Patchwork
Security and privacy
vulnerability notification
SHOW HN2016
122points
49comments
#293of 2,264 in 2016
Top 13%of 2016 by points
How HN took it
CuriousMostly questions and neutral comments
5 positive, 16 neutral or asking, 1 mixed, 10 critical, out of 32 comments about the project. Thread score -0.31.
Idea: 3 for, 3 againstDesign: 0 for, 3 againstExecution: 0 for, 2 againstPricing: 0 for, 1 againstDocs: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful idea that commenters would like to try
From 3 comments
This would be a cool service to integrate with github badges, next to test coverage and build status. e.g. "2 UNPATCHED VULNERABILITIES" or "VULNERABILITY ASSESSMENT PASSED" It…
chatmasta on HNAwesome. Can we hook into this to send updates to Slack instead?
mmaunder on HNLooked at the site and read the comments which made me think about the HN post yesterday about hiding vulnerabilities in plain site…
yaworsk on HN
Objections
Using curl piped to sh for installation is a security risk
From 4 comments
Sorry to be snide, but seriously? ``` curl -L https://git.io/cleansweep | sh ``` For a security tool? [edit] I still think it's a great idea, though [/edit]
DoubleMalt on HNMeaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.
whorleater on HNis this a joke? Piping random shit off the web straight into a shell. Sounds like worst advise. I'm sure the maintainers of this site really know their stuff when it comes to…
DyslexicAtheist on HNThis just sounds like a bad idea to me. Why would you publish all this very sensitive machine info to a third party to retrieve that list? This would be a goldmine if they got…
SchizoDuckie on HN
Sending detailed machine package data to a third party is a privacy risk and a target for attackers
From 2 comments
This just sounds like a bad idea to me. Why would you publish all this very sensitive machine info to a third party to retrieve that list? This would be a goldmine if they got…
SchizoDuckie on HNis this a joke? Piping random shit off the web straight into a shell. Sounds like worst advise. I'm sure the maintainers of this site really know their stuff when it comes to…
DyslexicAtheist on HN
Only covers apt packages so far
From 2 comments
Since you're only doing apt installed packages, couldn't you just mail yourself a list of ubuntu security updates for a machine using apt and have the same result?
mmaunder on HNHi halite! 1. We've got agents listening to incoming feeds, and did the work to ingest all the historical vulnerability data we could find. 2. We're focusing on apt installed…
dchanm on HN
Requests
Slack or callback integrations
From 2 comments
Awesome. Can we hook into this to send updates to Slack instead?
mmaunder on HNHi mmaunder, e-mail notifications are our current callback mechanism but that will expand. The goal of our API is to allow you to consume the vulnerability data in a way that is…
dchanm on HN
Integration with existing scanners like Nexpose
From 2 comments
Hi, we're currently looking for such tool. Here are some questions that would be helpful for us: How do you manage vulnerabilities database? Do you've a list of OSS that this…
halite on HNLaunched something very similar last year and learned that integrations with existing security scanning tools was more important than building our own from scratch. We actually…
k33n on HN
CI and GitHub badge integration
From 2 comments
This would be a cool service to integrate with github badges, next to test coverage and build status. e.g. "2 UNPATCHED VULNERABILITIES" or "VULNERABILITY ASSESSMENT PASSED" It…
chatmasta on HNHi, our roadmap includes hooking into CI where your CI can ask our API Is the current project state vulnerable? yes) Here are a list of dependencies you need to update, run your…
dchanm on HN
Questions
How is the vulnerability database maintained and what does it cover
From 1 comment
Hi, we're currently looking for such tool. Here are some questions that would be helpful for us: How do you manage vulnerabilities database? Do you've a list of OSS that this…
halite on HN
Where data is hosted and how volume pricing and licensing work
From 2 comments
Hi, we're currently looking for such tool. Here are some questions that would be helpful for us: How do you manage vulnerabilities database? Do you've a list of OSS that this…
halite on HN> 7. How much volume? I think what I'm more interested in understanding is how is license enforced? Our team is responsible for facilitation of pilots and this I can see useful…
halite on HN
Alternatives named
Pakiti
From 1 comment
Pakiti (http://pakiti.sourceforge.net/) is another useful tool in this space.
deadfece on HN
Sandstorm-style PGP-verified install
From 2 comments
I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1]…
swsieber on HNHi, We understand your concerns with the current install mechanisms. We're working toward providing multiple options similar similar to sandstorm.io…
dchanm on HN