[{"data":1,"prerenderedAt":440},["ShallowReactive",2],{"project-9935458":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":44,"post_text":45,"what":46,"said":97,"maker_in_thread":263,"shape":271,"grid":275,"attempts":403,"same_week":404,"maker_shows":302,"maker_hidden":432,"reader_version":433,"card":434},"9935458","AppCanary","Keep vulnerable software off your servers","title","Show HN: AppCanary – Keep vulnerable software off your servers","https:\u002F\u002Fappcanary.com\u002Fhey_hn","appcanary.com","phillmv",1437657271,2015,108,59,225,2565,9,"notable","infrastructure","vulnerability monitoring","cli",[21,24,25,26],"cve alerts","server security","patch management","mixed",-0.337,{"positive":30,"neutral":31,"mixed":32,"critical":33},5,13,0,16,34,{"pricing":36,"execution":38,"idea":40,"privacy":42},{"positive":32,"critical":37},3,{"positive":39,"critical":37},1,{"positive":41,"critical":37},4,{"positive":32,"critical":43},7,[39,32,39,32,39,37,39,39,37,32,37,32,39,37,32,37,30,39,37,30,39,37,30,30,39,37,39,32,39,39,37,37,32,37,39,39,32,32,32,39],null,{"problem":47,"audience":57,"pricing":62,"motivation":74,"time_to_build":45,"stack":81,"openness":94,"stage":95,"team_size":96},{"value":48,"source":49,"evidence":50},"Knowing which installed software on servers has known vulnerabilities and needs updating","maker",[51,54],{"id":52,"by":11,"text":53},"9935464","Hey everyone! appCanary monitors the software on your servers and notifies you when you have to take action. In a previous life, we spent a lot of time worrying about what needs…",{"id":55,"by":11,"text":56},"9935791","There's a stunning amount of elbow grease involved in that. If you're a random company, you have an engineer sitting around whose job involves reading a dozen mailing lists - and…",{"value":58,"source":59,"evidence":60},"Operators of server fleets and companies with engineers tracking security advisories","inferred",[61],{"id":55,"by":11,"text":56},{"value":63,"source":49,"evidence":64},"$9 per server; first server free; nonprofit tier planned; pricing model still being worked out",[65,68,71],{"id":66,"by":11,"text":67},"9935855",">I would probably feel differently about the pricing if it were tiered levels (e.g.: 1-50 servers: $x\u002Fmo, 50-250 servers: $y\u002Fmo, 250+ servers: $z\u002Fmo). Ya, that's fair and a good…",{"id":69,"by":11,"text":70},"9937686","We're still getting started, so - give it a spin, and we won't charge you until it's worth your while.",{"id":72,"by":11,"text":73},"9935831","Well, fortunately, it does! We currently support Ruby, and in the next three months we'll have Javaland and Python and Node. Right now most of our data is oriented around patch…",{"value":75,"source":49,"evidence":76},"Former security consultants saw the effort of tracking updates and built this to save others that work",[77,78],{"id":52,"by":11,"text":53},{"id":79,"by":11,"text":80},"9937009","This is a problem everyone in the security space faces. We used to work as security consultants, so we're more experienced than most, and we're working hard to be transparent and…",[82,88],{"value":83,"source":49,"evidence":84},"Go (agent)",[85],{"id":86,"by":11,"text":87},"9935762","It's very small and written in golang and up on github https:\u002F\u002Fgithub.com\u002Fappcanary\u002Fagent\u002F We understand how some people might have problems \u002F have plans to improve upon it -…",{"value":89,"source":49,"evidence":90},"Ruby vulnerability support via Ruby Advisory Database",[91],{"id":92,"by":11,"text":93},"9936134","1. They all do a great job! But there's this last mile problem with managing the information they do put out. If you can handle the downtime, unattended-upgrades will work