6 ms·

Don't find out about Ruby vulnerabilities through Hacker News and Twitter

92 points by phillmv 14y ago

throwawayG9 14y ago
We have this for PHP: https://security.sensiolabs.org/ https://security.sensiolabs.org/ You should consider building something similar.
phillmv 14y ago
Hey! We built this as an itch scratcher - something that will only notify us about security updates. We've been working on this for a couple weeks now, and we think other people might find it useful. We're still in beta and adding some polish, so please let us know if something breaks. Also, it's possible we may run up against the GitHub API rate limit, so bear with us if we turn off new user signups. Thanks!,
- ConstantineXVI 14y ago
  Seems it'd be much more useful to be able to have a commit hook POST the app's Gemfile to your service instead of doing everything via GitHub, unless there's something I'm missing?
  - phillmv 14y ago
    I agree. If you login through github and enable notifications, we install a post-receive hook. For non github projects… we plan on eventually supporting that, but GitHub was an easy-lowest-common-denominator.
- fla 14y ago
  Defenately something uselful I would pay for. Unfortunately I can't let you access my private repos. Any alternative ?
  - bryanthompson 14y ago
    Exactly what stopped me. I'd upload my Gemfile.locks, but I had to bail out at the github login screen.
  - phillmv 14y ago
    We're planning on releasing a gem so you can use it without github. If you're interested, add your email through the "I don't use GitHub" link on the front page, and we'll let you know when it's ready :).
- kmfrk 14y ago
  How do you detect when something's a security update - and not just an incremental patch or feature addition?
tantalor 14y ago
Very interesting, but why is it ruby specific? What about packages vulnerabilities in other languages? Surely you can parse Javascript and Python requirement files as well, the concept is no different.
- endtwist 14y ago
  (Disclaimer: I'm one of the founders.) BundleScout[1] does this for other languages, including Node.js and Python--and of course Ruby Gems. We don't have Github integration yet, but you can simply upload your requirements file (which, it seems, some people would rather do anyway). [1] https://bundlescout.com https://bundlescout.com
  - pulledpork 14y ago
    This is very cool. I'm not a ruby dev but just coming into this thread and finding out there are alternatives for my languages is fantastic. Congrats on a cool product and I'm glad it was posted here.
  - kmfrk 14y ago
    The design is gorgeous. A few observations: 1. When I upload a requirements.txt file, let me just pick 5 packages from the file instead of telling me I have to upgrade to use it. 2. Why is Django listed as the old version 1.3.7 in my dash? 3. You have a Twitter account, but there appears to be no link on your website that I could spot.
    - endtwist 14y ago
      Well, thank you! 1. We just pushed the import feature a couple days ago so we're still tweaking how it works. This is a good suggestion, I'll definitely take it into consideration. 2. You should be seeing 1.3.7 as the 'old version' (last update we detected). We're still working on better branch/track breakdown--this isn't an issue for most packages. 3. The Twitter account is linked at the bottom of the page :) Let me know at friends [at] bundlescout [.] com if you're not seeing the right Django version and I'll look into it today.
bradleyland 14y ago
Congrats on launching guys, but I'm going to be really honest here. The requirement that I provide access to my Github repos like this is a deal breaker. For a security related product, this creates a huge attack surface and audit requirement. From a security standpoint, what you want to do is less important than what you can do, and the access controls you use currently -- public or public + private -- just aren't fine grained enough.
- ryanbrunner 14y ago
  I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private repositories in general. You could probably hack around it by creating an integration account that only has access to the repositories that you want to integrate. If you're asking for only access to the Gemfile and not the repository, that's far outside the security model of GitHub, and even Git. Maybe a good alternative for people security conscious would be a manual Gemfile upload?
- phillmv 14y ago
  >For a security related product, this creates a huge attack surface and audit requirement. We agree. We spent a lot of time debating this. We originally set out to build a gem, but realized it was so much easier to use through GitHub. Unfortunately, we can't provide more granular access due to what the API gives us. We plan on eventually releasing said gem, as noted in the "I don't use github" link on the front page :).
  - mrgreenfur 14y ago
    What about a functionality where I can upload my gemfile when I deploy? I deploy, cap sends you my gemfile and you notify me.
    - phillmv 14y ago
      Exactly what we had in mind. Soon!
param 14y ago
How is this better than brakeman? (http://brakemanscanner.org/ http://brakemanscanner.org/) Seems like they only pretty much check your gem dependencies while brakeman also does static code analysis and points out potential sql injection spots etc...
- re_todd 14y ago
  Yeah, brakeman is awesome, here is a railscast for anyone interested: http://railscasts.com/episodes/358-brakeman http://railscasts.com/episodes/358-brakeman
- InAnEmergency 14y ago
  Brakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit https://github.com/postmodern/bundler-audit
- boonedocks 14y ago
  Brakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though. https://github.com/presidentbeef/brakeman/issues/276 https://github.com/presidentbeef/brakeman/issues/276 A complementary command-line tool would be fine too.
existentialmutt 14y ago
Where do you guys find out about security vulnerabilities?
- ontoillogical 14y ago
  (I'm the other person responsible for gemcanary) Having a record of all the security vulnerabilities that affect the Ruby community is important. To that end, we help maintain https://github.com/rubysec/ruby-advisory-db/ https://github.com/rubysec/ruby-advisory-db/ which is free for anyone to use or contribute to.
camus 14y ago
Oh yeah ,now i get it , it is like a canary in a coal mine !!! great project guys .
habosa 14y ago
This is really well done, thanks! I read HN every day and I thought I was fairly up to date after the last Rails security scramble but you guys pointed out a few more gems I need to update/remove. Integration was seamless and I got the information I came for in less than 2 minutes.
pnathan 14y ago
I think this is the best headline/page I've read for a long time. It neatly states an obvious problem in the headline, then on landing, proposes a service to solve the problem that we know exists. If I had a ruby system, I'd be on this like, well, frosting on a cupcake. Mmmmm, cupcakes. :)
deleted 14y ago
[deleted]
dguido 14y ago
Postmodern wrote a gem to do this entirely on your own, no giving away access to your Github repositories necessary. Check out bundle-audit: https://github.com/postmodern/bundler-audit https://github.com/postmodern/bundler-audit
- ontoillogical 14y ago
  We're actually collaborating with him on the advisory database that gemcanary and bundler-audit both use. It's free and open for anyone to use. Check it out: https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db
  - dguido 14y ago
    Cool, the whole system of projects you guys are working on look exciting. Glad that Ruby is finally getting its act together a little bit.
vaprem911 14y ago
Again, you RubyTards need to grow up and realize the consequences of using an immature security-hole ridden open source software and quit using it just because it looks "cool" on your resume. You are probably also not getting paid even half of what enterprise .Net and Java developers make with 1/2 the effort. Security should never be an afterthought. You'll realize when that "cute" site you build gets hacked by a 12 year old in China or Iran! And quit downvoting me cos I am saying it like it is, you PG Groupies! ~premsai karthikayan (someone called me coward for not using real name, so here it is!)
gravis 14y ago
I'm personally using https://gemnasium.com https://gemnasium.com, and very happy with it

