4 ms·

Attackers now scrambling onto Github to run this against open projects

• deleted 4y ago
  [deleted]
• tgv 4y ago
  It's checks against a list of known vulnerabilities. If you search the go.mod or .sum files on github for them, you have an more powerful route, I think.
  • waihtis 4y ago
    Hmm, thought the problem with that was poor fidelity.. from the top comment: > go.sum… ends up reporting a lot of vulnerabilities that you don't actually care about because your code isn't actually linking to the optional transitive dependency that has the vulnerability in it. Not a Go dev myself though.
  • artitars 4y ago
    Even though a search based on go.mod or .sum files should definitely result in more hits, the new vulnerability management should be way more efficient, because it is already filtered for more relevant hits and should thus contain more signal vs noise as it only returns at least transitively used vulns. Am I missing something here?
  • preseinger 4y ago
    Neither of those files reliably represents the actual dep graph of your program.
  • smoyer 4y ago
    The vulnerability list is open source and you can get a list of public projects that use each dependency from pkg.go.dev - if you really want a list, there are at least a few ways that are more efficient than scanning GitHub! (As you pointed out above)