On the Weaponisation of Open Source

Re:On the Weaponisation of Open Source by pabs3 on Friday March 18, 2022 @10:16PM (#30730277)

How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?

[ Parent | on HN ]

Re:On the Weaponisation of Open Source by feross on Friday March 18, 2022 @11:40PM (#30730751)

We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue

Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

[ Parent | on HN ]

Re:On the Weaponisation of Open Source by pabs3 on Saturday March 19, 2022 @02:31AM (#30731674)

I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page.

https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

[ Parent | on HN ]

Re:On the Weaponisation of Open Source by pabs3 on Saturday March 19, 2022 @02:27AM (#30731655)

Re the typosquat issue, maybe also add bitsquatting

https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/

[ Parent | on HN ]

Re:On the Weaponisation of Open Source by huynhhacnguyen on Saturday March 19, 2022 @12:42AM (#30731107)

That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?

[ Parent | on HN ]