How does this compare with Semgrep, which to my understanding is the dominating open-source SAST offering to date?
Show HN: Bearer – Open-source code security scanning solution (SAST)
21–30 of 62 posts
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#22How does this compare with Semgrep, which to my understanding is the dominating open-source SAST offering to date?
I wouldn't say dominating tbh, but clearly one of the good solution out there for sure.
Probably the biggest differentiator is our ability to detect sensitive data flows and map those to the different security findings. It allows finding unique risks as sensitive data leaking in loggers for example, but also dynamically prioritize issues based on the type of sensitive data at risks or even decide it's not important if none are.
Let's say you're connecting to an unsecure API, we're going to assess if you're sending sensitive data or not there, depending on that we'll change the priority of the risk. If none are involved it would be a low risk, if PHI are involved it would be critical.
For the rest, I let you be the judge of the UX, quality of findings, speed etc.
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#23How does this compare with Semgrep, which to my understanding is the dominating open-source SAST offering to date?
I wouldn't say dominating tbh, but clearly one of the good solution out there for sure. Probably the biggest differentiator is our ability to detect sensitive data flows and map those to the different security findings. It allows finding unique risks as sensitive data leaking in loggers for example, but also dynamically prioritize issues based on the type of sensitive data at risks or even decide it's not important i…
Interesting! Thanks for responding. Sounds like it's bridging SAST and threat modeling.
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#24I wish these tools would just auto fix it for me. I hate messages like this:
> CRITICAL: Only communicate using SFTP connections.
If you know what’s wrong, then fix it. My integration or unit tests will fail if your fix doesn’t work.
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#25Earlier quoted context omitted.
AGPLv3 would ensure any changes by a big vendor would remain freely licensed. The current license for this project fails to meet the Open Source Definition (Criteria 6: No Discrimination Against Fields of Endeavor) since it restricts offering Bearer as a managed service.
That's right, we don't want to have someone doing managed service on top of us without a getting a license (or just an agreement). Basically, it's the AWS vs Elastic case, that resulted in this license. Happy to revisit the license in the future when we feel more protected, but for now, we've seen so much bad behaviors in this industry with big vendors taking advantages of small companies like ours.
> …we've seen so much bad behaviors in this industry with big vendors taking advantages of small companies like ours.
Firstly, I have absolutely no problem with your choice of license so don’t take this as a criticism of your project.
What I do take issue with is people releasing software under a “free” license and then complaining about people taking them up on their offer. This isn’t “taking advantage”, this is taking what they are freely giving.
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#26The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.
Gitlab has a great security dashboard for this. It organizes the output of multiple tools in a place where you can discuss, triage, ignore or track an issue to resolve it.
https://docs.gitlab.com/ee/user/application_security/securit...
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#27Earlier quoted context omitted.
That's right, we don't want to have someone doing managed service on top of us without a getting a license (or just an agreement). Basically, it's the AWS vs Elastic case, that resulted in this license. Happy to revisit the license in the future when we feel more protected, but for now, we've seen so much bad behaviors in this industry with big vendors taking advantages of small companies like ours.
> …we've seen so much bad behaviors in this industry with big vendors taking advantages of small companies like ours. Firstly, I have absolutely no problem with your choice of license so don’t take this as a criticism of your project. What I do take issue with is people releasing software under a “free” license and then complaining about people taking them up on their offer. This isn’t “taking advantage”, this is tak…
Not taken, just wanted to give the context of why this license.
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#28The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.
Github actually has this feature (only for open source and enterprise IIRC) when there is a SARIF output
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#29I wish these tools would just auto fix it for me. I hate messages like this: > CRITICAL: Only communicate using SFTP connections. If you know what’s wrong, then fix it. My integration or unit tests will fail if your fix doesn’t work.
Well, we're getting there, at least into proposing some fixes.
Automatically fixing is tricky, it means changing your code that can get automatically deployed in production without any other checks.. Dangerous. Not sure if you want to trust anyone to do that, tbh.
Also, considering all the edge-cases there are, it's impossible to guarantee that a fix won't break your code. If someone does, they just lie to you.
But I understand why you'd love that, as a developer, I do too :)
Re: Show HN: Bearer – Open-source code security scanning solution (SAST)
#30The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.
Github actually has this feature (only for open source and enterprise IIRC) when there is a SARIF output
SARIF output is on our Roadmap btw!
Github code scanning is not so great from what we've heard so far, but also it's very expensive, you need to be on the Enterprise plan...