[flagged]
Show HN: I built ContainerCVE – a web tool to scan public Docker images
31–38 of 38 posts
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#32Earlier quoted context omitted.
The question on everyone's mind is whether or not regulators (Fed/State RAMP, etc) will accept variances with a vex statement. The posture for the vast majority of businesses subject to this kind of regulation is "fix every single CVE regardless of impact".
That's a good question and I encourage you to join the CISA Working Groups on VEX etc. It is only indirect work but it might help steer things in the right direction. I'm repeating myself but: CVEs are useless. Please don't use them as an equivalent for "vulnerabilities". Regulators might take a few years to catch up but if I'm able to DDoS my competition with bogus vulnerabilities then people will do just that. The…
I love the hundreds of critical vulnerabilities on test libraries for nonsense like ReDOS or "if you write code that does something unsafe, it will do something unsafe."
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#33Great tool! minor feature suggestion to add a querysting parameter to pass the image name so that it can be linked from other sites
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#34It might sound like nitpicking but I find it dangerous to say vulnerability == CVE. CVEs are one source of information about potential vulnerabilities but they are amongst the least reliable these days. I've heard them being called Curriculum Vitae Enhancer. And Trivy itself uses more sources than just CVEs as well. With upcoming regulation like the Cyber Resilience Act we'll get even more sources of vulnerabilities.…
(Not the author.) I’ve only really encountered CVEs when they have been mentioned on patches, usually Debian security updates. Do vulnerabilities normally get a patch and are we expecting upcoming regulation to require the patches are installed? If action is required to be taken when vulns are published do we all have to just uninstall the thing until the bug gets fixed, lest we invalidate our corporate insurance pol…
Quite a few vulnerabilities don't have CVEs. You can find some of them in the Github Security Advisories.
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#35Nice and simple interface! Congrats!
There are a number of web/SaaS based vulnerability scanners out there actually :) Snyk's SaaS does it, for example. Free to sign up, free to use. My company's SaaS also provides container scanning with Grype and Trivy. There was another free web-based tool I found a while ago too (forgot the name... will look for it).
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#36It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code. How do you identify what is a safe Docker Hub image? Surely it's not just reputation of the publisher of the image.
Hi there, I'm from the Trivy team -- you can scan the misconfiguration of container images i.e. Dockerfile, with Trivy as well.
However, without the source code being open source, you cannot really check what anyone is up to -- thus, don't just use any container image on DockerHub
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#37It's worth noting that whilst vulnerability scanners are very useful, they pretty easy to bypass, if someone creates an image and doesn't want them to flag things up. One very basic example is https://raesene.github.io/blog/2023/04/22/Fun-with-container...
Security Scanners are not supposed to be defensive tools -- they flag what they can find; evaluating the quality of the resources is still the responsibility of the user
Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images
#38[deleted]