JakeMimoni
Bug Bounty Board for Open-Source Code – Fix Code Get Rewarded
Why 'many eyes' isn't working and what we can do to fix it!
“Many eyes" in theory is perfect, but, in practice the "eyes" tend to focus only on the top 1% of packages, and those specifically with corporate sponsorship.But it is possible to fix this! Today we know exactly what packages are most used, so now all we have to do is incentivise the eyes to look at all open-source code.We are attempting to do just that with the launch of huntr...
Re:Two malicious Python libraries caught stealing SSH and GPG keys
on Thursday December 05, 2019 @06:39AM (#21711583)
might not have explained it the best I could have haha..
It means as you pull packages in from NPM et al, the analysis goes to work, telling you of any known vulnerabilities, or any license in-compliance.
With regards to Slack, we are hearing that a lot, it isn't the best mechanism for providing this feedback, and we are working on alternatives now, including email.
Happy to answer any more questions on here or reach out [email protected]
Re:Two malicious Python libraries caught stealing SSH and GPG keys
on Wednesday December 04, 2019 @09:24AM (#21702359)
we made a tool that automates that process - https://trustd.dev
it will analyse open-source packages as you install them and tell you of any vulnerabilities before they are even on your system...
meaning it will detect problems in the libraries you aren't thinking about.
Re:Two malicious Python libraries caught stealing SSH and GPG keys
on Wednesday December 04, 2019 @09:08AM (#21702228)
We just recently launched a free tool that helps python developers prevent exactly these type of issues.
Feel free to check it out: https://trustd.dev
we work preventatively, so as you download packages, the tool will analyse it and tell you of any issues found.
We’re looking to collaborate with devs to work out what features should be next.
trustd now supports Python!
trustd.dev now supports python!trustd is a free tool that helps developers consume open-source code in a safe way, identifying issues in the code before you even install it, saving you time as it will stop bad things being flagged up later on in your development cycle!check it out: https://trustd.devWe are now supporting developers across the globe, so come and join the growing community of...