git.kernel.org -> 4 security problems -> "borderline unsafe"
Hmm.
Democratizing Security
21–30 of 33 posts
Re: Democratizing Security
#22git.kernel.org -> 4 security problems -> "borderline unsafe" Hmm.
Feel free to verify you own git.kernel.org, and you can find out what those vulnerabilities were. :)
Re: Democratizing Security
#23There's definitely a gap to fill in the web application security market, especially for startups who want to budget ~1k-5k to security and are simply outbid by established companies (simple, short web projects by good appsec teams start at around $10k). That said: I'm not in love with the messaging here. The push/pull isn't between ineffective, inexpensive tools and ineffective, expensive consultants. Appsec teams ar…
"The direct comparison to competing tools just begs questions you don't want to answer."
I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ website installation I would be asking: what do I get out of this I don't get out of running another free tool such as Nessus (the answer, I'm afraid is going to be "less")? Sure, having to to go through the Nessus install process is kind of a pain (although this realistically represents < 5 minutes of my time); but as soon I saw that I had to add some kind of website verification I stopped there as well.
Re: Democratizing Security
#24There's definitely a gap to fill in the web application security market, especially for startups who want to budget ~1k-5k to security and are simply outbid by established companies (simple, short web projects by good appsec teams start at around $10k). That said: I'm not in love with the messaging here. The push/pull isn't between ineffective, inexpensive tools and ineffective, expensive consultants. Appsec teams ar…
"The direct comparison to competing tools just begs questions you don't want to answer." I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ web…
To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250.
We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.
Re: Democratizing Security
#25Earlier quoted context omitted.
"The direct comparison to competing tools just begs questions you don't want to answer." I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ web…
To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250. We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.
You're hoping to compete with Nessus? Why?
Re: Democratizing Security
#26Earlier quoted context omitted.
To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250. We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.
You're hoping to compete with Nessus? Why?
Not directly, but we are hoping to make our service more holistic in general.
Re: Democratizing Security
#27Earlier quoted context omitted.
"The direct comparison to competing tools just begs questions you don't want to answer." I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ web…
To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250. We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.
oh, ok, that makes it a lot more clear. thanks!
If I were you I would consider a model where I would be to do a full scan, display only the top X vulnerabilities found, and simply charge more to show the rest of the results.
Another thing I'm curious about: does this work on a pure client-side web application (e.g. my app is just one html page + javascript that loads all the html from templates)? Are you including static urls or somehow tracking "clicks" into a web app? Actually, most of the things I would concerned about in my web applications are things like not validating that I'm correctly doing correct validation in POST-requests. I'd be interested in seeing if you guys are doing that kind of "fuzzing" in that respect (though not sure if there is an automated way to do that safely). Additionally, I'd be curious to see what you detect Nessus/BurpSuite etc doesn't in terms of web application security.
Anyway, neat idea, perhaps I'll check it out a bit more thoroughly and do a comparison.
Re: Democratizing Security
#28Earlier quoted context omitted.
You're hoping to compete with Nessus? Why?
Not directly, but we are hoping to make our service more holistic in general.
Yea, agree with the above comments. This can all be done with Nessus (for free). What do you mean by `deep dive`? Are you reselling Burp? What do you plan to offer on the network security side? Keep in mind you should be targeting people who know nothing about security (you may want to play with the wording on your site). because experts already have a tool bag of tricks that can exceed these offerings for free.
Re: Democratizing Security
#29[deleted]
Re: Democratizing Security
#30Earlier quoted context omitted.
Not directly, but we are hoping to make our service more holistic in general.
Yea, agree with the above comments. This can all be done with Nessus (for free). What do you mean by `deep dive`? Are you reselling Burp? What do you plan to offer on the network security side? Keep in mind you should be targeting people who know nothing about security (you may want to play with the wording on your site). because experts already have a tool bag of tricks that can exceed these offerings for free.
We've written a lot of custom tools to do some heavier auditing of a website than off-the-shelf Nessus. With that said, we are definitely targeting those companies and teams that don't have the time or experience to be focused on setting up and running Nessus consistently.
Our SQLi and XSS modules in particular are quite a bit heavier than Nessus', but there are other features like page de-duplication that optimize speed as well.