Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Guardscript – Detect any changes made to your JavaScript files

guardscript.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#11

Post by BubRoss »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Why wouldn't someone just detect changes to the files at the OS level?

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#12

Post by koolba »

ben509 wrote: post #8
dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Some 3rd party services, though, serve up libraries, e.g. disqus.

And those 3rd party libs can dynamically load other files via script tags. The first level does not even have to change for dynamically loaded scripts to change.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#13

Post by godzillabrennus »

BubRoss wrote: post #11
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Why wouldn't someone just detect changes to the files at the OS level?

Not all hosts give you control at the OS level.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#14

Post by godzillabrennus »

Pricing seems high to me. A sub $10/month plan that lets someone check 30 files once a day or even once a week would be useful.

Plenty of small companies have god awful Wordpress sites with a ton of insecure JavaScript files. They don’t need to be checked every 10 minutes but they do need something to check.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#16

Post by leppr »

snek wrote: post #15

Imagine an internet where instead of making this tool, people stopped including billions of third party scripts.

Imagine an operating system where instead of making this tool, people stopped including billions of third party libraries.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#18

Post by missblit »

> How do you detect the modifications? We compute the hashes of the files regularly. If only one character in a file changes, his hash will change.

Does this include HTTP headers? For instance a yay.js framework that helps people print 'yay' to the console could return:

  HTTP/1.1 301 MOVED PERMANENTLY
  LOCATION: http://evil.evil/evil.js
  
  console.log('yay!');

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#19

Post by GhostVII »

dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Sounds pretty insane to me too, but I think it is valuable to let people do insane things more securely, as I don't think security concerns are generally a very big deterrent in software development (unfortunately).
Post reply on HN