Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcoming Semmle to GitHub

github.blog

Post reply on HN
Print view View original

81–90 of 110 posts

Re: Welcoming Semmle to GitHub

#81

Post by collingreene »

lawnchair_larry wrote: post #73
DannyBee wrote: post #69

Earlier quoted context omitted.

"and I don’t know Fermin, but taking a CSO role there would suggest to me that he believes in it." Sure, but Fermin was also offered a fairly ridiculous amount of money and a serious promotion :) I mean, he doesn't not believe in it, of course, but i also think most folks would have taken the role in his situation. IE it's not the kind of offer that really required a lot of faith I'll try to write a bit more later af…

So I did read a whitepaper about static analysis at Google, and how it was largely self-serve - let developers run the tools and fix what it tells them to as they see fit. I’m wondering if it was under this model where you found it was not useful. I would not expect it to provide much value in that scenario, and would not be surprised by your feedback. If your data is closer to a model where security bug hunters whos…

Here is our experience building and using program analysis as part of our product security efforts at facebook: https://engineering.fb.com/security/zoncolan/.

Its run in both self-service (output to developers), guided (output to product security oncall of security engineers) and used ad-hoc to power up manual security reviews. Depending on the accuracy of each rule and the impact of the pattern of security flaw the rule finds it is promoted to ultimately output to developers directly.

It finds about a third of the security vulns we unearth each year.

Re: Welcoming Semmle to GitHub

#82

Post by _xnmw »

spjt wrote: post #40
_xnmw wrote: post #12

I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

They have to say that anyway, because Microsoft is acquiring Semmle, not GitHub. It is joining the GitHub "product family".

If they had said "Welcoming Semmle to the Github Family of Products" instead, that would've been much more tolerable.

Re: Welcoming Semmle to GitHub

#83

Post by [deleted] »

andyfleming wrote: post #30
_xnmw wrote: post #14

Earlier quoted context omitted.

Intent matters. The phrase "parent corporation" has no PR or emotional intent. "Welcoming X to Y family" has a clear emotive intent.

Maybe the intent of the writer was to make the new hires feel welcome aboard to their new company. That's also not mutually exclusive of the emotive intent you are describing. What makes that Orwellian though?

[deleted]

Re: Welcoming Semmle to GitHub

#84

Post by strogonoff »

lawnchair_larry wrote: post #72
tptacek wrote: post #54

Earlier quoted context omitted.

First of all, Daniel Berlin is pretty senior at a reasonably large tech company a lot of us here have heard of. Secondly, I know Microsoft loves it, which is presumably where your telemetry comes from, and I know a lot of security people on Twitter are fans of the technology, but I've been asking around and "love it" is not the signal I'm getting from software security blue team people. "I installed it, I guess it do…

It’s absolutely useless in the wrong hands, so I don’t think you’d necessarily get a good signal by asking your average blue teamer. It’s a godsend for someone who spends a lot of time auditing code and has some experience writing code analysis tools. I mean think about it, if you wanted to write a query against the AST of a target, would you find that useful? Or in a given codebase, if you find one bug, would you li…

I’d presume the tool would be used by a whole team, not just Thomas alone, and hence be licensed to a company… Are you saying that they don’t sell the tool to infosec businesses working with multiple end customers?

Re: Welcoming Semmle to GitHub

#85

Post by lawnchair_larry »

strogonoff wrote: post #84
lawnchair_larry wrote: post #72

Earlier quoted context omitted.

It’s absolutely useless in the wrong hands, so I don’t think you’d necessarily get a good signal by asking your average blue teamer. It’s a godsend for someone who spends a lot of time auditing code and has some experience writing code analysis tools. I mean think about it, if you wanted to write a query against the AST of a target, would you find that useful? Or in a given codebase, if you find one bug, would you li…

I’d presume the tool would be used by a whole team, not just Thomas alone, and hence be licensed to a company… Are you saying that they don’t sell the tool to infosec businesses working with multiple end customers?

That’s correct. They sell to whoever owns the code being looked at, and charge accordingly, based on how many developers the codebase has. The incremental cost for people on security teams to use it is actually $0, no matter how many of them are working with it. If you have 500 developers checking in code, that’s what they charge you for, and read/query access to the results is “free”.

Re: Welcoming Semmle to GitHub

#86

Post by tom-jh »

I've just tested their lgtm.com on our codebase:

1) identified str.replace('[ABC]+', '') correctly as a bug (looks like a regex but is string literal)

2) identified various unnecessary code that TypeScript overlooked

3) identified double-unescaping of html (this one would have probably gone unnoticed for years)

And a bunch of other stuff. No actual vulnerability in our case, but still very useful. I'm enabling their checks on every future PR.

This was TypeScript but they support the rest of our stack too (Python, Java). I wonder if this includes Kotlin - will try.

Re: Welcoming Semmle to GitHub

#87

Post by lawnchair_larry »

collingreene wrote: post #81
lawnchair_larry wrote: post #73

Earlier quoted context omitted.

So I did read a whitepaper about static analysis at Google, and how it was largely self-serve - let developers run the tools and fix what it tells them to as they see fit. I’m wondering if it was under this model where you found it was not useful. I would not expect it to provide much value in that scenario, and would not be surprised by your feedback. If your data is closer to a model where security bug hunters whos…

Here is our experience building and using program analysis as part of our product security efforts at facebook: https://engineering.fb.com/security/zoncolan/ . Its run in both self-service (output to developers), guided (output to product security oncall of security engineers) and used ad-hoc to power up manual security reviews. Depending on the accuracy of each rule and the impact of the pattern of security flaw the…

That’s been my approach as well. An astonishingly large number of companies think they can buy an off the shelf static analysis tool and pipe the default output to developers. That’s counterproductive. A very small percentage of developers will understand the output, be able to assess the exploitability/severity, and care about fixing it. One might think you could then just have them take the “better safe than sorry” approach and fix everything, but FP rates for all of the commercial tools make that completely untenable. At the same time, you can’t expect to convince small teams of developers to model everything out and define sources/sinks using some obscure DSL that they have to learn. But, there are classes of issues that are extremely high impact, but only low accuracy static analysis rules can find the candidates. It’s that part in the middle that you don’t want to throw out, but you need security experts to vet. Other cases with high confidence checks are appropriate to short circuit straight to the devs, but it’s a bad first step.

Re: Welcoming Semmle to GitHub

#90

Post by thomasahle »

tptacek wrote: post #10
Dirlewanger wrote: post #8

Earlier quoted context omitted.

So I'm guessing they'll be merging what they have now with Semmie's tool? Because they've had the free vulnerability check for a while now.

Different things. Github has features that scan repos for "known-vulnerable" dependencies. They do not have features that scan for new vulnerabilities.

Yes and no. LGTM is about known vulnerabilities. It doesn't (currently) use artificial intelligence to discover new vulnerabilities, but it allows writing complicated yet efficient patterns for vulnerabilities found by human intelligence.

So it's more advanced than simple "know bad dependencies", but it's also not quite "new vulnerabilities".

Post reply on HN