3 ms·

Lazyweb question. Is there a way for me to easily keep track of important upstream security announcements for some given set of software—say, ElasticSearch, Rai

by mbrock 11y ago

Lazyweb question. Is there a way for me to easily keep track of important upstream security announcements for some given set of software—say, ElasticSearch, Rails, nginx, and Linux? Like I could check those check boxes and get an RSS feed, or something?

chei0aiV 11y ago
That isn't really possible, Linux for example doesn't even have a security issues page, you are expected to read git patches yourself and understand the implications of each patch. In general, looking at the security information for a Linux/BSD distro containing the software you care about is probably the best way, along with tracking any RSS feeds you can find that do exist.
viraptor 11y ago
It's not pretty (you need to do filtering yourself), but https://nvd.nist.gov/download.cfm https://nvd.nist.gov/download.cfm will give you 99% of the data you want. Otherwise, look at specific distro feeds. For example Ubuntu has http://www.ubuntu.com/usn/ http://www.ubuntu.com/usn/ (RSSable) and Debian has https://www.debian.org/security/ https://www.debian.org/security/ (also RSSable) (apparently you can also generate your own feed from http://tif.mcafee.com/ http://tif.mcafee.com/ but I never used it)
reidrac 11y ago
Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you should have someone looking at that list. I think it is a good complement to the security advisories of your Linux distributor (Debian, CentOS, whatever), but is isn't free as you'll need time to keep an eye on it. 1: http://oss-security.openwall.org/ http://oss-security.openwall.org/
- mbrock 11y ago
  Thanks. Regarding cost... someone should sell curated security feeds to startups. There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings. Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.
  - tie_ 11y ago
    There was something made to ease exactly that pain... sadly it's no longer updated: http://www.websecuritywatch.com/ http://www.websecuritywatch.com/
dchanm 11y ago
We're working something similar at Patchwork (https://patchworksecurity.com/ https://patchworksecurity.com/) . You tell us what packages are installed and we notify you when a new security update is released. Right now we're focusing on distro package managers, but plan to add support for monitoring upstreams like nginx. The big issue we see with RSS / mailing lists is a problem of discoverability and noise. Not all software has an easy to digest format for security changes. We want to do the scraping / parsing once and make it consumable by others. General lists such as OSS and distro specific security announce lists tend to have more noise. Most people only care about packages installed on their machines, which is why we filter our results based on your set of packages.

by mbrock 11y ago

chei0aiV 11y ago

That isn't really possible, Linux for example doesn't even have a security issues page, you are expected to read git patches yourself and understand the implications of each patch. In general, looking at the security information for a Linux/BSD distro containing the software you care about is probably the best way, along with tracking any RSS feeds you can find that do exist.

viraptor 11y ago

It's not pretty (you need to do filtering yourself), but https://nvd.nist.gov/download.cfm https://nvd.nist.gov/download.cfm will give you 99% of the data you want. Otherwise, look at specific distro feeds. For example Ubuntu has http://www.ubuntu.com/usn/ http://www.ubuntu.com/usn/ (RSSable) and Debian has https://www.debian.org/security/ https://www.debian.org/security/ (also RSSable) (apparently you can also generate your own feed from http://tif.mcafee.com/ http://tif.mcafee.com/ but I never used it)

reidrac 11y ago

Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you should have someone looking at that list. I think it is a good complement to the security advisories of your Linux distributor (Debian, CentOS, whatever), but is isn't free as you'll need time to keep an eye on it. 1: http://oss-security.openwall.org/ http://oss-security.openwall.org/

mbrock 11y ago
Thanks. Regarding cost... someone should sell curated security feeds to startups. There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings. Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.
- tie_ 11y ago
  There was something made to ease exactly that pain... sadly it's no longer updated: http://www.websecuritywatch.com/ http://www.websecuritywatch.com/

dchanm 11y ago

We're working something similar at Patchwork (https://patchworksecurity.com/ https://patchworksecurity.com/) . You tell us what packages are installed and we notify you when a new security update is released. Right now we're focusing on distro package managers, but plan to add support for monitoring upstreams like nginx. The big issue we see with RSS / mailing lists is a problem of discoverability and noise. Not all software has an easy to digest format for security changes. We want to do the scraping / parsing once and make it consumable by others. General lists such as OSS and distro specific security announce lists tend to have more noise. Most people only care about packages installed on their machines, which is why we filter our results based on your set of packages.