[{"data":1,"prerenderedAt":378},["ShallowReactive",2],{"project-30515090":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":45,"post_text":47,"what":48,"said":86,"maker_in_thread":219,"shape":230,"grid":234,"attempts":341,"same_week":342,"maker_shows":221,"maker_hidden":371,"reader_version":372,"card":373},"30515090","Socket","Secure your JavaScript supply chain","title","Show HN: Socket – Secure your JavaScript supply chain","https:\u002F\u002Fsocket.dev","socket.dev","feross",1646147497,2022,133,42,457,2570,18,"notable","dev_tools","dependency security scanner","web_app",[24,25,26,27],"npm supply chain security","javascript dependency security","typosquat detection","npm package analysis","mixed",-0.22,{"positive":31,"neutral":32,"mixed":33,"critical":32},4,11,0,26,{"design":36,"idea":38,"pricing":39,"execution":40,"privacy":42,"docs":43,"performance":44},{"positive":37,"critical":31},1,{"positive":37,"critical":33},{"positive":33,"critical":33},{"positive":33,"critical":41},5,{"positive":33,"critical":37},{"positive":33,"critical":33},{"positive":33,"critical":37},[37,33,37,41,46,37,33,37,46,37,37,46,33,37,33,46,33,41,33,46,41,33,46,46,33,46,37,33,33,33,33,46,37,33,37,33,46,33,37,41],3,"Excited to share the project I've been working on for the past 7 months!\n\nWe've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem.\n\nSocket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the pack",{"problem":49,"audience":55,"pricing":64,"motivation":74,"time_to_build":78,"stack":82,"openness":83,"stage":84,"team_size":85},{"value":50,"source":51,"evidence":52},"Supply chain attacks against open source npm packages","maker",[53],{"id":54},"post",{"value":56,"source":57,"evidence":58},"JavaScript developers and teams using npm packages","inferred",[59,60],{"id":54},{"id":61,"by":62,"text":63},"30522304","armchairhacker","I would honestly completely ditch the Socket \"ratings\". React = 70 - what the hell does that mean? \"quality = 82, license = 70\" where did you get those numbers? They are…",{"value":65,"source":51,"evidence":66},"Free during beta; paid later, around $20\u002Fdeveloper\u002Fmonth for private repos; free for open source and package search",[67,71],{"id":68,"by":69,"text":70},"30522065","bretc","1. We are in beta right now! We have the data and analysis, and are working hard to make it easy to integrate project specific views into it. 2. https:\u002F\u002Fsocket.dev\u002Froadmap See…",{"id":72,"by":11,"text":73},"30522810","Concern 1) I wasn't aware of this clause. Given how widespread the use of \"npm data\" is by the community I can't imagine they want to actually enforce this. But good to know. 2…",{"value":75,"source":51,"evidence":76},"Watched supply chain attacks on open source get worse as a maintainer",[77],{"id":54},{"value":79,"source":51,"evidence":80},"7 months",[81],{"id":54},[],"unknown","beta","team",{"praise":87,"objections":110,"requests":148,"questions":181,"alternatives":203},[88,99],{"value":89,"source":90,"evidence":91},"Animated visualization is a striking way to present dense package data","commenter",[92,96],{"id":93,"by":94,"text":95},"30522247","EvRev","What is the name of the animated visualization on the front page? I thought it was static, but it is an amazing way to display such a dense and dry subject. 10\u002F10",{"id":97,"by":11,"text":98},"30522875","The visualization is a custom component that our own Mik Lysenko (of https:\u002F\u002F0fps.net fame) made. I agree it's a super useful way to visualize package data.",{"value":100,"source":90,"evidence":101},"Useful typosquat detection and package analysis idea",[102,106],{"id":103,"by":104,"text":105},"30522171","extheat","As with all end products where you need safety, all the dependencies (3rd party or not) you use should be treated as your own code. All the dependencies should be committed to…",{"id":107,"by":108,"text":109},"30521839","d4mi3n","I work as a security engineer for a benefits provider. This stuff has been top of mind for me, the rest of my team, and our CSIO. I love the direction you're going with this.