[{"data":1,"prerenderedAt":358},["ShallowReactive",2],{"project-10897121":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":46,"post_text":47,"what":48,"said":94,"maker_in_thread":199,"shape":206,"grid":209,"attempts":318,"same_week":319,"maker_shows":33,"maker_hidden":350,"reader_version":351,"card":352},"10897121","Patchwork","Real-time notifications for OSS vulnerabilities","title","Show HN: Patchwork – Real-time notifications for OSS vulnerabilities","https:\u002F\u002Fpatchworksecurity.com\u002F","patchworksecurity.com","Shamiq",1452716026,2016,122,49,293,2264,13,"notable","security_privacy","vulnerability notification","cli",[24,25,26,27],"vulnerability notifications","apt security updates","open source vulnerabilities","patch management","curious",-0.308,{"positive":31,"neutral":32,"mixed":33,"critical":34},5,16,1,10,32,{"idea":37,"pricing":39,"execution":41,"design":43,"docs":44,"privacy":45},{"positive":38,"critical":38},3,{"positive":40,"critical":33},0,{"positive":40,"critical":42},2,{"positive":40,"critical":38},{"positive":33,"critical":40},{"positive":40,"critical":33},[38,38,33,38,38,40,31,38,31,33,40,31,33,40,38,40,33,40,33,38,38,33,38,33,40,38,31,31,38,33,40,38,33,38,40,33,40,40,40,38],null,{"problem":49,"audience":56,"pricing":65,"motivation":71,"time_to_build":47,"stack":78,"openness":91,"stage":92,"team_size":93},{"value":50,"source":51,"evidence":52},"Teams learn about vulnerabilities in their installed open source packages too late to patch quickly","maker",[53],{"id":54,"by":11,"text":55},"10897123","Hi all! I’m Shamiq, ex-Matasano and co-founder of Patchwork Security. David and I built Patchwork as a devops tool to help manage Open Source Vulnerabilities. We want to drive…",{"value":57,"source":58,"evidence":59},"DevOps teams and infrastructure operators running Linux machines","inferred",[60,61],{"id":54,"by":11,"text":55},{"id":62,"by":63,"text":64},"10897534","dchanm","Hi halite! 1. We've got agents listening to incoming feeds, and did the work to ingest all the historical vulnerability data we could find. 2. We're focusing on apt installed…",{"value":66,"source":51,"evidence":67},"Usage-based billing per machine, still being worked out",[68],{"id":69,"by":11,"text":70},"10898024","Sure thing! The service pivots around machines as it's core pilar. On a more fundamental level, we consider a machine to be the set of unique packages tracked together. So for…",{"value":72,"source":51,"evidence":73},"Shrink the time between an available fix and patched infrastructure, after frustration following mailing lists during Shellshock",[74,75],{"id":54,"by":11,"text":55},{"id":76,"by":63,"text":77},"10897142","Hey, I’m David, the other co-founder of Patchwork Security. I was working on AppSec at Mozilla when Shellshock came out, then the next variant and the next. The OpSec team…",[79,87],{"value":80,"source":81,"evidence":82},"Shell script client (cleansweep)","commenter",[83,84],{"id":62,"by":63,"text":64},{"id":85,"by":63,"text":86},"10897341","Hi, we decided to make it easy to setup the tool and run it. The source code is available on GitHub…",{"value":88,"source":81,"evidence":89},"Hosted on Digital Ocean",[90],{"id":62,"by":63,"text":64},"unknown","launched","team",{"praise":95,"objections":111,"requests":143,"questions":169,"alternatives":181},[96],{"value":97,"source":81,"evidence":98},"Useful idea that commenters would like to try",[99,103,107],{"id":100,"by":101,"text":102},"10897343","chatmasta","This would be a cool service to integrate with github badges, next to test coverage and build status. e.g. \"2 UNPATCHED VULNERABILITIES\" or \"VULNERABILITY ASSESSMENT PASSED\" It…",{"id":104,"by":105,"text":106},"10897693","mmaunder","Awesome. Can we hook into this to send updates to Slack instead?",{"id":108,"by":109,"text":110},"10897577","yaworsk","Looked