92 points by phillmv 14y ago

We have this for PHP: https://security.sensiolabs.org/ https://security.sensiolabs.org/ You should consider building something similar.

phillmv 14y ago

Hey! We built this as an itch scratcher - something that will only notify us about security updates. We've been working on this for a couple weeks now, and we think other people might find it useful. We're still in beta and adding some polish, so please let us know if something breaks. Also, it's possible we may run up against the GitHub API rate limit, so bear with us if we turn off new user signups. Thanks!,

ConstantineXVI 14y ago
Seems it'd be much more useful to be able to have a commit hook POST the app's Gemfile to your service instead of doing everything via GitHub, unless there's something I'm missing?
- phillmv 14y ago
  I agree. If you login through github and enable notifications, we install a post-receive hook. For non github projects… we plan on eventually supporting that, but GitHub was an easy-lowest-common-denominator.
fla 14y ago
Defenately something uselful I would pay for. Unfortunately I can't let you access my private repos. Any alternative ?
- bryanthompson 14y ago
  Exactly what stopped me. I'd upload my Gemfile.locks, but I had to bail out at the github login screen.
- phillmv 14y ago
  We're planning on releasing a gem so you can use it without github. If you're interested, add your email through the "I don't use GitHub" link on the front page, and we'll let you know when it's ready :).
kmfrk 14y ago
How do you detect when something's a security update - and not just an incremental patch or feature addition?

tantalor 14y ago

Very interesting, but why is it ruby specific? What about packages vulnerabilities in other languages? Surely you can parse Javascript and Python requirement files as well, the concept is no different.

endtwist 14y ago
(Disclaimer: I'm one of the founders.) BundleScout[1] does this for other languages, including Node.js and Python--and of course Ruby Gems. We don't have Github integration yet, but you can simply upload your requirements file (which, it seems, some people would rather do anyway). [1] https://bundlescout.com https://bundlescout.com
- pulledpork 14y ago
  This is very cool. I'm not a ruby dev but just coming into this thread and finding out there are alternatives for my languages is fantastic. Congrats on a cool product and I'm glad it was posted here.
- kmfrk 14y ago
  The design is gorgeous. A few observations: 1. When I upload a requirements.txt file, let me just pick 5 packages from the file instead of telling me I have to upgrade to use it. 2. Why is Django listed as the old version 1.3.7 in my dash? 3. You have a Twitter account, but there appears to be no link on your website that I could spot.
  - endtwist 14y ago
    Well, thank you! 1. We just pushed the import feature a couple days ago so we're still tweaking how it works. This is a good suggestion, I'll definitely take it into consideration. 2. You should be seeing 1.3.7 as the 'old version' (last update we detected). We're still working on better branch/track breakdown--this isn't an issue for most packages. 3. The Twitter account is linked at the bottom of the page :) Let me know at friends [at] bundlescout [.] com if you're not seeing the right Django version and I'll look into it today.

