Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code scanning for security vulnerabilities now available

github.blog

Post reply on HN
Print view View original

31–40 of 125 posts

Re: Code scanning for security vulnerabilities now available

#31

Post by stevula »

franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

Just because a dependency isn’t deployed to production doesn’t mean it’s safe. Remember when eslint tried to steal people’s npm credentials?

https://news.ycombinator.com/item?id=17513709

Re: Code scanning for security vulnerabilities now available

#32

Post by greysteil »

theSIRius wrote: post #28

Isn't this already done by Dependabot[1]? I've been using it for some time with my JS/TS repos to keep my dependencies up-to-date. It's not the greatest as it sends alerts about vulnerabilities in devDependencies. But with automatic merge checks I only get an email that the issue has been fixed so it isn't the worst thing in the world. [1] https://dependabot.com/

PM from GitHub here and author of Dependabot.

It's different.

- Dependabot looks for vulnerabilities in your dependencies, and creates pull requests to update you to fixed versions.

- Code scanning looks for vulnerabilities in your own code. So, for example, if you have written code that takes user input and creates a database instruction from it without escaping it, it will flag that you are introducing an SQL injection vulnerability.

(As an aside, we could definitely improve Dependabot to treat devDependencies differently. You do need to care about vulnerabilities in your devDependencies in _some_ cases (code exfiltration is the obvious one) but not in many - we should to get smarter about distinguishing between those cases.)

Re: Code scanning for security vulnerabilities now available

#33

Post by greysteil »

ypeter wrote: post #30
theSIRius wrote: post #28

Isn't this already done by Dependabot[1]? I've been using it for some time with my JS/TS repos to keep my dependencies up-to-date. It's not the greatest as it sends alerts about vulnerabilities in devDependencies. But with automatic merge checks I only get an email that the issue has been fixed so it isn't the worst thing in the world. [1] https://dependabot.com/

No, Dependabot scans your repo on dependencies that have known vulnerabilities and suggests to update those dependencies. This new GitHub feature will scan your code on potential vulnerabilities like SQL injection.

Wow, jinx, this is pretty much identical to the answer I just wrote!

Re: Code scanning for security vulnerabilities now available

#34

Post by njibhu »

rvanmil wrote: post #25
nickcox wrote: post #18

Pass from me, given the published pricing is: > Contact Sales to learn more

> Code scanning for private repositories is part of GitHub Advanced Security Looks like they expect you to upgrade to their Enterprise plan. That’s a 5x increase in subscription costs.

Running on GH Enterprise at work, we also have the "Contact Sales" instead of being able to set it up. So it's very unclear for now.

Re: Code scanning for security vulnerabilities now available

#35

Post by [deleted] »

stevula wrote: post #31
franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

Just because a dependency isn’t deployed to production doesn’t mean it’s safe. Remember when eslint tried to steal people’s npm credentials? https://news.ycombinator.com/item?id=17513709

[deleted]

Re: Code scanning for security vulnerabilities now available

#36

Post by Cthulhu_ »

geewee wrote: post #26
franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

That's actually a very interesting point in regards to switching from StackOverflow to Github - I have noticed the trend that what I could normally find on Stackoverflow, I now often find on Github issues

Yeah, I wouldn't mind if they added an extra tab for Q&A, with additional features to make it work like a community wiki (like what SO tries to do).

Re: Code scanning for security vulnerabilities now available

#37

Post by oars »

rvanmil wrote: post #25
nickcox wrote: post #18

Pass from me, given the published pricing is: > Contact Sales to learn more

> Code scanning for private repositories is part of GitHub Advanced Security Looks like they expect you to upgrade to their Enterprise plan. That’s a 5x increase in subscription costs.

Well considering how much money we recently spent deploying CheckMarx and integrating it into all our pipelines (hundreds of man hours of engineers on 6 figure salaries + a 6 figure licensing fee per year) that is quite expected.

If you're in an organisation that's are already using GitHub and this scanning capability is as good as that of CheckMarx, Snyk, etc. then it would be a no brainer to upgrade your Enterprise GitHub plan (if you're not already on Enterprise).

Re: Code scanning for security vulnerabilities now available

#38

Post by cik »

franciscop wrote: post #13

Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…

There's a genuine security fatigue issue (much like event fatigue) that comes from false positives. Unfortunately that doesn't reduce the value of the scanning - the onus is on the false positives.

At the very least, running and pruning scans should happen on projects so that at least we can have the conversation. It's like PCI (as an example, not an ideal); PCI isn't perfect, but at least it encourages a conversation about security. Today we're at the point where almost every single organization at least discusses security; but I remember when PCI first came out. I can't tell you have many times people used to ask why it was problematic to store passwords in plain text.

It this the best step forward, probably not. Is it a step forward, absolutely.

Re: Code scanning for security vulnerabilities now available

#39

Post by rbobby »

_the_inflator wrote: post #20
xjay wrote: post #14

In the not-so-distant future: Code snippet scanning for copyright infringement or Stack Overflow attribution. 2 years? 4?

I would call it the Oracle-API-Scan. ;)

Attribution-Oracle

Where "oracle" means predictor and not the database/java folks.

Here's my mvp:

    public static (bool IsOwned, string OwnedBy) GetAttribution(string CodeSnippet) 
        => string.IsNullOrWhiteSpace(CodeSnippet) 
           ? (false, null) 
           : (true, "Oracle Corp.");
Investors please :)
Post reply on HN