Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Guardscript – Detect any changes made to your JavaScript files

guardscript.com

Post reply on HN
Print view View original

1–10 of 39 posts

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#2

Post by Dyaz17 »

Hey HN!

I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2].

In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notification with the changes made. You can then detect any malicious modification by analyzing these results.I decided to build it for a broader audience.

I'd love feedback and suggestions on how to make it better.

Thanks!

[1] https://www.theregister.co.uk/2018/09/12/feedify_magecart_ja [2] https://www.zdnet.com/article/hackers-breach-statcounter-to-...

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#5

Post by leppr »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Suggestion: Monitor other potential attack vectors like CSS files.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#6

Post by netsharc »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

So as a hacker, I will just need to hack statcounter to serve your IP the non-molested JS, and almost everyone else the bad JS, right?

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#7

Post by ben509 »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Under "pricing" all the "start" buttons say "sart". (Checked Chrome and FF.)

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#8

Post by ben509 »

dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Some 3rd party services, though, serve up libraries, e.g. disqus.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#9

Post by ben509 »

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

What do you actually do about an alarm? Okay, I just got an email, check there's no release planned, I go through the diff and, oh crap, my customers are being pwned. Now I'm going to have to drop everything and manually disable those URLs until I can contact the maintainer of this service? I guess that's the unfortunate reality when using SaaS.

I'd want a runbook feature so that anyone getting the email has a procedure to:

* check release notes to identify a false alarm

* if not identify which source files the URL is used in

* disable those URLs

* flush caches

* confirm they're disabled

* contact the service provider

* roll back when upstream is fixed

Or something like that. Man, I do not miss ops work.

Post reply on HN