asadeddin

7 ms·

1. 31.▲
   by asadeddin 3y ago

   The crypto in this case doesn't come from the server. Nothing goes to the server for encryption. It's actually the browser that's generating the key pair and encrypting and decrypting. This is what makes all of this unique. S
2. 32.▲
   by asadeddin 3y ago

   The private keys are in the requester's browser. So if anyone gets a hold of the URL, they'll see nothing. For example, here's a secret I just put into Retriever. Are you able to see it? https://retriever.corgea.io
3. 33.▲
   by asadeddin 3y ago

   You can definitely do that. This is just a different mechanism to do so. Your statement could be applied on any secret sharing system that 1password, Bitwarden, Lastpass have. They have a place in the world, and I'm not sure everyone i
4. 34.▲
   by asadeddin 3y ago

   The end result of sharing the secret is the same. We didn't reinvent secret sharing. What's unique here is there's no server keeping record of a secret, a link or the parties involved. It's the truest form of zero-knowle
5. 35.▲
   by asadeddin 3y ago

   Totally! Someone was kind enough to issue a PR to allow you to delete the private key and generate a new one. We're going to fold those changes in.
6. 36.▲
   by asadeddin 3y ago

   Thanks! Yea, that's all you need to do really. It's pretty simple to get it up and running :)
7. 37.▲
   by asadeddin 3y ago

   Thank you! Glad that you love it, and hope you'll use it :)
8. 38.▲
   Show HN: Retriever – Securely share secrets over the internet(retriever.corgea.io)

   193 points by asadeddin 3y ago|99 comments
9. 39.▲
   by asadeddin 3y ago

   My apologies for taking too long to reply, and thanks for being patient. I must've missed this in the thread. I'm not sure what is happening. Things look correct. Could you reach out to us at support@corgea.com with your account?
10. 40.▲
    by asadeddin 3y ago

    Thanks for sharing this. We're aware of the challenge and we're considering competing. :)
11. 41.▲
    by asadeddin 3y ago

    I'll respond to this comment to provide a general response for all of the sub-comments here. As I highlighted in my post, LLM's generally are still not in a position to replace a developer for more complex tasks and refactoring. W
12. 42.▲
    by asadeddin 3y ago

    Thank you!
13. 43.▲
    by asadeddin 3y ago

    I believe we're in a similar category. A telling sign of what category a company belongs to is based on what conferences and events they're sponsoring and attending. Snyk and the likes sell to the security teams with dev friendlin
14. 44.▲
    by asadeddin 3y ago

    Thanks for sharing! Will look into it :)
15. 45.▲
    by asadeddin 3y ago

    Thank you! Please give it a spin. We'd love any feedback or thoughts. :) We are using it on our codebases, and it's helped us secure our own product. Users have also been trying it out with their private codebases, and we even use
16. 46.▲
    by asadeddin 3y ago

    Scrolling to the right should work, but you'll need to do so on each code editor section. We should combine scrolling of these two windows to be in sync. We'll also take a look at what's causing this. It might be a browser is
17. 47.▲
    by asadeddin 3y ago

    No worries. I think we might be talking past each other, and that's ok :). I believe we're defining the market differently. It sounds like you're talking about vulnerable code in other apps, and I'm talking about vulnera
18. 48.▲
    by asadeddin 3y ago

    Thanks for the feedback! For the first one the SAST scanner reports to us issues based on lines and issue type, so we generate fixes isolated for that issue. We do not generate fixes for other vulnerabilities in the same file for the same f
19. 49.▲
    by asadeddin 3y ago

    Thanks for commenting, and it is a great point. Keep in mind, we're not touting that Corgea is the fixer-all for every vulnerability. CWE's typically have simpler and more standardized fixes. You can see examples of that here: ht
20. 50.▲
    by asadeddin 3y ago

    Thanks for commenting, and totally get your perspective on it. Scanning today can be done locally with many tools like Semgrep before you use Corgea. We do send over vulnerability information over to Corgea to make sure we can issue fixes f
21. 51.▲
    by asadeddin 3y ago

    Thanks for commenting. We're always trying to learn more and iterate to make Corgea better. How should've the fix looked like?
22. 52.▲
    by asadeddin 3y ago

    For your first point, we're not responsible for detecting what is vulnerable (or even exploitable). Today there are 4 categories of vulnerabilities in software: 1 - CVE's which you've mentioned around updating dependencies. T
23. 53.▲
    by asadeddin 3y ago

    Thanks for highlighting this. This fix is to demonstrate more sophisticated fixes, and it does require human input to determine the correct domain and IP config. We are introducing in the product for the ability for humans to add additional
24. 54.▲
    by asadeddin 3y ago

    Thanks for the comment. - I would agree that a big chunk of vulnerability market helps with things that companies don't own, but I'm not sure it's that high. A lot of companies use SaaS tools and deploy tools they don't
25. 55.▲
    by asadeddin 3y ago

    You can use one of the existing scanners we support like Semgrep and Snyk to scan, and use Corgea to issue pull-requests for the fixes. We will support scanning in the future with some advanced capabilities.
26. 56.▲
    by asadeddin 3y ago

    Thank you!
27. 57.▲
    by asadeddin 3y ago

    Thank you!
28. 58.▲
    Launch HN: Corgea (YC S23) – Auto fix vulnerable code

    34 points by asadeddin 3y ago|43 comments