…",[111,119,130,141],{"value":112,"source":90,"evidence":113},"Numeric package scores look made-up and unclear",[114,115],{"id":61,"by":62,"text":63},{"id":116,"by":117,"text":118},"30525994","notafraudster","SSL Labs works because letter grades, like most low granularity ordinal measures, clearly read as qualitative and approximate rather than having false precision. No one is saying…",{"value":120,"source":90,"evidence":121},"MIT license flagged as non-FSF approved, lowering scores",[122,126],{"id":123,"by":124,"text":125},"30522214","syntheticcdo","Why does Socket flag npm packages with \"MIT\" in the license field as non-FSF approved, such as in lodash [1]. It appears the FSF seems to prefer to call the MIT license \"Expat\"…",{"id":127,"by":128,"text":129},"30524719","bjornstar","It looks like having an MIT license gives you a score of 70. It seems wrong that the most commonly used license on the platform is poor and it makes it hard to trust your scoring…",{"value":131,"source":90,"evidence":132},"Not open source; GitHub app source not public",[133,137],{"id":134,"by":135,"text":136},"30520709","niutech","> Socket is built by a team of open source maintainers with over 1 billion monthly downloads. Everyone on the Socket team is an open source maintainer. So is Socket.dev open…",{"id":138,"by":139,"text":140},"30523998","pabs3","Is Socket open source? Can I run it locally from the command-line?",{"value":142,"source":90,"evidence":143},"Typosquat warnings are overly aggressive",[144],{"id":145,"by":146,"text":147},"30523302","fenomas","Bug report: the typo-squatting check seems overly aggressive. I checked a module with a name like \"foo-engine\", and Socket shows a warning that this may be a typo for \"engine.io\".",[149,154,164,174],{"value":150,"source":90,"evidence":151},"Open source the product or allow running it locally",[152,153],{"id":134,"by":135,"text":136},{"id":138,"by":139,"text":140},{"value":155,"source":90,"evidence":156},"Use an auditable GitHub Action that sends only package files",[157,161],{"id":158,"by":159,"text":160},"30522293","teaearlgraycold","I think it would be awesome if Socket could be used through an auditable GitHub Action where developers can manually send over just their package*.json files.",{"id":162,"by":11,"text":163},"30522885","We agree. It's on our roadmap.",{"value":165,"source":90,"evidence":166},"Fix unclear license detection for lowercase license files",[167,171],{"id":168,"by":169,"text":170},"30525533","austincheney","Maybe a minor defect. I see many packages that receive the error unclear license because the bot cannot find the file LICENSE in the package when the file exists with lowercase…",{"id":172,"by":11,"text":173},"30530252","Thanks, we’ll fix that.",{"value":175,"source":90,"evidence":176},"Explain how the product works with examples",[177],{"id":178,"by":179,"text":180},"30521788","plasma","Hey team, great to see someone tackle this project, and the idea to scan for new potential issues based on the code that changed is cool Initial impressions when visiting the…",[182,189,196],{"value":183,"source":90,"evidence":184},"Where is the analysis run and does it run untrusted code",[185],{"id":186,"by":187,"text":188},"30522273","substructure","Congrats on the launch. There is both a large need for improvements in npm supply chain security and a market willing to pay for them. Concerns: 1) npm Open-Source Terms…",{"value":190,"source":90,"evidence":191},"Is there a human review of package diffs",[192],{"id":193,"by":194,"text":195},"30527193","nicoburns","Is there any plan to introduce human review into the process? I imagine a company that had a human review a diff of each package release prior to approval could make a ton of…",{"value":197,"source":90,"evidence":198},"Is the name confusing given socket.io",[199],{"id":200,"by":201,"text":202},"30522314","xingped","Great idea! As an aside, I can't help but immediately comment on the name, which kinda seems like a semi-poor choice given that socket.io is a very popular javascript websocket…",[204,208,213],{"value":205,"source":90,"evidence":206},"Snyk, JFrog Xray, Sonatype, WhiteSource",[207],{"id":186,"by":187,"text":188},{"value":209,"source":90,"evidence":210},"Deno