[{"data":1,"prerenderedAt":190},["ShallowReactive",2],{"project-12804196":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":32,"aspects":33,"strip":41,"post_text":43,"what":44,"said":54,"maker_in_thread":108,"shape":117,"grid":120,"attempts":153,"same_week":154,"maker_shows":31,"maker_hidden":183,"reader_version":184,"card":185},"12804196","safety-db","A curated list of insecure Python packages","title","Show HN: A curated list of insecure Python packages","https:\u002F\u002Fgithub.com\u002Fpyupio\u002Fsafety-db","github.com","jayfk",1477567340,2016,94,12,403,2264,18,"notable","security_privacy","vulnerability database","other",[24,25,26,27],"python security","vulnerable packages","cve database","dependency security","debated",0,{"positive":31,"neutral":31,"mixed":29,"critical":31},3,9,{"idea":34,"docs":36,"execution":38,"design":39,"performance":40},{"positive":35,"critical":29},2,{"positive":29,"critical":37},1,{"positive":29,"critical":37},{"positive":37,"critical":29},{"positive":29,"critical":37},[42,31,37,31,31,29,37,42,29,42,37,29],5,null,{"problem":43,"audience":43,"pricing":43,"motivation":43,"time_to_build":43,"stack":45,"openness":53,"stage":53,"team_size":53},[46],{"value":47,"source":48,"evidence":49},"JavaScript (jQuery-flavored, loads DB via ajax)","maker",[50],{"id":51,"by":11,"text":52},"12810434","I wouldn't call it stack, really. It's just a little bit jQuery flavored JavaScript that loads the DB via ajax and adds all entries to the DOM. Under 30 LOC:…","unknown",{"praise":55,"objections":68,"requests":90,"questions":98,"alternatives":103},[56],{"value":57,"source":58,"evidence":59},"Useful, great service for Python security","commenter",[60,64],{"id":61,"by":62,"text":63},"12807036","vinayan3","Really cool stuff. I love it! Thank you for making this. A side note anyone using Django should keep up to date. If you see the list of versions and the related packages which…",{"id":65,"by":66,"text":67},"12810113","daveguy","This is awesome. What a great service! Just curious, what stack did you use for the human browsable site and database? I am looking for a quick data reporting stack like this…",[69,76,83],{"value":70,"source":58,"evidence":71},"Unclear standard for what counts as insecure",[72],{"id":73,"by":74,"text":75},"12808283","pekk","What standard are you applying to distinguish \"insecure\" from \"secure\"?",{"value":77,"source":58,"evidence":78},"Hard to know the version where a CVE was introduced",[79],{"id":80,"by":81,"text":82},"12805360","svisser","This can detect when a CVE vulnerability is fixed but how would you know the version number at which it was introduced?",{"value":84,"source":58,"evidence":85},"Human-browsable site stops loading data partway",[86],{"id":87,"by":88,"text":89},"12809618","Twirrim","It doesn't seem to be loading all the data when you browse the \"human\" site. Stops at ftw.mail (if there's a way to go on to the next page, it isn't obvious)",[91],{"value":92,"source":58,"evidence":93},"Connect with OWASP Dependency Check project",[94],{"id":95,"by":96,"text":97},"12806575","eganist","Can you get in touch with the guys at OWASP Dependency Check? It's one of their more mature projects, and it essentially does a lot of what you described and then some, including…",[99],{"value":100,"source":58,"evidence":101},"What stack is used for the browsable site and database?",[102],{"id":65,"by":66,"text":67},[104],{"value":105,"source":58,"evidence":106},"OWASP Dependency Check",[107],{"id":95,"by":96,"text":97},{"comments":31,"answered":31,"key":109},[110,113,114],{"id":111,"text":112},"12805417","Most CVEs have a pretty good descriptions. For example CVE-2016-6186[1]: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in…",{"id":51,"text":52},{"id":115,"text":116},"12805176","The site is loading the data directly from the repo. Maybe HN has triggered some abuse mechanism. Edit: Switched to S3 to load the data.",{"commenters":118,"max_depth":35,"maker_replies":31,"first_comment_mins":119,"lifespan_hours":118},10,158,[121,123,127,131,133,135,136,138,141,143,146,151],[95,29,42,122,96,29],"maker\u002Fpositive\u002Fidea",[124,37,31,125,126,29],"12805205","project\u002Fneutral\u002Fnone","jacknews",[128,35,37,129,130,29],"12807755","project\u002Fcritical\u002Fdocs","SubiculumCode",[73,31,31,132,74,29],"project\u002Fneutral\u002Fidea",[80,134,31,132,81,29],4,[111,134,29,132,11,37],[87,42,37,137,88,29],"project\u002Fcritical\u002Fexecution",[65,139,42,140,66,29],6,"project\u002Fpositive\u002Fdesign",[51,139,29,142,11,37],"maker\u002Fneutral\u002Fexecution",[61,144,42,145,62,29],7,"project\u002Fpositive\u002Fidea",[147,148,37,149,150,29],"12805140",8,"project\u002Fcritical\u002Fperformance","x1798DE",[115,148,29,152,11,37],"project\u002Fneutral\u002Fperformance",[],[155,159,164,169,174,178],{"id":156,"name":157,"points":158,"category":20},"12834327","sudo-touchid",347,{"id":160,"name":161,"points":162,"category":163},"12843466","My first web app",297,"web_saas",{"id":165,"name":166,"points":167,"category":168},"12803860","Zone Messenger",194,"consumer_social",{"id":170,"name":171,"points":172,"category":173},"12838152","Fast Style Transfer",184,"ai",{"id":175,"name":176,"points":177,"category":20},"12802785","Android 'root' phones via dirtyc0w exploit",143,{"id":179,"name":180,"points":181,"category":182},"12842797","KQ",116,"dev_tools",false,"v2",{"id":186,"name":5,"line":6,"ai":183,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":187,"maker":11,"domain":10,"tier":19,"attempts":29,"strip":188,"url":9,"mix":189,"praise":57,"objection":70,"sub":21},12804196,[24,25,26,27],"531330150510",[31,31,29,31],1794036548923]