4 ms·

Remember: This is a 50 line Python script that is a wrapper for nmap + vulners NSE script. It's not a product, but some simple automation around existing tooli

Remember: This is a 50 line Python script that is a wrapper for nmap + vulners NSE script. It's not a product, but some simple automation around existing tooling. Better than paying $$$ for a full fledged scanner? Maybe, but depends on your use case.

peterwwillis 7y ago
Yeah, this is someone's two-week project which somehow became a blog post, and they're trying to look good to their execs for it. I made scripts like these at a previous company in about two weeks. One prints a network map based on traceroutes gathered from nmap scans: https://github.com/psypete/public-bin/blob/public-bin/src/networking/print_network_map.pl https://github.com/psypete/public-bin/blob/public-bin/src/ne... Another set checks all TLS certs found in an nmap scan: https://github.com/psypete/public-bin/tree/public-bin/src/networking/check-ssl https://github.com/psypete/public-bin/tree/public-bin/src/ne... But I wouldn't write a <edit> public-facing company-product-announcing </edit> blog post about them.
- jgrahamc 7y ago
  and they're trying to look good to their execs for it. That’s unnecessarily mean to Nadin who worked on this and misreads how this got created and written up.
  - peterwwillis 7y ago
    I apologize sincerely to Nadin, I didn't mean to imply this was their personal goal. I meant the team/team lead/department lead/etc that approved this public blog post. Probably there's been some grumbling from above about not showing the value of said team, so somebody said, hey Nadin, can you write up a blog post of that security work you did? The end result is the team gets some public recognition and their bosses (& execs) are now happy. Meanwhile, the internet is like, why are they showing us somebody's two-week project like it's a new VPN or something?
- ignoramous 7y ago
  That's fair, but since Cloudflare has the reach and cred, it makes sense for them to: 1. Call BS on expensive compliance solutions. 2. Show they're relentlessly resourcesful and how other upstarts could be, too. 3. Prefer the scrappy, get-the-job-done over NIH. Personally, I'm glad they blogged abt it, and generally too, in that they engage with the news.yc community despite having grown so large.

peterwwillis 7y ago

Yeah, this is someone's two-week project which somehow became a blog post, and they're trying to look good to their execs for it. I made scripts like these at a previous company in about two weeks. One prints a network map based on traceroutes gathered from nmap scans: https://github.com/psypete/public-bin/blob/public-bin/src/networking/print_network_map.pl https://github.com/psypete/public-bin/blob/public-bin/src/ne... Another set checks all TLS certs found in an nmap scan: https://github.com/psypete/public-bin/tree/public-bin/src/networking/check-ssl https://github.com/psypete/public-bin/tree/public-bin/src/ne... But I wouldn't write a <edit> public-facing company-product-announcing </edit> blog post about them.

jgrahamc 7y ago
and they're trying to look good to their execs for it. That’s unnecessarily mean to Nadin who worked on this and misreads how this got created and written up.
- peterwwillis 7y ago
  I apologize sincerely to Nadin, I didn't mean to imply this was their personal goal. I meant the team/team lead/department lead/etc that approved this public blog post. Probably there's been some grumbling from above about not showing the value of said team, so somebody said, hey Nadin, can you write up a blog post of that security work you did? The end result is the team gets some public recognition and their bosses (& execs) are now happy. Meanwhile, the internet is like, why are they showing us somebody's two-week project like it's a new VPN or something?
ignoramous 7y ago
That's fair, but since Cloudflare has the reach and cred, it makes sense for them to: 1. Call BS on expensive compliance solutions. 2. Show they're relentlessly resourcesful and how other upstarts could be, too. 3. Prefer the scrappy, get-the-job-done over NIH. Personally, I'm glad they blogged abt it, and generally too, in that they engage with the news.yc community despite having grown so large.