Best practices to keep your projects secure on GitHub • Hacker News Board

Re: Best practices to keep your projects secure on GitHub

#31

Post by mbesto » Fri, Apr 29, 2022, 4:01 AM UTC

fizzynut wrote: post #28

mbesto wrote: post #11

Earlier quoted context omitted.

> 1) Do not update dependencies We regularly ding companies that don't update dependencies. No offense, but how do developers sleep at night having their application littered with known vulnerabilities?

On the other hand, how do developers sleep at night after updating their dependencies as it will now be littered with new unknown vulnerabilities. The biggest correlated constant for bugs is that more lines of code = more bugs. As dependencies get updated they add more new features that I probably don't care about which adds more lines of code and therefore more bugs and security vulnerabilities. I appreciate there i…

> (something that is usually a low dev priority)

I guess you just proved my point. Thanks.

Re: Best practices to keep your projects secure on GitHub

#32

Post by pojzon » Fri, Apr 29, 2022, 6:00 AM UTC

jimt1234 wrote: post #27

pojzon wrote: post #25

Earlier quoted context omitted.

If the application is not exposed to public internet - who cares ? TBH most best practices preach for security by obscurity. If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.

"We're not internet-facing, so we're not at risk, so we're not concerned with security." Standard misconception. I once worked with a team running a large Hadoop cluster. Everything in a private network. Nothing internet-facing. No risk, right? Well, a Python library they were importing got compromised and was using all their nodes to mine Monero. Oops! The cluster had been running for weeks. The only reason anyone k…

This example is a borderline case. This means that not only they got hacked but also pip repo they were using.

Which means that their provider also did not run any dependency scans.

Tho if they fetched that from github open source repo -> yup thats just incompetence.

Re: Best practices to keep your projects secure on GitHub

#33

Post by jhutchings0 » Fri, Apr 29, 2022, 9:48 PM UTC

kevin_nisbet wrote: post #4

Article doesn't talk about much, just a bit on dependencies apparently from someone focused on supply chain security at Github. At previous role, the more we looked at some of the technical controls around security within github itself, and had a number of security concerns. There's alot of nuance which is hard to go through and comment on, but the defaults and controls caused us lots of concern. Here's a good writeu…

Thanks for your comment! I'm Justin Hutchings, the author of that blog, and you're right that it was pretty narrowly focused on dependencies. We've been making a concerted effort to post about a number of security topics lately to provide best practices for users, everything from coordinated vulnerability disclosure, to how to protect from supply chain risks.

You can find all of our security related blogs here: https://github.blog/category/security/

And thanks for sharing that blog, I'll pass it along to my colleagues in the Actions team.

Re: Best practices to keep your projects secure on GitHub

#34

Post by jhutchings0 » Fri, Apr 29, 2022, 9:55 PM UTC

newman314 wrote: post #8

From what I can tell, there appears to be two camps. 1) Do not update dependencies (because updating to the latest version just because is silly) 2) Update dependencies (because security) Personally, I fall into the second group (with caveats). I've found that Dependabot helps with the tedious work of updating versions by hand but at the same time provides a check so that I manually approve. This seems to work out to…

Dependabot was created with the philosophy that staying up to date all the time is the best strategy. The main reason for that is because if you wait to update until there's a CVE, there's a chance that you'll be so far out of date that you'll have to sort out breaking changes in your dependencies when there's urgency.

It's not a perfect strategy, since there's non-zero risk that the latest version was hijacked by a malicious user, but the chances of a hijacked dependency are much lower than the chances of relying on something with a known vulnerability.

Re: Best practices to keep your projects secure on GitHub

#35

Post by jhutchings0 » Fri, Apr 29, 2022, 10:00 PM UTC

cebert wrote: post #6

mcraiha wrote: post #2

Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"

I’ve noticed Dependabot isn’t always even the greatest for JS projects. There are popular front-end frameworks such as Angular or React. When it makes PRs for currency updates, it seems unaware that it should update all packages for a particular framework or update @types imports when it updates a package import.

Hi from the Dependabot team! We're working on a fix for the Typescript @types problem that should be available very soon.