Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Guardscript – Detect any changes made to your JavaScript files

guardscript.com

Post reply on HN
Print view View original

21–30 of 39 posts

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#21

Post by jjeaff »

netsharc wrote: post #6
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

So as a hacker, I will just need to hack statcounter to serve your IP the non-molested JS, and almost everyone else the bad JS, right?

If you want to mitigate that, you simply need to run this from, or proxy the request through, some other random ip address.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#22

Post by jjeaff »

BubRoss wrote: post #11
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Why wouldn't someone just detect changes to the files at the OS level?

It sounds like this is talking about 3rd party scripts included in the page. Like Google analytics and the like.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#23

Post by stephenr »

Apart from the "SaaS services" (I mean, are they really services for services?), this seems to boil down to:

"We can't trust SaaS.... so we built a SaaS to alert you when the JS delivered by your SaaS changes...". So now you have to trust this SaaS to tell you that the other SaaS is still trustworthy.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#24

Post by quickthrower2 »

stephenr wrote: post #23

Apart from the "SaaS services" (I mean, are they really services for services?), this seems to boil down to: "We can't trust SaaS.... so we built a SaaS to alert you when the JS delivered by your SaaS changes...". So now you have to trust this SaaS to tell you that the other SaaS is still trustworthy.

That's the premise behind most security software. We can't trust the internet, so download a firewall from the internet to block traffic from the internet.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#25

Post by jhgg »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

>GuardScript is usefull when Subressource integrity is not feasible or not implemented, which is most of the time for SaaS services.

Can you explain what this means?

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#26

Post by stephenr »

quickthrower2 wrote: post #24
stephenr wrote: post #23

Apart from the "SaaS services" (I mean, are they really services for services?), this seems to boil down to: "We can't trust SaaS.... so we built a SaaS to alert you when the JS delivered by your SaaS changes...". So now you have to trust this SaaS to tell you that the other SaaS is still trustworthy.

That's the premise behind most security software. We can't trust the internet, so download a firewall from the internet to block traffic from the internet.

The software you download is generally signed by a party that you do trust though, and then runs locally on your computer.

And of course, that also doesn't really apply if you're using an operating system that includes a firewall by default.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#27

Post by Dyaz17 »

jhgg wrote: post #25
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

>GuardScript is usefull when Subressource integrity is not feasible or not implemented, which is most of the time for SaaS services. Can you explain what this means?

Well many companies that offer you a service don't include the Subresource integrity Tag.

Check for instance Stripe : " rel="nofollow">https://js.stripe.com/v3"> or Facebook : " rel="nofollow">https://connect.facebook.net/en_US/sdk.js">

If they offer you a javascript and it has to change frequently to fix bugs, for instance, they don't want to be bothered with having to coordinate with all their customers to change the subresource integrity tag...

In this case our service could be an alternative.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#28

Post by Dyaz17 »

ben509 wrote: post #7
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Under "pricing" all the "start" buttons say "sart". (Checked Chrome and FF.)

Thank you! I have changed it.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#29

Post by Dyaz17 »

leppr wrote: post #5
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Suggestion: Monitor other potential attack vectors like CSS files.

Thanks for the suggestion

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#30

Post by Dyaz17 »

jjeaff wrote: post #22
BubRoss wrote: post #11

Earlier quoted context omitted.

Why wouldn't someone just detect changes to the files at the OS level?

It sounds like this is talking about 3rd party scripts included in the page. Like Google analytics and the like.

Exactly.
Post reply on HN