Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code scanning for security vulnerabilities now available

github.blog

Post reply on HN
Print view View original

21–30 of 125 posts

Re: Code scanning for security vulnerabilities now available

#21

Post by [deleted] »

_the_inflator wrote: post #17
franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

It is tricky. I would say the perfect tool still needs to be developed. And I agree with you. Tools need to get better in detecting dependencies. However, it can be helpful to know at least that you rely on vulnerable code even if it does not get deployed to prod. To be automated, security scans are like unit tests. Just because a unit test is green does not mean your app is working and vice versa. So security scans…

[deleted]

Re: Code scanning for security vulnerabilities now available

#22

Post by zdw »

franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

Github's notification system is incredibly spammy if you have a lot of repos, and there's no obvious way to manage it. There's also a huge need for an "unsubscribe all" in the notification inbox.

There's also not a severity indicator - some minor issue not encountered in normal use is just as noisy as an extremely important issue that affects every user.

Other tools like Jira and Gerrit are far better at this.

Re: Code scanning for security vulnerabilities now available

#23

Post by innoying »

ksec wrote: post #9
hbcondo714 wrote: post #3

Earlier quoted context omitted.

I had to click around a bit from the PR but: CodeQL code scanning automatically detects code written in the supported languages C/C++ C# Go Java JavaScript/TypeScript Python Source: https://docs.github.com/en/free-pro-team@latest/github/findi...

Interesting. Consider that Github uses lots of Ruby but the tool does not support Ruby from the get go.

CodeQL is based on an existing product from a company called Semmle which GitHub acquired in late 2019 [1]

They have been part of GitHub for barely a year so it's not too surprising, especially given they are continuing to support the product for the enterprise customers they had previously not just GitHub.

[1] https://techcrunch.com/2019/09/18/github-acquires-code-analy...

Re: Code scanning for security vulnerabilities now available

#24

Post by hyperrail »

franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

Microsoft has used products from Semmle (the now-GitHub and thus now-Microsoft division whose tech is in GitHub code scanning) for a few years, and I've personally used it on occasion.

From that limited experience, I'd say that false positives are less of a problem with Semmle's checkers than with other security-focused static analysis tools. This is partly due to Semmle checkers being much more customizable; Semmle has developed a declarative query language called CodeQL* which its checkers' built-in and user-provided rules are written in. Microsoft's security development lifecycle has a lot of mandates which are captured by custom CodeQL rules precisely enough to match their intent.

You can see some examples of how Microsoft uses Semmle here: https://msrc-blog.microsoft.com/2018/08/16/vulnerability-hun...

* https://github.com/github/codeql

Re: Code scanning for security vulnerabilities now available

#25

Post by rvanmil »

nickcox wrote: post #18

Pass from me, given the published pricing is: > Contact Sales to learn more

> Code scanning for private repositories is part of GitHub Advanced Security

Looks like they expect you to upgrade to their Enterprise plan. That’s a 5x increase in subscription costs.

Re: Code scanning for security vulnerabilities now available

#26

Post by geewee »

franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

That's actually a very interesting point in regards to switching from StackOverflow to Github - I have noticed the trend that what I could normally find on Stackoverflow, I now often find on Github issues

Re: Code scanning for security vulnerabilities now available

#27

Post by greysteil »

ksec wrote: post #9
hbcondo714 wrote: post #3

Earlier quoted context omitted.

I had to click around a bit from the PR but: CodeQL code scanning automatically detects code written in the supported languages C/C++ C# Go Java JavaScript/TypeScript Python Source: https://docs.github.com/en/free-pro-team@latest/github/findi...

Interesting. Consider that Github uses lots of Ruby but the tool does not support Ruby from the get go.

PM from GitHub here.

We're adding Ruby support to CodeQL (the scanning engine used in code scanning by default). It's our top requested language, and one we use extensively internally. Adding each new language to CodeQL takes about 6-9 months and needs a team to maintain it in perpetuity, which is why we don't have it yet, but we're starting that work now.

The other languages we hear the most demand for CodeQL support on are PHP, Kotlin and Swift. We'll get to all of those - it will just take a little time.

In the meantime, all of the code scanning experiences are extensible, so you can use other scanning engines with it, like Brakeman for Ruby.

Re: Code scanning for security vulnerabilities now available

#28

Post by theSIRius »

Isn't this already done by Dependabot[1]? I've been using it for some time with my JS/TS repos to keep my dependencies up-to-date. It's not the greatest as it sends alerts about vulnerabilities in devDependencies. But with automatic merge checks I only get an email that the issue has been fixed so it isn't the worst thing in the world.

[1] https://dependabot.com/

Re: Code scanning for security vulnerabilities now available

#29

Post by Normal_gaussian »

GitLab has had this as part of their autodevops for a while now.

My experience with their solution has been:

- 'unusual' repo structures throw it off, silently doing essentially nothing.

- noise is real

- It caught some genuine vulnerabilities

I'm not sure if github also offers the secret detection, license scanning and dependency scanning that gitlab does.

Re: Code scanning for security vulnerabilities now available

#30

Post by ypeter »

theSIRius wrote: post #28

Isn't this already done by Dependabot[1]? I've been using it for some time with my JS/TS repos to keep my dependencies up-to-date. It's not the greatest as it sends alerts about vulnerabilities in devDependencies. But with automatic merge checks I only get an email that the issue has been fixed so it isn't the worst thing in the world. [1] https://dependabot.com/

No, Dependabot scans your repo on dependencies that have known vulnerabilities and suggests to update those dependencies.

This new GitHub feature will scan your code on potential vulnerabilities like SQL injection.

Post reply on HN