Show HN: Patchwork – Real-time notifications for OSS vulnerabilities

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by DyslexicAtheist on Thursday January 14, 2016 @04:11AM (#10900305)

is this a joke?

Piping random shit off the web straight into a shell. Sounds like worst advise. I'm sure the maintainers of this site really know their stuff when it comes to security.

A malicious attacker will love breaking this site and find out who uses which versions.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dang on Thursday January 14, 2016 @02:05PM (#10903558)

This comment breaks the HN guidelines. If you have a question or a criticism there is no reason why you can't express it respectfully. Please don't post any more comments like this.

Install via curl is also, by now, a classic flamewar topic with people who know what they're doing on both sides of the argument and well-trodden arguments all around. Please don't bring topics like that up with indignant denunciation as if you're the first person to encounter an outrage.

[ Parent | on HN ]

Re:Show HN: Patchwork – Real-time notifications for OSS vuln... by dchanm on Thursday January 14, 2016 @01:50PM (#10903458)

Hi,

We understand your concerns with the current install mechanisms. We're working toward providing multiple options similar similar to sandstorm.io

https://docs.sandstorm.io/en/latest/install/

There is the risk that we become a high value target. Would a solution that allows a user to query the state of a package/version instead of us storing package sets be acceptable? Or do you believe that SchizoDuckie's database approach to be the only way?

[ Parent | on HN ]