at the site and read the comments which made me think about the HN post yesterday about hiding vulnerabilities in plain site…",[112,131,136],{"value":113,"source":81,"evidence":114},"Using curl piped to sh for installation is a security risk",[115,119,123,127],{"id":116,"by":117,"text":118},"10897311","DoubleMalt","Sorry to be snide, but seriously? ``` curl -L https:\u002F\u002Fgit.io\u002Fcleansweep | sh ``` For a security tool? [edit] I still think it's a great idea, though [\u002Fedit]",{"id":120,"by":121,"text":122},"10897379","whorleater","Meaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.",{"id":124,"by":125,"text":126},"10900305","DyslexicAtheist","is this a joke? Piping random shit off the web straight into a shell. Sounds like worst advise. I'm sure the maintainers of this site really know their stuff when it comes to…",{"id":128,"by":129,"text":130},"10897338","SchizoDuckie","This just sounds like a bad idea to me. Why would you publish all this very sensitive machine info to a third party to retrieve that list? This would be a goldmine if they got…",{"value":132,"source":81,"evidence":133},"Sending detailed machine package data to a third party is a privacy risk and a target for attackers",[134,135],{"id":128,"by":129,"text":130},{"id":124,"by":125,"text":126},{"value":137,"source":81,"evidence":138},"Only covers apt packages so far",[139,142],{"id":140,"by":105,"text":141},"10897715","Since you're only doing apt installed packages, couldn't you just mail yourself a list of ubuntu security updates for a machine using apt and have the same result?",{"id":62,"by":63,"text":64},[144,151,162],{"value":145,"source":81,"evidence":146},"Slack or callback integrations",[147,148],{"id":104,"by":105,"text":106},{"id":149,"by":63,"text":150},"10897854","Hi mmaunder, e-mail notifications are our current callback mechanism but that will expand. The goal of our API is to allow you to consume the vulnerability data in a way that is…",{"value":152,"source":81,"evidence":153},"Integration with existing scanners like Nexpose",[154,158],{"id":155,"by":156,"text":157},"10897342","halite","Hi, we're currently looking for such tool. Here are some questions that would be helpful for us: How do you manage vulnerabilities database? Do you've a list of OSS that this…",{"id":159,"by":160,"text":161},"10897866","k33n","Launched something very similar last year and learned that integrations with existing security scanning tools was more important than building our own from scratch. We actually…",{"value":163,"source":81,"evidence":164},"CI and GitHub badge integration",[165,166],{"id":100,"by":101,"text":102},{"id":167,"by":63,"text":168},"10897526","Hi, our roadmap includes hooking into CI where your CI can ask our API Is the current project state vulnerable? yes) Here are a list of dependencies you need to update, run your…",[170,174],{"value":171,"source":81,"evidence":172},"How is the vulnerability database maintained and what does it cover",[173],{"id":155,"by":156,"text":157},{"value":175,"source":81,"evidence":176},"Where data is hosted and how volume pricing and licensing work",[177,178],{"id":155,"by":156,"text":157},{"id":179,"by":156,"text":180},"10897882","> 7. How much volume? I think what I'm more interested in understanding is how is license enforced? Our team is responsible for facilitation of pilots and this I can see useful…",[182,189],{"value":183,"source":81,"evidence":184},"Pakiti",[185],{"id":186,"by":187,"text":188},"10900036","deadfece","Pakiti (http:\u002F\u002Fpakiti.sourceforge.net\u002F) is another useful tool in this space.",{"value":190,"source":81,"evidence":191},"Sandstorm-style PGP-verified install",[192,196],{"id":193,"by":194,"text":195},"10897488","swsieber","I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1]…",{"id":197,"by":63,"text":198},"10903458","Hi, We