3 ms·

Snyk isn’t great to be honest and neither is Dependabot though I like the latter better. GitHub is the only company uniquely positioned to fix/profit from the

Snyk isn’t great to be honest and neither is Dependabot though I like the latter better. GitHub is the only company uniquely positioned to fix/profit from the major problem of insecure FOSS toolchains but for whatever reason they are dragging their feet on it. Features I’d like to see from GH: - Private package repository. Each package includes metadata and rank based upon if its actively maintained or includes vulns. Being a GitHub Sponsor would be mandatory for all companies using the service. - License audit: At the click of a button or api request fetch licenses for each dependency listed in your repo’s requirements.txt, gemfile, package.JSON etc. Extra points if it can flag problematic licenses automagically - Dynamic scanning: They are already offering static scans against source code might as well go a step further - Automagic secure code checklists: Scan my PR’s code and dependencies then generate a checklist for my dev teams use case. - Signed-off Exceptions: Give me the option to configure better notifications and more accountability for Dependabot. If I haven’t addressed a vulnerability then automatically communicate the risk to a reviewer. - Centralized dashboard: Let me view all vulnerabilities for all repos for my organization in one place

sverhagen 6y ago
And some people might feel all of that is not GitHub's job. Maybe because they like the tools that are familiar to their technology stack, for better or worse. And maybe GitHub doesn't feel like stepping into that minefield?
- underwater 6y ago
  Github own npm. They're absolutely the right company to do this.
- jollofricepeas 6y ago
  I disagree completely. They have already stepped their foot into application security in a big way. See: https://github.com/features/security https://github.com/features/security With a little bit more concentrated effort, they could take major market share from Veracode, Synopsys and every other appsec outfit for lunch.
  - alokshukla 6y ago
    Just because you are the core infra provider, does not automatically position you to provide the best security. AWS does not provides the best web or network firewalls, microsoft never had the best AV, so forth and so on. If security is not your core mission, it is always hard to create a fundamentally good offering. That is at least the less of history of such companies. May be Github surprises, but that is what it is.
jackpeterfletch 6y ago
What are your problems Snyk/Dependabot out of interest?
- jollofricepeas 6y ago
  Dependabot doesn’t work well for a Fortune 50 company or any company with a large micro services pattern because app sec teams are small. It’s really hard to provide oversight or even counsel a development team if you have no centralized view into whats happening across your organization. That’s one problem but there are others like not keeping updated to the latest versions of languages and frameworks. Snyk like most security tools lacks perspective that takes business and how product teams work into consideration. I’ve heard good things about their container security tools but their appsec stuff doesnt appear to be worth it (they demoed for us recently). We don’t need yet another tool that offers up vulns in isolation of business context. A high vulnerability is not high if compensating controls and application value aren’t considered. That’s great your tool can be yet something else that bugs my devs come deploy time. Want to be worth it? Snyk should focus on moving security left into sprint planning. If not, then they are fundamentally selling the same tools as Veracode and Synopsys.

sverhagen 6y ago

And some people might feel all of that is not GitHub's job. Maybe because they like the tools that are familiar to their technology stack, for better or worse. And maybe GitHub doesn't feel like stepping into that minefield?

underwater 6y ago
Github own npm. They're absolutely the right company to do this.
jollofricepeas 6y ago
I disagree completely. They have already stepped their foot into application security in a big way. See: https://github.com/features/security https://github.com/features/security With a little bit more concentrated effort, they could take major market share from Veracode, Synopsys and every other appsec outfit for lunch.
- alokshukla 6y ago
  Just because you are the core infra provider, does not automatically position you to provide the best security. AWS does not provides the best web or network firewalls, microsoft never had the best AV, so forth and so on. If security is not your core mission, it is always hard to create a fundamentally good offering. That is at least the less of history of such companies. May be Github surprises, but that is what it is.

jackpeterfletch 6y ago

What are your problems Snyk/Dependabot out of interest?

jollofricepeas 6y ago
Dependabot doesn’t work well for a Fortune 50 company or any company with a large micro services pattern because app sec teams are small. It’s really hard to provide oversight or even counsel a development team if you have no centralized view into whats happening across your organization. That’s one problem but there are others like not keeping updated to the latest versions of languages and frameworks. Snyk like most security tools lacks perspective that takes business and how product teams work into consideration. I’ve heard good things about their container security tools but their appsec stuff doesnt appear to be worth it (they demoed for us recently). We don’t need yet another tool that offers up vulns in isolation of business context. A high vulnerability is not high if compensating controls and application value aren’t considered. That’s great your tool can be yet something else that bugs my devs come deploy time. Want to be worth it? Snyk should focus on moving security left into sprint planning. If not, then they are fundamentally selling the same tools as Veracode and Synopsys.