3 ms·

Hey team, great to see someone tackle this project, and the idea to scan for new potential issues based on the code that changed is cool Initial impressions wh

by plasma 5y ago

Hey team, great to see someone tackle this project, and the idea to scan for new potential issues based on the code that changed is cool Initial impressions when visiting the website though is I can't understand how it works exactly, for example the learn more page at https://socket.dev/integrations https://socket.dev/integrations says Socket helps improve the posture, but it would be good to explain (perhaps with screenshots an actual example?) of it catching an issue.

feross 5y ago
Thanks, glad you like our approach! Sorry about the confusing page. We're still working on some of the pages on the site. You might find these links more informative: - Launch post: https://socket.dev/blog/introducing-socket https://socket.dev/blog/introducing-socket - What's Really Going On Inside Your node_modules Folder? https://socket.dev/blog/inside-node-modules https://socket.dev/blog/inside-node-modules - And maybe even the launch Twitter thread: https://twitter.com/feross/status/1498676284590800903 https://twitter.com/feross/status/1498676284590800903
bretc 5y ago
I'm actually working on that page right now hah. Right now the integration is fairly slim, it just does typo squat warnings when you install a package that has a similar name to a more common package. The warning comes in the form of a comment in PRs that include additions of packages that meet this criteria. We have a bunch of other detections listed here: https://socket.dev/npm/issue https://socket.dev/npm/issue which have not been added to the GitHub App yet, but are available on a per-package basis for manual research at the moment. Over the next few release cycles we will be adding additional issue checks and warnings to the Github integration so that you can get a warning when dependencies add new capabilities, add suspicious things like analytics or install scripts or add unknown publishers to their maintainer list, or start publishing binary or obfuscated code. These will be automatically turned on and rolled out as we determine them to be not too noisy and provide interesting signals.

by plasma 5y ago

feross 5y ago

Thanks, glad you like our approach! Sorry about the confusing page. We're still working on some of the pages on the site. You might find these links more informative: - Launch post: https://socket.dev/blog/introducing-socket https://socket.dev/blog/introducing-socket - What's Really Going On Inside Your node_modules Folder? https://socket.dev/blog/inside-node-modules https://socket.dev/blog/inside-node-modules - And maybe even the launch Twitter thread: https://twitter.com/feross/status/1498676284590800903 https://twitter.com/feross/status/1498676284590800903

bretc 5y ago

I'm actually working on that page right now hah. Right now the integration is fairly slim, it just does typo squat warnings when you install a package that has a similar name to a more common package. The warning comes in the form of a comment in PRs that include additions of packages that meet this criteria. We have a bunch of other detections listed here: https://socket.dev/npm/issue https://socket.dev/npm/issue which have not been added to the GitHub App yet, but are available on a per-package basis for manual research at the moment. Over the next few release cycles we will be adding additional issue checks and warnings to the Github integration so that you can get a warning when dependencies add new capabilities, add suspicious things like analytics or install scripts or add unknown publishers to their maintainer list, or start publishing binary or obfuscated code. These will be automatically turned on and rolled out as we determine them to be not too noisy and provide interesting signals.