Code scanning for security vulnerabilities now available

Post by oefrha » Thu, Oct 01, 2020, 3:32 PM UTC

coldpie wrote: post #87

greysteil wrote: post #32

Earlier quoted context omitted.

PM from GitHub here and author of Dependabot. It's different. - Dependabot looks for vulnerabilities in your dependencies, and creates pull requests to update you to fixed versions. - Code scanning looks for vulnerabilities in your own code. So, for example, if you have written code that takes user input and creates a database instruction from it without escaping it, it will flag that you are introducing an SQL injec…

> PM from GitHub here Hey totally off topic sorry. Can you get someone to turn off pull-requests for the unofficial mirrors that you guys created for some open source projects? Users are being mislead into thinking opening PRs there is productive, but they're not monitored by our project and we don't own the repo anyway. https://github.com/wine-mirror/wine/pulls I've tried contacting your support, but they just tell…

Post by kageneko » Thu, Oct 01, 2020, 3:53 PM UTC

Vinnl wrote: post #67

vosper wrote: post #43

Hopefully GH will apply this to Github Actions, which seem like an exploit vector just sitting there. GH Actions are: - complex enough to develop that third-party solutions are attractive, especially for simple-seeming tasks (I have just been through this) - but yay there's a "marketplace" for actions! - the code in the marketplace is the wild-west, but you'll find something that seems like it'll do what you want - y…

As far as I can see they also have access to your secrets. I really haven't gotten myself to use any non-GitHub-defined Actions yet, because I haven't been able to verify if that's actually safe.

  steps:
    - uses: actions/checkout@v2
    - uses: sfdx-actions/setup-sfdx@v1
      with:
        sfdx-auth-url: ${{ secrets.SFDX_AUTH_URL }}

  steps:
    - uses: actions/checkout@v2
    - name: Run deployment script
      env:
        HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }}

Post by langitbiru » Thu, Oct 01, 2020, 3:59 PM UTC

nickcox wrote: post #18

Pass from me, given the published pricing is: > Contact Sales to learn more

Post by nurettin » Thu, Oct 01, 2020, 4:06 PM UTC

cik wrote: post #60

nurettin wrote: post #46

Earlier quoted context omitted.

Automated proof of vulnerability is valuable. Kafkaesque pattern matching, is not.

That's only true based on a certain level of care, which sadly is not always the case. Say you have a codebase that wasn't built well. Let's say your code scanner finds you at the very least the text "-----BEGIN R/DSA PRIVATE KEY-----*-----END R/DSA PRIVATE KEY-----". In my codebases that'll find nothing, but for many people, they just found SSH keys committed in plaintext. The same is true for any 1k/2k (++etc) stri…

Post by prepend » Thu, Oct 01, 2020, 5:09 PM UTC

beardedwizard wrote: post #91

prepend wrote: post #74

Earlier quoted context omitted.

What’s frustrating is that it’s not part of the $21/month. I have that and have been trying to get pricing info for a few weeks. I’ve gotten mixed messages that it costs nothing extra and just uses Action minutes on their price schedule or that it costs some unknown price that is extra. My impression is that they haven’t picked pricing yet. It frustrates me when the price answer is “contact sales and let’s talk about…

They are still trying to determine pricing, and figure out how to position themselves against competitors (who are about to have thier lunch eaten if gh is smart)