6 ms·

Show HN: A curated list of insecure Python packages

94 points by jayfk 10y ago

x1798DE 10y ago
Is the backend getting hammered? https://pyupio.github.io/safety-db https://pyupio.github.io/safety-db is just looping a loading animation.
- jayfk 10y ago
  The site is loading the data directly from the repo. Maybe HN has triggered some abuse mechanism. Edit: Switched to S3 to load the data.
jacknews 10y ago
Just a single wrong character can really ruin a package
svisser 10y ago
This can detect when a CVE vulnerability is fixed but how would you know the version number at which it was introduced?
- jayfk 10y ago
  Most CVEs have a pretty good descriptions. For example CVE-2016-6186[1]: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. [1] http://www.cvedetails.com/cve/CVE-2016-6186/ http://www.cvedetails.com/cve/CVE-2016-6186/
eganist 10y ago
Can you get in touch with the guys at OWASP Dependency Check? It's one of their more mature projects, and it essentially does a lot of what you described and then some, including for Python projects. https://www.owasp.org/index.php/OWASP_Dependency_Check https://www.owasp.org/index.php/OWASP_Dependency_Check I can make a connection between you and Jeremy Long (head of the project) if you'd like. He's also on twitter as @ctxt
vinayan3 10y ago
Really cool stuff. I love it! Thank you for making this. A side note anyone using Django should keep up to date. If you see the list of versions and the related packages which have known vulnerabilities you will realize keeping up to date is critical.
SubiculumCode 10y ago
HN title contains a misspelling: insucure should be insecure Unless insucure is a Python package I do not know about.
pekk 10y ago
What standard are you applying to distinguish "insecure" from "secure"?
Twirrim 10y ago
It doesn't seem to be loading all the data when you browse the "human" site. Stops at ftw.mail (if there's a way to go on to the next page, it isn't obvious)
daveguy 10y ago
This is awesome. What a great service! Just curious, what stack did you use for the human browsable site and database? I am looking for a quick data reporting stack like this that is hopefully easy to set up in Python. Any advice?
- jayfk 10y ago
  I wouldn't call it stack, really. It's just a little bit jQuery flavored JavaScript that loads the DB via ajax and adds all entries to the DOM. Under 30 LOC: https://github.com/pyupio/safety-db/blob/master/docs/index.html#L67 https://github.com/pyupio/safety-db/blob/master/docs/index.h... It's a bit dirty, but was the right tool for the job. If you are working on a larger project, I'd probably use some template language like mustache to render the elements.
deleted 10y ago
[deleted]

94 points by jayfk 10y ago

Is the backend getting hammered? https://pyupio.github.io/safety-db https://pyupio.github.io/safety-db is just looping a loading animation.

jayfk 10y ago
The site is loading the data directly from the repo. Maybe HN has triggered some abuse mechanism. Edit: Switched to S3 to load the data.

jacknews 10y ago

Just a single wrong character can really ruin a package

svisser 10y ago

This can detect when a CVE vulnerability is fixed but how would you know the version number at which it was introduced?

jayfk 10y ago
Most CVEs have a pretty good descriptions. For example CVE-2016-6186[1]: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. [1] http://www.cvedetails.com/cve/CVE-2016-6186/ http://www.cvedetails.com/cve/CVE-2016-6186/

eganist 10y ago

Can you get in touch with the guys at OWASP Dependency Check? It's one of their more mature projects, and it essentially does a lot of what you described and then some, including for Python projects. https://www.owasp.org/index.php/OWASP_Dependency_Check https://www.owasp.org/index.php/OWASP_Dependency_Check I can make a connection between you and Jeremy Long (head of the project) if you'd like. He's also on twitter as @ctxt

vinayan3 10y ago

Really cool stuff. I love it! Thank you for making this. A side note anyone using Django should keep up to date. If you see the list of versions and the related packages which have known vulnerabilities you will realize keeping up to date is critical.

SubiculumCode 10y ago

HN title contains a misspelling: insucure should be insecure Unless insucure is a Python package I do not know about.

pekk 10y ago

What standard are you applying to distinguish "insecure" from "secure"?

Twirrim 10y ago

It doesn't seem to be loading all the data when you browse the "human" site. Stops at ftw.mail (if there's a way to go on to the next page, it isn't obvious)

daveguy 10y ago

This is awesome. What a great service! Just curious, what stack did you use for the human browsable site and database? I am looking for a quick data reporting stack like this that is hopefully easy to set up in Python. Any advice?

jayfk 10y ago
I wouldn't call it stack, really. It's just a little bit jQuery flavored JavaScript that loads the DB via ajax and adds all entries to the DOM. Under 30 LOC: https://github.com/pyupio/safety-db/blob/master/docs/index.html#L67 https://github.com/pyupio/safety-db/blob/master/docs/index.h... It's a bit dirty, but was the right tool for the job. If you are working on a larger project, I'd probably use some template language like mustache to render the elements.

deleted 10y ago

[deleted]