5 ms·

Hey! I'm one of the maintainers behind the Ruby advisory database: https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db We'

by phillmv 12y ago

Hey! I'm one of the maintainers behind the Ruby advisory database: https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db We're trying to build a common database for people building these tools; at the moment, trawling through CVE disclosures and various mailing lists is a largely manual process that we can reap economies of scale by pooling our efforts together. It's free and volunteer run. I would like to encourage you and anyone else reading this who is interested in bolstering the security ecosystem to consider using and contributing to the advisory database. It's the database that powers http://github.com/rubysec/bundler-audit http://github.com/rubysec/bundler-audit and (disclaimer: I made this) https://gemcanary.com https://gemcanary.com and the more people contributing the more we can all benefit from improving the ways we can notify end users of their vulnerable dependencies. Thanks,

vasinov 12y ago
Do you know of any apps like https://hakiri.io https://hakiri.io that automate security scanning and serve as a security monitor for any future disclosures? Also, how would one use bundler-audit if a Rails app is not actively maintained?
- phillmv 12y ago
  Yeah, like I mentioned above the app I built (https://gemcanary.com https://gemcanary.com) automates disclosure notification, and I believe? https://codeclimate.com/ https://codeclimate.com/ may use the advisory database as well, but I do not know for a fact. There's a few others but they've slipped my mind at the moment. I use bundler-audit when performing security audits for clients. You could wrap it in a git commit hook and have it publish results, but to my knowledge no one's done it that way.
- jamie_ca 12y ago
  I believe [Code Climate](https://codeclimate.com/ https://codeclimate.com/) will report vulnerable gem versions in your app. Their marketing page suggests that they also analyze how you use a vulnerable library to see if you're affected or not.
dmix 12y ago
Is there any way to run these scanners locally? For example, is there something blocking the ability to simply hook Gem Canary into say a git hook or similar local action, and checking Gemfile.lock with the scanning service? I'm not super-comfortable connecting private Github repos to remote web services. Github's (and other applications) recent OAuth exploits aren't very comforting and I'm generally the paranoid type.
- phillmv 12y ago
  Bundler audit is entirely local; you install it as a gem, and it fetches a fresh copy of the database on its own. Regarding Gemcanary, we're actually in the midst of building something just like that because we deeply hate storing Github tokens - but the ease of use was too good to not go for with our proof of concept. Once we release the new feature it'll be our goal to move as many people as possible away from giving us access to their private github repos.
- thesp0nge 12y ago
  Codesake-dawn gem (I wrote), and brakeman scanner are the ones you're looking for. You can run locally on your projects and having some remediation hints. Paolo

by phillmv 12y ago

vasinov 12y ago

Do you know of any apps like https://hakiri.io https://hakiri.io that automate security scanning and serve as a security monitor for any future disclosures? Also, how would one use bundler-audit if a Rails app is not actively maintained?

phillmv 12y ago
Yeah, like I mentioned above the app I built (https://gemcanary.com https://gemcanary.com) automates disclosure notification, and I believe? https://codeclimate.com/ https://codeclimate.com/ may use the advisory database as well, but I do not know for a fact. There's a few others but they've slipped my mind at the moment. I use bundler-audit when performing security audits for clients. You could wrap it in a git commit hook and have it publish results, but to my knowledge no one's done it that way.
jamie_ca 12y ago
I believe [Code Climate](https://codeclimate.com/ https://codeclimate.com/) will report vulnerable gem versions in your app. Their marketing page suggests that they also analyze how you use a vulnerable library to see if you're affected or not.

dmix 12y ago

Is there any way to run these scanners locally? For example, is there something blocking the ability to simply hook Gem Canary into say a git hook or similar local action, and checking Gemfile.lock with the scanning service? I'm not super-comfortable connecting private Github repos to remote web services. Github's (and other applications) recent OAuth exploits aren't very comforting and I'm generally the paranoid type.

phillmv 12y ago
Bundler audit is entirely local; you install it as a gem, and it fetches a fresh copy of the database on its own. Regarding Gemcanary, we're actually in the midst of building something just like that because we deeply hate storing Github tokens - but the ease of use was too good to not go for with our proof of concept. Once we release the new feature it'll be our goal to move as many people as possible away from giving us access to their private github repos.
thesp0nge 12y ago
Codesake-dawn gem (I wrote), and brakeman scanner are the ones you're looking for. You can run locally on your projects and having some remediation hints. Paolo