Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Bearer – Open-source code security scanning solution (SAST)

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#51

Post by spmurrayzzz »

cfabianski wrote: post #43
spmurrayzzz wrote: post #39

Earlier quoted context omitted.

Totally agree. I love the idea of SAST-in-CI, but I ran this on a handful of repos I manage (ranging from 40k-100k SLOC) and there were too many false positives for me want to add this as build-breaking criteria to our CI pipeline. Not unique at all to bearer in any way of course, as you point out, but still a real problem. I suppose an alternative would be to not have this be a zero-sum part of CI, but maybe as a qu…

I’ve introduced the `absence` trigger that does that If express is present but helmet is missing then break. Do you think that’d help achieve what you have in mind?

I think the design flaw in most of the problematic rules was from too simple of regex matching. Looking for a string pattern should be a clue to do some deeper analysis (maybe verify via AST), not necessarily to flag the string alone as security failure.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#53

Post by dang »

Vote manipulation is against HN's rules and will get you banned here, so please don't do it again.

https://twitter.com/g_montard/status/1633119734991405058

https://twitter.com/g_montard/status/1633119274838392841

This is the one point that's in both the site guidelines and the FAQ:

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newsfaq.html

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#54

Post by gmontard »

dang wrote: post #53

Vote manipulation is against HN's rules and will get you banned here, so please don't do it again. https://twitter.com/g_montard/status/1633119734991405058 https://twitter.com/g_montard/status/1633119274838392841 This is the one point that's in both the site guidelines and the FAQ: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsfaq.html

Oh, I’m really sorry about that, I didn’t know (my fault) mentioning we were on HN was against the rules. Calling that « vote manipulation » is quite exaggerated imho but I get it.

Ultimately I think I got carried away by the great community reception.

Anyway thanks for letting me know, I’ll avoid doing so next time.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#55

Post by didroe »

ac wrote: post #48

First of all, thank you for making and sharing this. I have a few technical questions, if I may. Does Bearer perform data-flow analysis? If so: 1. Is the analysis inter-procedural? 2. Is it sound? (Does it only report findings that it’s absolutely certain in but missing others; or does it report all possible findings even if some of them report false positives) 3. How are sources and sinks of information specified? 4…

Thanks for your questions. Yes we do perform dataflow analysis:

1. Not yet but we are exploring ways to support that

2. The analysis part is sound. False +ves (mainly) come from limitations with what you can specify in the rule language. We're working on this however.

3. We don't make that distinction in the rules language currently. Sensitive data detection (which is built-in) is effectively treated as a source. But we need to allow rules to specify sources. I don't think the limitation matters to finding issues, but more to how well they are reported (you effectively only get the sinks reported at the moment).

4. We plan to add other languages but are mindful of the balance of depth vs breadth of support. Is there a particular language you'd like to see support for?

5. There is no support for these currently unfortunately.

6. As it's intra-procedural, we take quite a basic approach to these (with some special cases in the engine). In terms of dataflow, we treat unknown function calls as identity functions (assume the output is somehow influenced by all the inputs). Obviously this is not ideal in terms of false +ves, but we need to work on inter-procedural support first to do a good job of this. In terms of type analysis, we will try to infer unknown types locally from field/property access.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#56

Post by didroe »

spmurrayzzz wrote: post #51
cfabianski wrote: post #43

Earlier quoted context omitted.

I’ve introduced the `absence` trigger that does that If express is present but helmet is missing then break. Do you think that’d help achieve what you have in mind?

I think the design flaw in most of the problematic rules was from too simple of regex matching. Looking for a string pattern should be a clue to do some deeper analysis (maybe verify via AST), not necessarily to flag the string alone as security failure.

The rules do work on the AST but the current cookie rule is not as advanced as it could/should be. For example, we really should treat encryption as sanitizing the value.

We'll take another look at the rules with this in mind. If you are able to share the (rough) approach you take to build the cookie string it would help us to ensure we're covering the specific case(s) you have.

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#57

Post by _elsapet »

spmurrayzzz wrote: post #50
gmontard wrote: post #47

Earlier quoted context omitted.