permissions model",[211,212],{"id":107,"by":108,"text":109},{"id":68,"by":69,"text":70},{"value":214,"source":90,"evidence":215},"Lighthouse and SSL Labs style scoring",[216],{"id":217,"by":11,"text":218},"30522946","I think this is a valid criticism of using scores to summarize a complex subject, and I agree that we can definitely do a better job on this. What's interesting is that…",{"comments":220,"answered":221,"key":222},12,6,[223,224,227],{"id":217,"text":218},{"id":225,"text":226},"30522605","Non-FSF approved licenses as just flagged as informational – they shouldn't detract from the score. But perhaps that bit of info just isn't that interesting to most people. If…",{"id":228,"text":229},"30521574","We want to open source as much of Socket as we can. However, our first priority is to build a sustainable company. This whole party ends with us losing our jobs if we fail to…",{"commenters":231,"max_depth":221,"maker_replies":220,"first_comment_mins":232,"lifespan_hours":233},30,415,27,[235,237,239,240,242,244,247,249,250,253,254,257,259,261,265,268,270,271,273,274,276,277,282,287,291,294,297,299,300,302,303,307,312,314,316,318,322,325,329,331,335,337],[61,33,37,236,62,33],"project\u002Fcritical\u002Fdesign",[217,33,33,238,11,37],"project\u002Fneutral\u002Fdesign",[116,33,37,236,117,33],[107,37,41,241,108,33],"project\u002Fpositive\u002Fidea",[68,37,46,243,69,33],"project\u002Fneutral\u002Fpricing",[123,245,37,246,124,33],2,"project\u002Fcritical\u002Fexecution",[225,245,33,248,11,37],"project\u002Fneutral\u002Fexecution",[127,245,37,246,128,33],[251,245,46,248,252,33],"30523255","Uehreka",[200,46,37,236,201,33],[255,31,37,246,256,33],"30527223","onion2k",[134,41,46,258,135,33],"project\u002Fneutral\u002Fnone",[228,41,33,260,11,37],"maker\u002Fneutral\u002Fnone",[262,41,37,263,264,33],"30521960","project\u002Fcritical\u002Fprivacy","encryptluks2",[266,41,33,267,11,37],"30522057","project\u002Fpositive\u002Fprivacy",[158,41,46,269,159,33],"project\u002Fneutral\u002Fprivacy",[162,41,33,267,11,37],[93,221,41,272,94,33],"project\u002Fpositive\u002Fdesign",[97,221,33,272,11,37],[186,275,46,258,187,33],7,[72,275,33,243,11,37],[278,279,41,280,281,33],"30522050",8,"maker\u002Fpositive\u002Fnone","kaycebasques",[283,284,33,285,286,33],"30523030",9,"other\u002Fneutral\u002Fidea","hn_throwaway_99",[288,284,46,289,290,33],"30524127","project\u002Fneutral\u002Fidea","tehlike",[178,292,46,293,179,33],10,"project\u002Fneutral\u002Fdocs",[295,292,33,296,11,37],"30522083","maker\u002Fneutral\u002Fdocs",[298,292,46,293,69,33],"30522153",[168,32,37,246,169,33],[172,32,33,301,11,37],"maker\u002Fpositive\u002Fexecution",[103,220,33,285,104,33],[304,220,33,305,306,33],"30523902","other\u002Fcritical\u002Fidea","joebob42",[308,309,33,310,311,33],"30530558",13,"other\u002Fpositive\u002Fnone","brianzelip",[193,313,46,289,194,33],14,[145,315,37,246,146,33],15,[317,315,33,301,11,37],"30523915",[319,320,37,236,321,33],"30522773",16,"lavingiasa",[323,320,33,324,11,37],"30522849","maker\u002Fpositive\u002Fdesign",[326,327,46,293,328,33],"30522666",17,"theogravity",[330,327,33,293,11,37],"30522882",[332,18,37,333,334,33],"30526045","project\u002Fcritical\u002Fperformance","jsmith99",[138,336,46,258,139,33],19,[338,339,41,280,340,33],"30522824",20,"diegorbaquero",[],[343,348,353,358,362,367],{"id":344,"name":345,"points":346,"category":347},"30517626","Almost Pong",1135,"games",{"id":349,"name":350,"points":351,"category":352},"30503197","booqsi.com",478,"consumer_social",{"id":354,"name":355,"points":356,"category":357},"30529262","Huemint",335,"creative",{"id":359,"name":360,"points":361,"category":352},"30489003","Messages for Macintosh",211,{"id":363,"name":364,"points":365,"category":366},"30457900","Programming Time",203,"learning_science",{"id":368,"name":369,"points":370,"category":20},"30531621","WAPM",186,false,"v2",{"id":374,"name":5,"line":6,"ai":371,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":375,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":376,"url":9,"mix":377,"praise":89,"objection":112,"sub":21},30515090,[24,25,26,27],"1015310131130103050350330310000310103015",[31,32,33,32],1794036617550]