Socket
Dev tools
dependency security scanner
SHOW HN2022
How HN took it
4 positive, 11 neutral or asking, 0 mixed, 11 critical, out of 26 comments about the project. Thread score -0.22.
Design: 1 for, 4 againstExecution: 0 for, 5 againstIdea: 1 for, 0 againstPrivacy: 0 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Animated visualization is a striking way to present dense package data
From 2 comments
What is the name of the animated visualization on the front page? I thought it was static, but it is an amazing way to display such a dense and dry subject. 10/10
EvRev on HNThe visualization is a custom component that our own Mik Lysenko (of https://0fps.net fame) made. I agree it's a super useful way to visualize package data.
feross on HN
Useful typosquat detection and package analysis idea
From 2 comments
As with all end products where you need safety, all the dependencies (3rd party or not) you use should be treated as your own code. All the dependencies should be committed to…
extheat on HNI work as a security engineer for a benefits provider. This stuff has been top of mind for me, the rest of my team, and our CSIO. I love the direction you're going with this.…
d4mi3n on HN
Objections
Numeric package scores look made-up and unclear
From 2 comments
I would honestly completely ditch the Socket "ratings". React = 70 - what the hell does that mean? "quality = 82, license = 70" where did you get those numbers? They are…
armchairhacker on HNSSL Labs works because letter grades, like most low granularity ordinal measures, clearly read as qualitative and approximate rather than having false precision. No one is saying…
notafraudster on HN
MIT license flagged as non-FSF approved, lowering scores
From 2 comments
Why does Socket flag npm packages with "MIT" in the license field as non-FSF approved, such as in lodash [1]. It appears the FSF seems to prefer to call the MIT license "Expat"…
syntheticcdo on HNIt looks like having an MIT license gives you a score of 70. It seems wrong that the most commonly used license on the platform is poor and it makes it hard to trust your scoring…
bjornstar on HN
Not open source; GitHub app source not public
From 2 comments
> Socket is built by a team of open source maintainers with over 1 billion monthly downloads. Everyone on the Socket team is an open source maintainer. So is Socket.dev open…
niutech on HNIs Socket open source? Can I run it locally from the command-line?
pabs3 on HN
Typosquat warnings are overly aggressive
From 1 comment
Bug report: the typo-squatting check seems overly aggressive. I checked a module with a name like "foo-engine", and Socket shows a warning that this may be a typo for "engine.io".
fenomas on HN
Requests
Open source the product or allow running it locally
From 2 comments
> Socket is built by a team of open source maintainers with over 1 billion monthly downloads. Everyone on the Socket team is an open source maintainer. So is Socket.dev open…
niutech on HNIs Socket open source? Can I run it locally from the command-line?
pabs3 on HN
Use an auditable GitHub Action that sends only package files
From 2 comments
I think it would be awesome if Socket could be used through an auditable GitHub Action where developers can manually send over just their package*.json files.
teaearlgraycold on HNWe agree. It's on our roadmap.
feross on HN
Fix unclear license detection for lowercase license files
From 2 comments
Maybe a minor defect. I see many packages that receive the error unclear license because the bot cannot find the file LICENSE in the package when the file exists with lowercase…
austincheney on HNThanks, we’ll fix that.
feross on HN
Explain how the product works with examples
From 1 comment
Hey team, great to see someone tackle this project, and the idea to scan for new potential issues based on the code that changed is cool Initial impressions when visiting the…
plasma on HN
Questions
Where is the analysis run and does it run untrusted code
From 1 comment
Congrats on the launch. There is both a large need for improvements in npm supply chain security and a market willing to pay for them. Concerns: 1) npm Open-Source Terms…
substructure on HN
Is there a human review of package diffs
From 1 comment
Is there any plan to introduce human review into the process? I imagine a company that had a human review a diff of each package release prior to approval could make a ton of…
nicoburns on HN
Is the name confusing given socket.io
From 1 comment
Great idea! As an aside, I can't help but immediately comment on the name, which kinda seems like a semi-poor choice given that socket.io is a very popular javascript websocket…
xingped on HN
Alternatives named
Snyk, JFrog Xray, Sonatype, WhiteSource
From 1 comment
Congrats on the launch. There is both a large need for improvements in npm supply chain security and a market willing to pay for them. Concerns: 1) npm Open-Source Terms…
substructure on HN
Deno permissions model
From 2 comments
I work as a security engineer for a benefits provider. This stuff has been top of mind for me, the rest of my team, and our CSIO. I love the direction you're going with this.…
d4mi3n on HN1. We are in beta right now! We have the data and analysis, and are working hard to make it easy to integrate project specific views into it. 2. https://socket.dev/roadmap See…
bretc on HN
Lighthouse and SSL Labs style scoring
From 1 comment
I think this is a valid criticism of using scores to summarize a complex subject, and I agree that we can definitely do a better job on this. What's interesting is that…
feross on HN