Btw if you have some exemple please share or even better write an issue, we’d be super happy to look at it and fine tune the rules. It’s just a 1.0, we can do much better for sure :)

I'll cherry pick an example: the default cookie config rule( https://github.com/bearer/bearer/blob/main//pkg/commands/pro... ). We have many places where `cookie: ` is used in our code and it triggers that rule. There are a few issues with this: - Most of the expressions where we use that pattern are used to send a full encrypted cookie string. The use of `cookie` is not the name of a key in the cookie string, its th…

Thanks for the feedback here; it is much appreciated :) I do know your point around catching encryption is more general than this example, but I’ve made a small improvement to the default cookie config rule regex to address one of the false positive cases mentioned https://github.com/Bearer/bearer/pull/754

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#58

Post by RangerScience »

cfabianski wrote: post #2

Hello HN community, I'm Cédric Fabianski, Co-founder and CTO @ Bearer. This is a big milestone for me personally and I'm super happy to be able to contribute to the Security space and help improve the security of others' applications. This is by far the most challenging project I've ever worked on but as people say, if you don't make security simple and accessible enough, there is no way engineers are going to care a…

Thanks, this is very cool, I've been clicking around a lot! I like what you've got going, and I like how it has a resemblance to Rubocop.

My first feedback -

It's a little too many "clicks to code" given (1) how easy it actually is, and (2) aimed at developers.

Personally, I'd slap the `brew install` + `bear scan` on the initial landing page, just under the "Get Started" link. (with an "Other Installation Options" link, 'cuz brew)`. You do a pretty good job of this (the GIF) but I look at "clicks to code" as an indicator of how focused on ease-of-use the provider is, and you're more focused on it than the landing page suggests to me. (Sinatra is the reigning champ at this).

Next -

1. Pronto integration. I'd like to be able to plug it into things like Pronto, so we make sure we're not introducing new problems while we're not ready to deal with existing ones.

2. Github PR comments. It's not clear to me if the output of the GH action will create comments in a PR ala Pronto / Rubocop. It looks it probably does, so just show me a picture so I know for sure?

3. YAML option for recipes

4. I needed to upgrade to XCode 14.1 (from 14.0). Why was that necessary? Seems like it shouldn't be?

5. THANK YOU for providing links to source code from the docs! (I checked out a couple of rules). I would pick a couple of your favs and link to them from the "Custom Rule" page, too.

6. I'd definitely run a few from-scratch workshops for custom rules, recipes, etc; point people at the docs and ask them where they run into even the smallest friction. Your docs are really good but I did need to scroll and click around a bunch as I came to an understanding. Smoothing that out would be nice! (Think Rails Guides vs Rails Docs)

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#59

Post by mdaniel »

gmontard wrote: post #54
dang wrote: post #53

Vote manipulation is against HN's rules and will get you banned here, so please don't do it again. https://twitter.com/g_montard/status/1633119734991405058 https://twitter.com/g_montard/status/1633119274838392841 This is the one point that's in both the site guidelines and the FAQ: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsfaq.html

Oh, I’m really sorry about that, I didn’t know (my fault) mentioning we were on HN was against the rules. Calling that « vote manipulation » is quite exaggerated imho but I get it. Ultimately I think I got carried away by the great community reception. Anyway thanks for letting me know, I’ll avoid doing so next time.

https://news.ycombinator.com/newsfaq.html#ring exactly describes the circumstance and while it doesn't have its own heading in the guidelines:

> Don't solicit upvotes, comments, or submissions. Users should vote and comment when they run across something they personally find interesting—not for promotion.

seems to also match what dang is drawing attention to. My (outsider) suspicion is that the number of dead comments from new accounts on this thread drew attention to the goings-on

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

#60

Post by eranation »

tyingq wrote: post #17

The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.

100% agree

(shameless plug, the product we are working on for the last 1.5 years aims to solve exactly that… either via a PR bot, slack / teams etc). Ping me (see profile for details) if it’s interesting.

Post reply on HN