jsulinski

7 ms·

1.
Show HN: GitHub Action for Salus, an open source app security scanner(federacy.com)
3 points by jsulinski 6y ago|0 comments
2.
Security Headers – The Whys and Hows (with library/framework charts)(blog.federacy.com)
6 points by jsulinski 7y ago|0 comments
3.
by jsulinski 8y ago
We definitely don't want to discourage you from contributing. It also doesn't necessarily have to be money, you could stake reputation you've previously earned. The dupes problem is super important, in my opinion, because it&
4.
by jsulinski 8y ago
I agree with you, they aren't very informative. We're big fans of BugCrowd's work in this area, and intend to adopt their VRT, though we're still considering how to make P1/P2/P3/P4 more clear/descrip
5.
by jsulinski 8y ago
Hah, yeah, this stuff is hard and acquisitions make it even harder. I think you started a month after I left. We built a lot at MoPub in a short period of time and when we were acquired I had a mile-long backlog. The Twitter security team w
6.
Launch HN: Federacy (YC S18) – bug bounties for startups
71 points by jsulinski 8y ago|23 comments
7.
by jsulinski 9y ago
Draft | Operations/Backend/SRE/DevOps Engineers | New York, NY | Onsite | Full-time | Salary: $135-$170k Do you... Enjoy building scalable, distributed systems with automation and modern tools? Love telemetry and monitoring a
8.
by jsulinski 9y ago
How does this compare to say, Aerospike, or Honeycomb.io?
9.
by jsulinski 10y ago
I don't fully understand the question. clair does static analysis vuls uses a package manager and changelogs
10.
by jsulinski 10y ago
The conversion of package version numbers to vulnerabilities is perilous and incredibly complicated. That's one of the most significant challenges that we want to solve, which is even more pressing considering how badly the CVE ecosyst
11.
by jsulinski 10y ago
That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD. There are certainly flaws in this approach; it's one of the reasons we in
12.
by jsulinski 10y ago
This is a very well-written explanation. The only exception is when people have access to the underlying container, willing or not. Then these vulnerable binaries can lead to a vulnerable container. This is also why the subjectivity in CVE
13.
by jsulinski 10y ago
Thank you. I'll definitely be reaching out.
14.
by jsulinski 10y ago
Good point. What I meant was comfort moving away from a major distribution. NixOS is another distro that looks interesting.
15.
by jsulinski 10y ago
Fixed!
16.
by jsulinski 10y ago
Thanks sir! I redesigned my landing page and made it static; forgot to update the confirmation email link. The command is a standard 'wget/bash' script that you will receive when you login, but it's pretty simple to grok
17.
by jsulinski 10y ago
To add a bit of detail here, one of the most surprising things I found that I'm saving for my next post is: 24% of recent vulnerabilities in the NVD have no rating, and that doesn't even include the ones that weren't posted t
18.
by jsulinski 10y ago
You're spot on. These are two of the things I intend on working on next. Thanks for the links.
19.
by jsulinski 10y ago
Absolutely. Huge props to CoreOS and the Kube community for pushing forward with this stuff. I gave Clair a shout out in the article, and I intend on adding it as an optional scanner to Federacy. Funny, I'm pretty sure we met before ei
20.
by jsulinski 10y ago
Absolutely agree. I did see some bad practices in the Docker community that I expect to see elsewhere as well. Specifically: reliance on deprecated images and not updating images during build. Thoughts? I didn't address the implication
21.
by jsulinski 10y ago
I did some market research before I started working on Federacy (which began as frustrations I encountered at mopub/twitter). It seems that very few companies sub-hundreds of employees and thousands of servers have a security specialis
22.
by jsulinski 10y ago
CentOS/RHEL have a very small footprint in the open source community, it seems. I was pretty surprised by this because they have such significant corporate backing, a lot of enterprise software is RHEL only, and they may be the only li
23.
by jsulinski 10y ago
Absolutely. I intended this post to identify (some of) the problems/challenges. My next post will focus on how to address them. Alpine is definitely one of the major points, as well as static binary images and some advice on Dockerfile
24.
by jsulinski 10y ago
I don't know the answer to this, but I do know that Alpine has some really awesome stuff around vulnerabilities, and I would presume that they react to vulnerabilities more quickly. However, I intend to validate this presumption in a f
25.
by jsulinski 10y ago
That's exactly what I'm trying to highlight. After you take that 'latest' image, if you're not applying updates regularly, you are vulnerable from almost day 1. This also applies to most of the AWS, Digital Ocean, e
26.
by jsulinski 10y ago
Absolutely. Docker and Quay.io both offer scanning for repositories they host, there are open source options like vuls and clair that are a bit more work to set up, and we have a free plan for up to 5 hosts and for open source projects and
27.
by jsulinski 10y ago
There absolutely is a pattern, but the thing is -- even if the image is updated at build, as soon as you deploy it, vulnerabilities begin to emerge.
28.
by jsulinski 10y ago
To be clear, one of those lines relates to making sure you pull in upstream during image building. This is super important, as it seems that people have assumed their base image will be current and that is not always the case.
29.
by jsulinski 10y ago
I will absolutely release some data. I intend to fully automate this research so that it is current whenever viewed as well. Not sure about the state of CI/CD in the image building process, I assume it varies wildly. Two of the major p
30.
Docker Image Vulnerability Research(federacy.com)
90 points by jsulinski 10y ago|46 comments

More ›