Show HN: Patchwork – Real-time notifications for OSS vulnerabilities

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by whorleater on Wednesday January 13, 2016 @03:42PM (#10897325)

Yeah telling us to blindly run a shell script is...a quirky design choice. At least it doesn't tell you to run it with sudo like I've seen some other ones do, and the shell script itself is sanely commented.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by jacobscott on Wednesday January 13, 2016 @03:46PM (#10897354)

If the script source is on github and isn't run under sudo, is there a meaningful difference between curl | sh and apt-get install from a PPA, gem/pip install, etc?

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by whorleater on Wednesday January 13, 2016 @03:49PM (#10897379)

Meaningful? In most cases no, but since we're already talking about security, curl'ing the shell script from github exposes you to another attack vector, like MITM'ing the script.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by jacobscott on Wednesday January 13, 2016 @03:55PM (#10897421)

The software has to be distributed somehow, right? Probably over https? What makes curl more susceptible to MITM than apt-get/pip/gem/etc?

I don't particularly like curl | sh either, but without sudo, I'm not sure how much it /really/ differs, security wise, from other options.

Edit: real package managers have improved features compared to curl, as outlined in another branch of the comments.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dchanm on Wednesday January 13, 2016 @03:59PM (#10897453)

If you want to be extra cautious you can verify that the script hasn't changed with our release key

https://patchworksecurity.com/releases.txt

The latest release (2.0.0) has been signed by my key 0x85C64E20

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by yaworsk on Wednesday January 13, 2016 @04:18PM (#10897577)

Looked at the site and read the comments which made me think about the HN post yesterday about hiding vulnerabilities in plain site (https://news.ycombinator.com/item?id=10889721). Like your idea though.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dchanm on Wednesday January 13, 2016 @08:50PM (#10899117)

Hi yaworsk,

We're working on improving our API documentation. You can develop against our API and not use the supplied client.

https://patchworksecurity.com/docs/

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by yaworsk on Thursday January 14, 2016 @10:22AM (#10901884)

Oh nice! that's a great idea, thanks for sharing

[ Parent | on HN ]