Node.js security advisories

Re:Node.js security advisories by troygoode on Thursday September 05, 2013 @10:33AM (#6334436)

I like the idea of having a centralized repository of these advisories, but I need a better way of watching for changes for this to be effective. I was hoping that the Twitter feed would be that (I would just turn on SMS notification), but the Twitter feed is full of general low-value tweets like "Thanks @espreto for being our 1000th follower!". Perhaps a separate Twitter feed could be created (@nodesecurityadvisories?) that only tweets when new advisories are posted on the site?

[ Parent | on HN ]

Re:Node.js security advisories by viraptor on Thursday September 05, 2013 @10:42AM (#6334490)

I think the security checker from Sensio labs is the best approach to this. You can upload your composer file, which is really the list of packages you use and they'll check it against the known reports for various Symfony modules. It's got both the API and its own module with a CLI tool, so you can easily integrate it into monitoring. https://security.sensiolabs.org/

I really wish other projects had something like that (rubygems, pypi, etc.)

[ Parent | on HN ]

Re:Node.js security advisories by kibibyte on Thursday September 05, 2013 @12:55PM (#6335271)

There actually does exist one for Ruby. Check out gemcanary https://gemcanary.com/

[ Parent | on HN ]

Re:Node.js security advisories by gravis on Friday September 06, 2013 @04:33AM (#6339310)

and https://gemnasium.com (which supports npm as well)

[ Parent | on HN ]