7 ms·

Libre Tools from the National Cybersecurity Competence Center of Luxembourg

58 points by cedricbonhomme 4y ago

cedricbonhomme 4y ago
source code of various related projects: https://github.com/NC3-LU/ https://github.com/NC3-LU/
- rosnd 4y ago
  Which projects do you think would be most interesting to HN users?
  - cedricbonhomme 4y ago
    I would say this one: https://opensource.nc3.lu/projects/saems/ https://opensource.nc3.lu/projects/saems/ https://github.com/scandale-project https://github.com/scandale-project It's the most recent, really in development. It's about scanning IP ranges, looking for vulnerabilities (in MS Exchange Servers and various things) and sending notifications. Some parts are already used for operational stuff (NMAP Script Engines for example). An other really interesting project, under AGPL as well: https://opensource.nc3.lu/projects/monarc/ https://opensource.nc3.lu/projects/monarc/ "MONARC is an iterative and qualitative method of risk analysis in four stages, broadly inspired by ISO/IEC 27005." ;-) And maybe this project: https://github.com/NC3-LU/MOSP https://github.com/NC3-LU/MOSP As you can see it's a collaborative platform to share security related JSON objects. The nice thing is the object editing user interface automatically generated thanks to the JSON schemas. The project provides an API and is connected to every MONARC instances.
    - gallypette 4y ago
      scandale-project is also meant to monitor constituencies' actions after being notified about security issues. The idea is to timestamp scan results with a Time Stamp Authority to have a clear and indisputable incident timeline following a notification. The aim is to nudge constituencies to take action and also give them leverage on non-cooperating suppliers. No infrastructure change or patch after repeated notifications is not a good trajectory to be on--hence the name, scandale :)
- tpxl 4y ago
  Licensed under GNU AGPL, nice.
  - i10s 4y ago
    Interesting to know why exactly this license because GNU GPL3 is more common.
    - tpxl 4y ago
      > The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. > The purpose of the GNU Affero GPL is to prevent a problem that affects developers of free programs that are often used on servers. AGPL is GPL3 but better IMO.
    - cedricbonhomme 4y ago
      indeed, tpxl is right. Affero GPL fits well for Web software (services provided by a server).
  - sneak 4y ago
    It's not really nice; the AGPL is considered by many (myself included) to be a nonfree license created by anticapitalist zealots. https://nitter.net/marcan42/status/1512269055763566592 https://nitter.net/marcan42/status/1512269055763566592 https://nitter.net/marcan42/status/1512267950551867395 https://nitter.net/marcan42/status/1512267950551867395 https://nitter.net/marcan42/status/1512267952573526026 https://nitter.net/marcan42/status/1512267952573526026
    - cedricbonhomme 4y ago
      " ...the only entities capable of safely using the AGPL are companies using it to dump source ... " I stopped reading here. But this will definitely make my day. I won't even start to list examples of companies (private sector, public sector, research, etc.) that are not in this "only entities".
xnickb 4y ago
Why are they using Telegram's logo as their icon for "Open"?
- cedricbonhomme 4y ago
  It's (Font Awesome) fa-paper-plane, and not fa-telegram. No but seriously I admit it's not a good choice. We will change it to something else. I personally never used Telegram, I do not even know how their Website looks like.

cedricbonhomme 4y ago

source code of various related projects: https://github.com/NC3-LU/ https://github.com/NC3-LU/

rosnd 4y ago
Which projects do you think would be most interesting to HN users?
- cedricbonhomme 4y ago
  I would say this one: https://opensource.nc3.lu/projects/saems/ https://opensource.nc3.lu/projects/saems/ https://github.com/scandale-project https://github.com/scandale-project It's the most recent, really in development. It's about scanning IP ranges, looking for vulnerabilities (in MS Exchange Servers and various things) and sending notifications. Some parts are already used for operational stuff (NMAP Script Engines for example). An other really interesting project, under AGPL as well: https://opensource.nc3.lu/projects/monarc/ https://opensource.nc3.lu/projects/monarc/ "MONARC is an iterative and qualitative method of risk analysis in four stages, broadly inspired by ISO/IEC 27005." ;-) And maybe this project: https://github.com/NC3-LU/MOSP https://github.com/NC3-LU/MOSP As you can see it's a collaborative platform to share security related JSON objects. The nice thing is the object editing user interface automatically generated thanks to the JSON schemas. The project provides an API and is connected to every MONARC instances.
  - gallypette 4y ago
    scandale-project is also meant to monitor constituencies' actions after being notified about security issues. The idea is to timestamp scan results with a Time Stamp Authority to have a clear and indisputable incident timeline following a notification. The aim is to nudge constituencies to take action and also give them leverage on non-cooperating suppliers. No infrastructure change or patch after repeated notifications is not a good trajectory to be on--hence the name, scandale :)
tpxl 4y ago
Licensed under GNU AGPL, nice.
- i10s 4y ago
  Interesting to know why exactly this license because GNU GPL3 is more common.
  - tpxl 4y ago
    > The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. > The purpose of the GNU Affero GPL is to prevent a problem that affects developers of free programs that are often used on servers. AGPL is GPL3 but better IMO.
  - cedricbonhomme 4y ago
    indeed, tpxl is right. Affero GPL fits well for Web software (services provided by a server).
- sneak 4y ago
  It's not really nice; the AGPL is considered by many (myself included) to be a nonfree license created by anticapitalist zealots. https://nitter.net/marcan42/status/1512269055763566592 https://nitter.net/marcan42/status/1512269055763566592 https://nitter.net/marcan42/status/1512267950551867395 https://nitter.net/marcan42/status/1512267950551867395 https://nitter.net/marcan42/status/1512267952573526026 https://nitter.net/marcan42/status/1512267952573526026
  - cedricbonhomme 4y ago
    " ...the only entities capable of safely using the AGPL are companies using it to dump source ... " I stopped reading here. But this will definitely make my day. I won't even start to list examples of companies (private sector, public sector, research, etc.) that are not in this "only entities".

xnickb 4y ago

Why are they using Telegram's logo as their icon for "Open"?

cedricbonhomme 4y ago
It's (Font Awesome) fa-paper-plane, and not fa-telegram. No but seriously I admit it's not a good choice. We will change it to something else. I personally never used Telegram, I do not even know how their Website looks like.