just…","unknown","beta","team",{"praise":98,"objections":119,"requests":171,"questions":214,"alternatives":240},[99,115],{"value":100,"source":101,"evidence":102},"Useful idea that addresses a real pain of tracking CVEs","commenter",[103,107,111],{"id":104,"by":105,"text":106},"9935986","anc84","I had that exact idea a while ago and filed it into my \"ideas that might be fun and might be successful\" list. Time to cross it off. Good luck with this, it's a great idea!",{"id":108,"by":109,"text":110},"9935939","joergsauer","This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have…",{"id":112,"by":113,"text":114},"9936197","HappyTypist","Correct, but if this will reduce the 0-day \u002F 1-day time then it's very useful if your server does anything important. The difference between responding to Shellshock in 15 mins…",{"value":116,"source":49,"evidence":117},"Agent is open source on GitHub",[118],{"id":86,"by":11,"text":87},[120,131,138,153,160],{"value":121,"source":101,"evidence":122},"Sending full file contents and Gemfile credentials raises privacy concerns",[123,127],{"id":124,"by":125,"text":126},"9937010","wompa164","Apologies if I'm misunderstanding as I only skimmed the source code but.. Why are you sending the full file contents from the agent to the client?…",{"id":128,"by":129,"text":130},"9937231","brightball","\"You're not going to be storing any sensitive information in your Gemfile.locks\" That's not accurate. When using private gems hosted on github one of the common approaches is to…",{"value":132,"source":101,"evidence":133},"Anonymous company with little visible business information raises trust concerns",[134],{"id":135,"by":136,"text":137},"9936894","Animats","\"Hey Hacker News! Try out our pilot program.\" Just sign here. It's another wannabe startup that asks people to sign up before disclosing terms, or, in this case, anything at all.…",{"value":139,"source":101,"evidence":140},"Pricing per server seems high, especially for VMs and containers",[141,145,149],{"id":142,"by":143,"text":144},"9935833","jaryd","You may want to rethink the pricing. I have several server variants that I effectively clone in different datacenters across my deployment. Since the base images are static I…",{"id":146,"by":147,"text":148},"9937593","pki","Any way of cheaper pricing for VMs? We have a bunch of VMs that run on not-our-host-node, so it would be effectively $9 for a 256MB RAM instance.",{"id":150,"by":151,"text":152},"9935747","nickphx","$9\u002Fserver? lol.",{"value":154,"source":101,"evidence":155},"Firewalled servers cannot easily send package lists",[156],{"id":157,"by":158,"text":159},"9940440","iang","I like the idea but most of the servers we manage have out going firewalls to block them from talking to the internet. We produce installed package lists during deployment (as…",{"value":161,"source":101,"evidence":162},"CVE matching is unreliable and hard to automate",[163,167],{"id":164,"by":165,"text":166},"9935757","ryanlol","Unless they're watching updates from repos, it'd be very hard to automate this. CVEs are very far from reliable.",{"id":168,"by":169,"text":170},"9937573","feld","If you can solve this people will throw boatloads of money at you. Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to…",[172,187,197,204,208],{"value":173,"source":101,"evidence":174},"Docker and container support",[175,179,183],{"id":176,"by":177,"text":178},"9936115","ihsw","> $9 per server How does this affect containers?",{"id":180,"by":181,"text":182},"9936569","sandGorgon","@phillmv - +1 for the Docker+supervisord version ! Would strongly recommend an \"in-container\" version, so that I can bake your agent into my Docker VMs. Remember that if I run my…",{"id":184,"by":185,"text":186},"9937861","justizin","i was wondering if there's an interactive version of this I could run in CI (e.g. test-kitchen), so that I can fail CI when the results of a fresh CM build is vulnerable.",{"value":188,"source":101,"evidence":189},"Python, Java and Node dependency support",[190,194],{"id":191,"by":192,"text":193},"9935868","efriese","+1 for Python. You're probably aware of a company called Sonatype that does something like this during the dev process. Their business is growing fast. As far as I know nobody is…",{"id":195,"by":192,"text":196},"9935808","Oh yeah I know, I think there's value in what you're trying to do. I would pay 9\u002Fm if it also covered application dependencies. I was just curious how it works. What's the time…",{"value":198,"source":101,"evidence":199},"Windows server support",[200],{"id":201,"by":202,"text":203},"9935972","timboslice","At my day job I am stuck on a Windows IIS stack. Any plans for windows servers? I'd honestly prioritize this after application dependencies checking for Java\u002FNode etc, but just…",{"value":205,"source":101,"evidence":206},"Detection of hand-compiled binaries",[207],{"id":108,"by":109,"text":110},{"value":209,"source":101,"evidence":210},"SSL for transferring files",[211],{"id":212,"by":129,"text":213},"9937464","I agree with you there but to this point at least, I haven't seen another good way to handle this with something like Heroku. It does show in the Gemfile.lock though (just…",[215,222,229],{"value":216,"source":101,"evidence":217},"How does the agent work and does it call home to a third party",[218],{"id":219,"by":220,"text":221},"9935735","dewey","How does this work? Do I need to run your software on my servers? A software calling home to some third party seems to be a problem for many use cases.",{"value":223,"source":101,"evidence":224},"How it determines whether software is vulnerable",[225],{"id":226,"by":227,"text":228},"9935748","m00dy","How can you figure out whether a software is vulnerable? Parsing public CVEs and matching with version number?",{"value":230,"source":101,"evidence":231},"How it differs from distro security teams and pkg audit",[232,236],{"id":233,"by":234,"text":235},"9936090","federico3","And that's why there are Linux distributions with security teams doing that work for everybody. How is this service different?",{"id":237,"by":238,"text":239},"9935945","vezzy-fnord","What advantage do I gain from this over periodically running various distro tools that compile CVEs and security advisories into a flat file database and search on top of that,…",[241,245,249,255,259],{"value":242,"source":101,"evidence":243},"Sonatype",[244],{"id":191,"by":192,"text":193},{"value":246,"source":101,"evidence":247},"Nessus and Qualys agent scanners",[248],{"id":108,"by":109,"text":110},{"value":250,"source":101,"evidence":251},"debsecan",[252],{"id":253,"by":109,"text":254},"9936169","Currently, there is no straightforward way of checking Ubuntu package versions against CVEs. Debian provides this through debsecan[1], but this tool is pretty much broken on…",{"value":256,"source":101,"evidence":257},"pkg audit and glsa-check",[258],{"id":237,"by":238,"text":239},{"value":260,"source":49,"evidence":261},"unattended-upgrades",[262],{"id":92,"by":11,"text":93},{"comments":33,"answered":264,"key":265},12,[266,267,268],{"id":66,"text":67},{"id":52,"text":53},{"id":269,"text":270},"9935996",">And are you planning to add detection for binaries that live outside of the distro package manager? It's on the roadmap! Others have mentioned that before. First we need to