understand your concerns with the current install mechanisms. We're working toward providing multiple options similar similar to sandstorm.io…",{"comments":31,"answered":38,"key":200},[201,202,205],{"id":69,"text":70},{"id":203,"text":204},"10897666","Halite, feel free to ping me about the volume pricing! shamiq@patchworksecurity.com",{"id":54,"text":55},{"commenters":207,"max_depth":31,"maker_replies":31,"first_comment_mins":40,"lifespan_hours":208},19,27,[210,212,213,215,217,219,220,222,224,225,226,228,229,232,235,237,239,242,243,245,250,252,255,260,263,266,269,272,276,277,279,281,282,285,288,289,291,294,296,297,299,301,304,306,308,310,312,314,316],[155,40,38,211,156,40],"project\u002Fneutral\u002Fnone",[62,40,38,211,63,40],[140,40,33,214,105,40],"project\u002Fcritical\u002Fidea",[149,40,38,216,63,40],"project\u002Fneutral\u002Fidea",[179,40,38,218,156,40],"project\u002Fneutral\u002Fpricing",[69,40,40,218,11,33],[203,40,40,221,11,33],"maker\u002Fneutral\u002Fpricing",[100,33,31,223,101,40],"project\u002Fpositive\u002Fidea",[167,33,38,216,63,40],[54,42,40,223,11,33],[76,42,31,227,63,40],"maker\u002Fpositive\u002Fidea",[159,38,33,214,160,40],[230,38,40,231,63,40],"10898148","commenter\u002Fneutral\u002Fnone",[233,38,31,234,160,40],"10898214","maker\u002Fpositive\u002Fnone",[186,236,33,214,187,40],4,[238,236,40,231,63,40],"10900049",[240,236,40,241,187,40],"10905551","other\u002Fneutral\u002Fnone",[104,31,38,216,105,40],[244,31,40,223,11,33],"10897748",[246,247,33,248,249,40],"10898228",6,"project\u002Fcritical\u002Fpricing","jondubois",[251,247,40,216,11,33],"10898308",[253,247,40,231,254,40],"10899025","akerl_",[256,257,33,258,259,40],"10897455",7,"project\u002Fcritical\u002Fexecution","TheHippo",[261,257,38,262,63,40],"10897466","maker\u002Fneutral\u002Fexecution",[264,257,38,265,63,40],"10899102","project\u002Fneutral\u002Fexecution",[116,267,33,268,117,40],8,"project\u002Fcritical\u002Fdesign",[270,267,38,271,121,40],"10897325","project\u002Fmixed\u002Fdesign",[273,267,38,274,275,40],"10897354","project\u002Fneutral\u002Fdesign","jacobscott",[120,267,33,258,121,40],[278,267,40,231,275,40],"10897421",[280,267,38,265,63,40],"10897453",[108,267,31,223,109,40],[283,267,38,284,63,40],"10899117","project\u002Fneutral\u002Fdocs",[286,267,31,287,109,40],"10901884","project\u002Fpositive\u002Fdocs",[85,267,38,274,63,40],[290,267,33,268,117,40],"10897381",[292,267,40,231,293,40],"10897541","kentonv",[295,267,38,265,63,40],"10897624",[193,267,40,241,194,40],[124,298,33,268,125,40],9,[197,298,38,300,63,40],"project\u002Fneutral\u002Fprivacy",[302,298,40,241,303,40],"10903558","dang",[128,34,33,305,129,40],"project\u002Fcritical\u002Fprivacy",[307,34,40,231,275,40],"10897388",[309,34,40,231,129,40],"10897414",[311,34,40,231,275,40],"10897430",[313,34,40,231,117,40],"10897415",[315,34,38,300,63,40],"10897404",[317,34,38,300,63,40],"10898931",[],[320,325,330,335,340,345],{"id":321,"name":322,"points":323,"category":324},"10872143","gradient.quasi.ink",448,"creative",{"id":326,"name":327,"points":328,"category":329},"10896901","awk-raycaster",350,"games",{"id":331,"name":332,"points":333,"category":334},"10890531","2Sli.de",244,"productivity",{"id":336,"name":337,"points":338,"category":339},"10869046","Charme",167,"consumer_social",{"id":341,"name":342,"points":343,"category":344},"10887071","Libconcurrent",91,"languages",{"id":346,"name":347,"points":348,"category":349},"10858327","Penny",89,"finance_crypto",false,"v2",{"id":353,"name":5,"line":6,"ai":350,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":354,"top":18,"kw":355,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":356,"url":9,"mix":357,"praise":97,"objection":113,"sub":21},10897121,-0.31,[24,25,26,27],"3313305351051030101331310355310313010003",[31,32,33,34],1794036539620]