Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Guardscript – Detect any changes made to your JavaScript files

guardscript.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#31

Post by Dyaz17 »

leppr wrote: post #4

This is good, but this won't stop the first few visitors from getting pwned. Client-side check (SRI) is still the best solution.

You are right. SRI is the best solution and I mention it in the FAQ. Unfortunately, it can't always be implemented. See my previous comment :

Well many companies that offer you a service don't include the Subresource integrity Tag. Check for instance Stripe : " rel="nofollow">https://js.stripe.com/v3"> or Facebook : " rel="nofollow">https://connect.facebook.net/en_US/sdk.js">

If they offer you a javascript and it has to change frequently to fix bugs, for instance, they don't want to be bothered with having to coordinate with all their customers to change the subresource integrity tag...

In this case, our service could be an alternative.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#32

Post by Dyaz17 »

stephenr wrote: post #23

Apart from the "SaaS services" (I mean, are they really services for services?), this seems to boil down to: "We can't trust SaaS.... so we built a SaaS to alert you when the JS delivered by your SaaS changes...". So now you have to trust this SaaS to tell you that the other SaaS is still trustworthy.

For now, Guardscript Goal is for the different SaaS services to use it, not for the individual website owners to use it to monitor the JS of SaaS services.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#33

Post by Dyaz17 »

missblit wrote: post #18

> How do you detect the modifications? We compute the hashes of the files regularly. If only one character in a file changes, his hash will change. Does this include HTTP headers? For instance a yay.js framework that helps people print 'yay' to the console could return: HTTP/1.1 301 MOVED PERMANENTLY LOCATION: http://evil.evil/evil.js console.log('yay!');

No it does not include the headers. Only the js file downloaded.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#34

Post by Dyaz17 »

godzillabrennus wrote: post #14

Pricing seems high to me. A sub $10/month plan that lets someone check 30 files once a day or even once a week would be useful. Plenty of small companies have god awful Wordpress sites with a ton of insecure JavaScript files. They don’t need to be checked every 10 minutes but they do need something to check.

Thanks for the suggestion.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#36

Post by Dyaz17 »

ben509 wrote: post #9
Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

What do you actually do about an alarm? Okay, I just got an email, check there's no release planned, I go through the diff and, oh crap, my customers are being pwned. Now I'm going to have to drop everything and manually disable those URLs until I can contact the maintainer of this service? I guess that's the unfortunate reality when using SaaS. I'd want a runbook feature so that anyone getting the email has a proced…

You are right, for now all the analysis should be done by the owner of the script. I'll think about adding a runbook...

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#37

Post by jjeaff »

dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Lots of 3rd party services don't allow you to host your own copy of their library.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#38

Post by [deleted] »

jjeaff wrote: post #37
dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Lots of 3rd party services don't allow you to host your own copy of their library.

[deleted]

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#39

Post by graphememes »

viraptor wrote: post #20
graphememes wrote: post #17

You could do this with a free serverless function on aws, why would I pay for it

To save time you'd otherwise spend writing and testing the serverless function. This applies to literally every SaaS.

This isn't particularly a hard thing to do, and the testing framework is pretty much baked into AWS. There are libraries to do this already.

You do you though.

Post reply on HN