get…",{"commenters":272,"max_depth":273,"maker_replies":33,"first_comment_mins":39,"lifespan_hours":274},35,6,22,[276,278,280,283,286,288,290,292,294,295,296,298,301,304,306,308,312,315,317,319,322,323,324,325,327,328,329,330,331,334,337,341,342,343,347,348,350,353,355,356,358,360,362,364,366,368,369,373,374,377,380,382,385,389,393,395,399,401],[142,32,39,277,143,32],"project\u002Fcritical\u002Fpricing",[66,32,32,279,11,39],"maker\u002Fneutral\u002Fpricing",[281,32,39,277,282,32],"9937187","pdpi",[284,32,32,285,185,32],"9937030","commenter\u002Fneutral\u002Fpricing",[52,39,32,287,11,39],"maker\u002Fneutral\u002Fidea",[226,39,37,289,227,32],"maker\u002Fneutral\u002Fexecution",[164,39,39,291,165,32],"project\u002Fcritical\u002Fexecution",[108,39,37,293,109,32],"project\u002Fneutral\u002Fexecution",[269,39,32,289,11,39],[168,39,39,291,169,32],[237,39,39,297,238,32],"project\u002Fcritical\u002Fidea",[299,39,32,300,11,39],"9936015","maker\u002Fpositive\u002Fidea",[146,302,37,303,147,32],2,"project\u002Fneutral\u002Fpricing",[69,302,32,305,11,39],"maker\u002Fpositive\u002Fpricing",[201,37,37,307,202,32],"project\u002Fneutral\u002Fnone",[309,37,32,310,311,32],"9936965","other\u002Fneutral\u002Fnone","j_s",[313,37,32,310,314,32],"9937012","stephengillie",[219,41,39,316,220,32],"project\u002Fcritical\u002Fprivacy",[86,41,32,318,11,39],"maker\u002Fneutral\u002Fprivacy",[320,30,37,321,192,32],"9935724","project\u002Fneutral\u002Fidea",[55,30,32,300,11,39],[195,30,37,321,192,32],[72,30,32,289,11,39],[191,30,30,326,192,32],"project\u002Fpositive\u002Fidea",[233,30,39,297,234,32],[92,30,32,287,11,39],[253,30,37,293,109,32],[112,30,30,326,113,32],[332,30,30,326,333,32],"9935921","lazyant",[335,273,39,316,336,32],"9936838","ZeWaren",[338,273,37,339,340,32],"9936872","project\u002Fneutral\u002Fprivacy","hellbanner",[79,273,32,318,11,39],[104,43,30,326,105,32],[344,345,30,346,185,32],"9939023",8,"project\u002Fpositive\u002Fexecution",[124,18,39,316,125,32],[349,18,32,318,11,39],"9937036",[351,18,37,293,352,32],"9937074","apazzolini",[354,18,32,289,11,39],"9937123",[128,18,39,316,129,32],[357,18,32,318,11,39],"9937257",[212,18,39,359,129,32],"maker\u002Fcritical\u002Fprivacy",[361,18,32,318,11,39],"9937555",[157,363,39,291,158,32],10,[176,365,37,303,177,32],11,[367,365,32,289,11,39],"9936140",[180,365,37,293,181,32],[370,365,32,371,372,32],"9936834","commenter\u002Fneutral\u002Fexecution","shazow",[184,365,37,293,185,32],[375,264,37,293,376,32],"9941144","altharaz",[378,31,39,297,379,32],"9939086","kylequest",[135,381,39,316,136,32],14,[383,381,32,384,11,39],"9936989","maker\u002Fneutral\u002Fnone",[386,381,32,387,388,32],"9937244","commenter\u002Fpositive\u002Fnone","c2h5oh",[390,381,32,391,392,32],"9937509","commenter\u002Fneutral\u002Fnone","ontoillogical",[394,381,32,387,388,32],"9937936",[396,381,32,397,398,32],"9937986","commenter\u002Fcritical\u002Fnone","NateLawson",[400,381,39,316,136,32],"9940246",[150,402,39,277,151,32],15,[],[405,410,415,420,424,428],{"id":406,"name":407,"points":408,"category":409},"9962185","Spot the Drowning Child",1215,"learning_science",{"id":411,"name":412,"points":413,"category":414},"9944746","Showgoers",281,"consumer_social",{"id":416,"name":417,"points":418,"category":419},"9956415","Meshtag",270,"dev_tools",{"id":421,"name":422,"points":423,"category":409},"9963714","Flexbox.io",236,{"id":425,"name":426,"points":427,"category":20},"9969171","File.io",155,{"id":429,"name":430,"points":431,"category":409},"9969345","parametricity.com",149,false,"v2",{"id":435,"name":5,"line":6,"ai":432,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":436,"top":18,"kw":437,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":438,"url":9,"mix":439,"praise":100,"objection":121,"sub":21},9935458,-0.34,[21,24,25,26],"1010131130301303513513551310113303110001",[30,31,32,33],1794036533645]