Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Bearer – Open-source code security scanning solution (SAST)

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#31

Post by gmontard »

brightball wrote: post #26
tyingq wrote: post #17

The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.

Gitlab has a great security dashboard for this. It organizes the output of multiple tools in a place where you can discuss, triage, ignore or track an issue to resolve it. https://docs.gitlab.com/ee/user/application_security/securit...

Also, super expensive, you need the $99 plan :) https://about.gitlab.com/pricing/

Integration with SCM is clearly a top priority for us, especially directly in PR. GitHub SARIF is a nice way to integrate third-party into their Dashboard, we're commited to it.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#32

Post by tomekw »

spuz wrote: post #4

This is a great looking project - we've been looking for tools similar to this to add an extra layer of validation to our codebase. Are you thinking about supporting Java in the future?

+1 for Java, because that, possibly, means… Clojure? :)

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#35

Post by gmontard »

smcleod wrote: post #34

Always great to see more SAST options. "Contact Us" for pricing immediately disqualifies any product I'm looking at however, I'd suggest making pricing very clear on the site.

Once we're a bit more ready on the Cloud version, we'll release the pricing. Honestly I also hate when pricing is not available, so I'd like us to avoid this going further! Thanks for putting this back in my radar.

Anyway, with the OSS, you don't need to care about pricing :)

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#36

Post by gmontard »

tomekw wrote: post #32
spuz wrote: post #4

This is a great looking project - we've been looking for tools similar to this to add an extra layer of validation to our codebase. Are you thinking about supporting Java in the future?

+1 for Java, because that, possibly, means… Clojure? :)

You're pushing it ^^

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#37

Post by olddustytrail »

itake wrote: post #24

I wish these tools would just auto fix it for me. I hate messages like this: > CRITICAL: Only communicate using SFTP connections. If you know what’s wrong, then fix it. My integration or unit tests will fail if your fix doesn’t work.

You can't just fix that in code. FTP and SFTP are completely different protocols that use different servers.

You need a new server to talk to in order to fix that. And if it's a customer server maybe it can only do FTPS rather than SFTP.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#38

Post by mrtweetyhack »

eltondegeneres wrote: post #12
gmontard wrote: post #11

Earlier quoted context omitted.

Absolutely! We wanted to find a good balance with a license to allow any team to use it for their own usage no strings attached and at the same time protect us against a big vendor tempted to package our work under their product without us getting a dime... Unfortunately, it happens in this world :(

AGPLv3 would ensure any changes by a big vendor would remain freely licensed. The current license for this project fails to meet the Open Source Definition (Criteria 6: No Discrimination Against Fields of Endeavor) since it restricts offering Bearer as a managed service.

nothing wrong with this license. Don't like it, then don't use it. I don't needs somebody to tell me how OSS is defined or yours.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#39

Post by spmurrayzzz »

tyingq wrote: post #17

The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.

Totally agree. I love the idea of SAST-in-CI, but I ran this on a handful of repos I manage (ranging from 40k-100k SLOC) and there were too many false positives for me want to add this as build-breaking criteria to our CI pipeline. Not unique at all to bearer in any way of course, as you point out, but still a real problem.

I suppose an alternative would be to not have this be a zero-sum part of CI, but maybe as a qualitative summary that gets autogenerated as part of the PR / code review process. The noise issue is still a real one as people will eventually ignore the noisy summaries or filter/whitelist them into relative oblivion.

I like the idea of "only applies if these other conditions are true". In all the false positives I encountered so far, if given the option I would be able to declaratively express when and when not to apply the rule. I'd even be ok with inline ignore comments to that end which, while not ideal, is something folks are already used to for other idioms like test coverage et al.

Post reply on HN