Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code scanning for security vulnerabilities now available

github.blog

Post reply on HN
Print view View original

91–100 of 125 posts

Re: Code scanning for security vulnerabilities now available

#91

Post by beardedwizard »

prepend wrote: post #74
indymike wrote: post #70

Dear Github: I do not want to talk to sales for something listed on the pricing page for $21 per month. Thank you.

What’s frustrating is that it’s not part of the $21/month. I have that and have been trying to get pricing info for a few weeks. I’ve gotten mixed messages that it costs nothing extra and just uses Action minutes on their price schedule or that it costs some unknown price that is extra. My impression is that they haven’t picked pricing yet. It frustrates me when the price answer is “contact sales and let’s talk about…

They are still trying to determine pricing, and figure out how to position themselves against competitors (who are about to have thier lunch eaten if gh is smart)

Re: Code scanning for security vulnerabilities now available

#92

Post by moduspol »

prepend wrote: post #77
j1elo wrote: post #59

Earlier quoted context omitted.

Recently I learned in a conversation [0] (about SaaS in general, not GitHub in particular) that you passing is actually the desired outcome and it's by design. So, I guess, "well done"? (it hurts a little though, I'm too in the camp of wanting to see the pricing beforehand) [0]: https://news.ycombinator.com/item?id=24630106

I think the real question is if their pricing design is optimal. Would they make more money with clear pricing? I think so. One of my ancestors had a company selling commodities. He wouldn’t answer the phone until the customer had called three times and left messages. He said this was a filter to identify the customers who really needed his product. The logic is sound and on the surface clever. But would he have made…

I'm sure it's tough to tell, and the side with less risk is the one that often costs fewer resources.

My dad runs a shop restoring classic cars, mostly as a hobby. The number of minutes you can spend on the phone discussing some potential client's great-grandfather's old clunker and their dreams / aspirations of getting it fixed is nearly limitless, but the number of clients willing to actually pay and wait for it is a tiny fraction.

Similarly I looked into having a hair transplant done and found most places near me actually charge for consultations! It probably makes sense, though. The market of "guys that want to be less bald" is gigantic, but the ones serious enough to plop down tens of thousands of dollars for it is much smaller. Narrowing that group down made for a consultation that was much more personal and focused than it'd have to be if they offered it for free knowing 95%+ will never be seen again.

Re: Code scanning for security vulnerabilities now available

#93

Post by mrkramer »

So I was researching Snyk they raised $452m which is absurd amount for small startup and they provide "security analysis tools used to identify open-source vulnerabilities."

I hope this GitHub feature bring their valuation to the ground and their investors to the reality.

Re: Code scanning for security vulnerabilities now available

#94

Post by bdamm »

falcor84 wrote: post #76
lhnz wrote: post #65

Earlier quoted context omitted.

Webpack generates code which might be loaded by users and additionally it's very common to run it on a CI server (which can sometimes have network access out to other machines at a firm). In general, it's quite strange to me that vulnerabilities in `devDependencies` are considered less important than those in `dependencies`. These dependencies are generally for tools that are run within your company network, and cont…

What would be the attack vector in this case? Assuming that it's a vulnerability rather than an actually malicious package, how would an attacker exploit something running on your CI server? The only way I see is if they already have the ability to modify your source code, at which point it's of course already game over.

While it's not always considered a risk, there are many cases where being able to run code on a CI server is a vulnerability.

Re: Code scanning for security vulnerabilities now available

#96

Post by alienfilesystem »

I've always been impressed with Theo de Raadt and his OpenBSD team in this regard. Everything in the base OS is routinely audited and fixed quickly.

The link has a section named Audit Process, which is interesting.

https://www.openbsd.org/security.html

Re: Code scanning for security vulnerabilities now available

#97

Post by detaro »

panny wrote: post #56
xjay wrote: post #14

In the not-so-distant future: Code snippet scanning for copyright infringement or Stack Overflow attribution. 2 years? 4?

>In the not-so-distant future: Code snippet scanning for copyright infringement Will never happen. Can you imagine what would occur if Github started harrassing private repo owners for including GPL licensed code? Or automatically making them public? All their customers would bolt immediately. Copyright infringement is Github's bread and butter. Stack Overflow attribution is equally unlikely. The same group that says…

Many companies pay good money for scanning services like that, so Github adding it to their Enterprise offerings would make sense. (No clue how you get to "harassing" and "automatically making them public" from that suggestion...)

Re: Code scanning for security vulnerabilities now available

#99

Post by dec0dedab0de »

panny wrote: post #56
xjay wrote: post #14

In the not-so-distant future: Code snippet scanning for copyright infringement or Stack Overflow attribution. 2 years? 4?

>In the not-so-distant future: Code snippet scanning for copyright infringement Will never happen. Can you imagine what would occur if Github started harrassing private repo owners for including GPL licensed code? Or automatically making them public? All their customers would bolt immediately. Copyright infringement is Github's bread and butter. Stack Overflow attribution is equally unlikely. The same group that says…

Stack Overflow attribution is equally unlikely. The same group that says Oracle's claim that Java's API is not original and unworthy of copyright protection, cannot then turn around and claim 30 lines of code from SO is original and deserves recognition.

I would bet most stack overflow answers don't qualify as copyrightable, at least in the US. Though I think automatically finding copied stuff would be very useful. Any time I copy something small I try to include a link to where I got it from, if someone has to troubleshoot my code it may help them to see where it came from.

Re: Code scanning for security vulnerabilities now available

#100

Post by thrownaway954 »

ransom1538 wrote: post #71
donatj wrote: post #63

They really bury their lead on what languages are supported. - C/C++ - C# - Go - Java - JavaScript/TypeScript - Python https://docs.github.com/en/free-pro-team@latest/github/findi...

Thank god no php. Not that it would be needed.

actually, i'm very surprised that PHP isn't in the list seeing how WordPress account for 75%+ of the sites internet and the slew of plugins in its ecosystem.
Post reply on HN