They really bury their lead on what languages are supported. - C/C++ - C# - Go - Java - JavaScript/TypeScript - Python https://docs.github.com/en/free-pro-team@latest/github/findi...
Thank god no php. Not that it would be needed.
Code scanning for security vulnerabilities now available
71–80 of 125 posts
Re: Code scanning for security vulnerabilities now available
#72Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…
At some point many beginner devs migrated from StackOverflow to Github because their really bad question were being closed there, and now they just overwhelm open source authors I'm glad it's not just me seeing this - My repos aren't even that popular and some of the issues just seem to be "help me build my project..."
I started just quoting them back prices when they send me random emails like that. What'd you think, they disappear quickly!
Re: Code scanning for security vulnerabilities now available
#73Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production. In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-…
That's actually a very interesting point in regards to switching from StackOverflow to Github - I have noticed the trend that what I could normally find on Stackoverflow, I now often find on Github issues
Seeing many people surprised or like "finally someone said it", I thought this was very common knowledge? I might have been in some specific communities at the critical point 2-3 years ago, where bootcamps and other educators would advice new devs not to go to StackOverflow but instead go to Github. It didn't occur to me back then that the consequences would be so bad.
Re: Code scanning for security vulnerabilities now available
#74Dear Github: I do not want to talk to sales for something listed on the pricing page for $21 per month. Thank you.
What’s frustrating is that it’s not part of the $21/month. I have that and have been trying to get pricing info for a few weeks. I’ve gotten mixed messages that it costs nothing extra and just uses Action minutes on their price schedule or that it costs some unknown price that is extra.
My impression is that they haven’t picked pricing yet.
It frustrates me when the price answer is “contact sales and let’s talk about it.”
These marginal services really depend on the price, I think.
Re: Code scanning for security vulnerabilities now available
#75I wonder if it is or will be possible to set this up without littering the repo with another configuration file. In the past, I've done a couple one-off scans at https://lgtm.com/
It goes into the repo in the .guthub folder as an action.
Re: Code scanning for security vulnerabilities now available
#76Earlier quoted context omitted.
Sure, but the reported issues are usually not nearly that severe. Most of the time what I see is "A dependency of a dependency of a dependency of Webpack is vulnerable to a Regular expression Denial of Service attack" or prototype pollution or something like that.
Webpack generates code which might be loaded by users and additionally it's very common to run it on a CI server (which can sometimes have network access out to other machines at a firm). In general, it's quite strange to me that vulnerabilities in `devDependencies` are considered less important than those in `dependencies`. These dependencies are generally for tools that are run within your company network, and cont…
What would be the attack vector in this case? Assuming that it's a vulnerability rather than an actually malicious package, how would an attacker exploit something running on your CI server? The only way I see is if they already have the ability to modify your source code, at which point it's of course already game over.
Re: Code scanning for security vulnerabilities now available
#77Pass from me, given the published pricing is: > Contact Sales to learn more
Recently I learned in a conversation [0] (about SaaS in general, not GitHub in particular) that you passing is actually the desired outcome and it's by design. So, I guess, "well done"? (it hurts a little though, I'm too in the camp of wanting to see the pricing beforehand) [0]: https://news.ycombinator.com/item?id=24630106
I think the real question is if their pricing design is optimal. Would they make more money with clear pricing? I think so.
One of my ancestors had a company selling commodities. He wouldn’t answer the phone until the customer had called three times and left messages. He said this was a filter to identify the customers who really needed his product.
The logic is sound and on the surface clever. But would he have made more money servicing all customers? Or perhaps marketing?
Re: Code scanning for security vulnerabilities now available
#78Too much nitpicking here for an unprecedented leap forward in infosec. Github giving away yet another enterprise class property away for free. The future of security is very dire and available means like this are essential to protect democracy and freedom. A lot of those noisy repos do actually run cog wheels of critical infrastructure. All praise our source code OVERLORD.
It’s most certainly precedented as Semmle offered this before getting bought by GitHub and turned off. And, of course, GitLab has had this for years.
Re: Code scanning for security vulnerabilities now available
#79They really bury their lead on what languages are supported. - C/C++ - C# - Go - Java - JavaScript/TypeScript - Python https://docs.github.com/en/free-pro-team@latest/github/findi...
It’s actually “lede” [1]
> A lede is the introductory section in journalism and thus to bury the lede refers to hiding the most important and relevant pieces of a story within other distracting information. The spelling of lede is allegedly so as to not confuse it with lead (/led/) which referred to the strip of metal that would separate lines of type. Both spellings, however, can be found in instances of the phrase.
[1] https://www.merriam-webster.com/words-at-play/bury-the-lede-...
Re: Code scanning for security vulnerabilities now available
#80They really bury their lead on what languages are supported. - C/C++ - C# - Go - Java - JavaScript/TypeScript - Python https://docs.github.com/en/free-pro-team@latest/github/findi...
[deleted]