3 ms·
We published this because there are lots of legacy tools that approach this problem with two specific weaknesses: * Many tools just scan a text file where you
by briandoll 10y ago
We published this because there are lots of legacy tools that approach this problem with two specific weaknesses:
* Many tools just scan a text file where you declare your dependencies, which misses transitive dependencies and won't tell you exactly which versions are in use
* They use incomplete datasets for vulnerabilities, like CVE. Most OSS projects don't create CVEs for vulnerabilities, so it is a mostly useless datasource.
Besides having a complete view of the dependencies, we have a research team that is finding and disclosing new vulnerabilities all the time, which you can see here:
https://www.sourceclear.com/registry/explore https://www.sourceclear.com/registry/explore
- dkarapetyan 10y agoThat's a lot more clear and a much better description. I didn't get any of that from the post. Instead you explained several disparate processes each of which has their place in security analysis and declared a specific version the winner.