bradleyland 14y ago

Congrats on launching guys, but I'm going to be really honest here. The requirement that I provide access to my Github repos like this is a deal breaker. For a security related product, this creates a huge attack surface and audit requirement. From a security standpoint, what you want to do is less important than what you can do, and the access controls you use currently -- public or public + private -- just aren't fine grained enough.

ryanbrunner 14y ago
I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private repositories in general. You could probably hack around it by creating an integration account that only has access to the repositories that you want to integrate. If you're asking for only access to the Gemfile and not the repository, that's far outside the security model of GitHub, and even Git. Maybe a good alternative for people security conscious would be a manual Gemfile upload?
phillmv 14y ago
>For a security related product, this creates a huge attack surface and audit requirement. We agree. We spent a lot of time debating this. We originally set out to build a gem, but realized it was so much easier to use through GitHub. Unfortunately, we can't provide more granular access due to what the API gives us. We plan on eventually releasing said gem, as noted in the "I don't use github" link on the front page :).
- mrgreenfur 14y ago
  What about a functionality where I can upload my gemfile when I deploy? I deploy, cap sends you my gemfile and you notify me.
  - phillmv 14y ago
    Exactly what we had in mind. Soon!

param 14y ago

How is this better than brakeman? (http://brakemanscanner.org/ http://brakemanscanner.org/) Seems like they only pretty much check your gem dependencies while brakeman also does static code analysis and points out potential sql injection spots etc...

re_todd 14y ago
Yeah, brakeman is awesome, here is a railscast for anyone interested: http://railscasts.com/episodes/358-brakeman http://railscasts.com/episodes/358-brakeman
InAnEmergency 14y ago
Brakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit https://github.com/postmodern/bundler-audit
boonedocks 14y ago
Brakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though. https://github.com/presidentbeef/brakeman/issues/276 https://github.com/presidentbeef/brakeman/issues/276 A complementary command-line tool would be fine too.

existentialmutt 14y ago

Where do you guys find out about security vulnerabilities?

ontoillogical 14y ago
(I'm the other person responsible for gemcanary) Having a record of all the security vulnerabilities that affect the Ruby community is important. To that end, we help maintain https://github.com/rubysec/ruby-advisory-db/ https://github.com/rubysec/ruby-advisory-db/ which is free for anyone to use or contribute to.

camus 14y ago

Oh yeah ,now i get it , it is like a canary in a coal mine !!! great project guys .

habosa 14y ago

This is really well done, thanks! I read HN every day and I thought I was fairly up to date after the last Rails security scramble but you guys pointed out a few more gems I need to update/remove. Integration was seamless and I got the information I came for in less than 2 minutes.

pnathan 14y ago

I think this is the best headline/page I've read for a long time. It neatly states an obvious problem in the headline, then on landing, proposes a service to solve the problem that we know exists. If I had a ruby system, I'd be on this like, well, frosting on a cupcake. Mmmmm, cupcakes. :)

deleted 14y ago

[deleted]

dguido 14y ago

Postmodern wrote a gem to do this entirely on your own, no giving away access to your Github repositories necessary. Check out bundle-audit: https://github.com/postmodern/bundler-audit https://github.com/postmodern/bundler-audit

ontoillogical 14y ago
We're actually collaborating with him on the advisory database that gemcanary and bundler-audit both use. It's free and open for anyone to use. Check it out: https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db
- dguido 14y ago
  Cool, the whole system of projects you guys are working on look exciting. Glad that Ruby is finally getting its act together a little bit.

vaprem911 14y ago

Again, you RubyTards need to grow up and realize the consequences of using an immature security-hole ridden open source software and quit using it just because it looks "cool" on your resume. You are probably also not getting paid even half of what enterprise .Net and Java developers make with 1/2 the effort. Security should never be an afterthought. You'll realize when that "cute" site you build gets hacked by a 12 year old in China or Iran! And quit downvoting me cos I am saying it like it is, you PG Groupies! ~premsai karthikayan (someone called me coward for not using real name, so here it is!)

gravis 14y ago

I'm personally using https://gemnasium.com https://gemnasium.com, and very happy with it