Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Datree (YC W20) – Best practices and security policies on each commit

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#21

Post by stevenpetryk »

__jal wrote: post #12
almathes wrote: post #11

Why wouldn't someone just use github actions and token scanning. https://github.com/features/actions https://developer.github.com/partnerships/token-scanning/

For starters, that "just" is swallowing: - Identify the relevant tokens you want to scan for, and create regular expressions to capture them. - Create a token alert service which accepts webhooks from GitHub that contain the token scanning message payload. - Implement signature verification in your token alert service. - Implement token revocation and user notification in your token alert service. And that would repl…

It always warms my heart to see someone fighting the "why not just..." comments on here. Everyone underestimates how much goes into a project.

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#24

Post by ldthorne »

harrisonjackson wrote: post #19

>What we built is a rules engine, which is essentially a server-side git-hook platform. Isn't it too late once it is committed to github? It seems like this would be much more useful as a service running as a precommit hook on each workstation. Probably harder to ship/monetize that but as far as actually solving the problem wouldn't that be better?

Agreed that it's too late in that the key is compromised at that point, but a notification before you release to production that you've accidentally committed it allows you to roll the key (hopefully) before any bad actors find it.

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#25

Post by shimont »

bluefox wrote: post #14

Hello Shimon, nice to see your post here, all the best to you and your team from an ex-colleague. Would you mind sharing an example of a custom rule?

Hey :) Here are several examples of custom rules:

* Verify that CI configuration includes running certain jobs (e.g. third-party packages scanner).

* Ensure that all Docker containers are using a pinned down tag and not "latest"

* Verify that every commit is tied to an issue tracker (e.g. JIRA) ticket for traceability.

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#26

Post by shimont »

theanirudh wrote: post #9

Looks good. We were trying to implement this using a mix of CI, pre-commit hooks and Gitlab PR templates, but it was limiting. This looks like exactly what we needed. Regarding custom rules, does the tool run automated tests for those too?

Most companies we see try to implement something by themselves. pre-commit hooks is a major problem as it requires all the developers to install them on their computer, which is part of the problem itself right? aligning the dev team :)

Your unit tests and integration tests should still run using your CI. We run tests around the git and structured files

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#27

Post by dang »

stevenpetryk wrote: post #21
__jal wrote: post #12

Earlier quoted context omitted.

For starters, that "just" is swallowing: - Identify the relevant tokens you want to scan for, and create regular expressions to capture them. - Create a token alert service which accepts webhooks from GitHub that contain the token scanning message payload. - Implement signature verification in your token alert service. - Implement token revocation and user notification in your token alert service. And that would repl…

It always warms my heart to see someone fighting the "why not just..." comments on here. Everyone underestimates how much goes into a project.

Jerry Weinberg used to say that whenever you hear the word "just" on a software project, replace it with "have trouble". Similarly, replace "should" with "isn't". "That should be easy" -> "that isn't easy"; "we should just use git" -> "we'll have trouble using git".

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#28

Post by shimont »

ThePhysicist wrote: post #18

Funny we built almost the same product 6 years ago (sold it to a competitor), we even did automated refactoring of Python code. We also developed a regex-like language that could operate on abstract syntax trees / annotated graphs, which we wrote all our checks with. We were working on extending that with a graph database backend and symbolic execution, basically building a large code graph that we would perform patt…

I would love to hear more about your experience! could you please email me at Shimon [AT] Datree IO?

I believe that now is the right time for a solution like Datree. I think so because of the way we develop software has evolved, companies moved from Waterfall into Agile, there is developer autonomy and the move towards distributed micro-services has brought many companies to the reality of having hundreds and thousands of git repositories, each one with its own configuration files for CI, Docker, Kubernetes, etc.. its really hard managing all of those distributed pieces :)

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#29

Post by shimont »

harrisonjackson wrote: post #19

>What we built is a rules engine, which is essentially a server-side git-hook platform. Isn't it too late once it is committed to github? It seems like this would be much more useful as a service running as a precommit hook on each workstation. Probably harder to ship/monetize that but as far as actually solving the problem wouldn't that be better?

Initially, we started as a CLI tool, but as you said, it is part of the problem, how do you make sure all of your developers are using the CLI/pre-commit hooks?

This is why we choose to integrate on the pull-request level. It is not perfect, but at least your plain text secrets will not be merged into master and go in onto your developer's laptops and your servers(less). :)

We try to find a balance between perfect and achievable in an easy way for our customers

Re: Launch HN: Datree (YC W20) – Best practices and security policies on each commit

#30

Post by shimont »

chaostheory wrote: post #16
almathes wrote: post #11

Why wouldn't someone just use github actions and token scanning. https://github.com/features/actions https://developer.github.com/partnerships/token-scanning/

Not everyone uses github

We are actively working on supporting GitLab and BitBucket. Once it is GA we will update you :)
Post reply on HN