluating module you passive just the platform API is irrelevant okay so love them

builds on top of that and to pray so runtime collections for bundles so you give those basics animators for like object array you get a per package up for maybe I access controls and you can protect modules from corrupting each other through the pensiero and I'm totally out of time so come ask me about this more thanks [Applause] you