AppCanary
Infrastructure
vulnerability monitoring
SHOW HN2015
108points
59comments
#225of 2,565 in 2015
Top 9%of 2015 by points
How HN took it
MixedNo clear lean
5 positive, 13 neutral or asking, 0 mixed, 16 critical, out of 34 comments about the project. Thread score -0.34.
Idea: 4 for, 3 againstPrivacy: 0 for, 7 againstExecution: 1 for, 3 againstPricing: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful idea that addresses a real pain of tracking CVEs
From 3 comments
I had that exact idea a while ago and filed it into my "ideas that might be fun and might be successful" list. Time to cross it off. Good luck with this, it's a great idea!
anc84 on HNThis looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have…
joergsauer on HNCorrect, but if this will reduce the 0-day / 1-day time then it's very useful if your server does anything important. The difference between responding to Shellshock in 15 mins…
HappyTypist on HN
Agent is open source on GitHub
From 1 comment
It's very small and written in golang and up on github https://github.com/appcanary/agent/ We understand how some people might have problems / have plans to improve upon it -…
phillmv on HN
Objections
Sending full file contents and Gemfile credentials raises privacy concerns
From 2 comments
Apologies if I'm misunderstanding as I only skimmed the source code but.. Why are you sending the full file contents from the agent to the client?…
wompa164 on HN"You're not going to be storing any sensitive information in your Gemfile.locks" That's not accurate. When using private gems hosted on github one of the common approaches is to…
brightball on HN
Anonymous company with little visible business information raises trust concerns
From 1 comment
"Hey Hacker News! Try out our pilot program." Just sign here. It's another wannabe startup that asks people to sign up before disclosing terms, or, in this case, anything at all.…
Animats on HN
Pricing per server seems high, especially for VMs and containers
From 3 comments
You may want to rethink the pricing. I have several server variants that I effectively clone in different datacenters across my deployment. Since the base images are static I…
jaryd on HNAny way of cheaper pricing for VMs? We have a bunch of VMs that run on not-our-host-node, so it would be effectively $9 for a 256MB RAM instance.
pki on HN$9/server? lol.
nickphx on HN
Firewalled servers cannot easily send package lists
From 1 comment
I like the idea but most of the servers we manage have out going firewalls to block them from talking to the internet. We produce installed package lists during deployment (as…
iang on HN
CVE matching is unreliable and hard to automate
From 2 comments
Unless they're watching updates from repos, it'd be very hard to automate this. CVEs are very far from reliable.
ryanlol on HNIf you can solve this people will throw boatloads of money at you. Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to…
feld on HN
Requests
Docker and container support
From 3 comments
> $9 per server How does this affect containers?
ihsw on HN@phillmv - +1 for the Docker+supervisord version ! Would strongly recommend an "in-container" version, so that I can bake your agent into my Docker VMs. Remember that if I run my…
sandGorgon on HNi was wondering if there's an interactive version of this I could run in CI (e.g. test-kitchen), so that I can fail CI when the results of a fresh CM build is vulnerable.
justizin on HN
Python, Java and Node dependency support
From 2 comments
+1 for Python. You're probably aware of a company called Sonatype that does something like this during the dev process. Their business is growing fast. As far as I know nobody is…
efriese on HNOh yeah I know, I think there's value in what you're trying to do. I would pay 9/m if it also covered application dependencies. I was just curious how it works. What's the time…
efriese on HN
Windows server support
From 1 comment
At my day job I am stuck on a Windows IIS stack. Any plans for windows servers? I'd honestly prioritize this after application dependencies checking for Java/Node etc, but just…
timboslice on HN
Detection of hand-compiled binaries
From 1 comment
This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have…
joergsauer on HN
SSL for transferring files
From 1 comment
I agree with you there but to this point at least, I haven't seen another good way to handle this with something like Heroku. It does show in the Gemfile.lock though (just…
brightball on HN
Questions
How does the agent work and does it call home to a third party
From 1 comment
How does this work? Do I need to run your software on my servers? A software calling home to some third party seems to be a problem for many use cases.
dewey on HN
How it determines whether software is vulnerable
From 1 comment
How can you figure out whether a software is vulnerable? Parsing public CVEs and matching with version number?
m00dy on HN
How it differs from distro security teams and pkg audit
From 2 comments
And that's why there are Linux distributions with security teams doing that work for everybody. How is this service different?
federico3 on HNWhat advantage do I gain from this over periodically running various distro tools that compile CVEs and security advisories into a flat file database and search on top of that,…
vezzy-fnord on HN
Alternatives named
Sonatype
From 1 comment
+1 for Python. You're probably aware of a company called Sonatype that does something like this during the dev process. Their business is growing fast. As far as I know nobody is…
efriese on HN
Nessus and Qualys agent scanners
From 1 comment
This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have…
joergsauer on HN
debsecan
From 1 comment
Currently, there is no straightforward way of checking Ubuntu package versions against CVEs. Debian provides this through debsecan[1], but this tool is pretty much broken on…
joergsauer on HN
pkg audit and glsa-check
From 1 comment
What advantage do I gain from this over periodically running various distro tools that compile CVEs and security advisories into a flat file database and search on top of that,…
vezzy-fnord on HN
unattended-upgrades
From 1 comment
1. They all do a great job! But there's this last mile problem with managing the information they do put out. If you can handle the downtime, unattended-upgrades will work just…
phillmv on HN