[HN Gopher] CVE Alerting Platform
___________________________________________________________________
CVE Alerting Platform
Author : ncrocfer
Score : 91 points
Date : 2021-04-13 07:21 UTC (15 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| fmajid wrote:
| I use the NVD feed directly:
|
| https://nvd.nist.gov/feeds/xml/cve/misc/nvd-rss-analyzed.xml
|
| then filter out stuff I am not interested in using the filtering
| features of my RSS feed reader, but the feed is so comprehensive
| with all sorts of reports on obscure commercial packages I've
| never even heard about, and with relatively poor metadata about
| the packages (so you can't just filter out "anything having to do
| with Windows since I don't use Windows").
| csunbird wrote:
| There is also a dependency-check maven plugin that will read
| the CVE feed from NVD and check your dependencies.
| thepimp32 wrote:
| There is also https://dependencytrack.org/ which allows you to
| gather your software dependencies and notifies you when new
| vulnerabilities are found for them.
| tsteenbe wrote:
| Are you aware of https://github.com/nexB/vulnerablecode? which
| offers a similar solution, is also open source and written in
| Python.
| hardwaresofton wrote:
| Thanks for this link to another project that I'd prefer.
|
| Just a small nitpick though, both are "open source" but only
| one of them is "free". I know that's what you meant but wanted
| to point it out. Some open source software that most people
| like (ex. Sentry) is BSL so it's not an uncommon license.
|
| BSL is open source software but you cannot "free"ly use it (to
| make money) -- GPL v2 is free software.
| [deleted]
| hjek wrote:
| > BSL is open source software but you cannot "free"ly use it
| (to make money)
|
| To nitpick your nitpick: That wouldn't be open source but
| _source-available software_ [0].
|
| [0]: https://en.wikipedia.org/wiki/Source-
| available#Distinction_f...
| hardwaresofton wrote:
| Thanks for this, will try to remember and use that term
| instead
| tsteenbe wrote:
| Good catch I missed that openCVE is Business Source License
| which I actually do not consider to be open source.
| cpach wrote:
| I agree. If it doesn't follow the Debian Free Software
| Guidelines then I wouldn't call it open source.
|
| https://en.m.wikipedia.org/wiki/Debian_Free_Software_Guidel
| i...
| lightswitch05 wrote:
| I didn't realize there were so many CVE-based tools out there! I
| even have an ultra-specific one for PHP (with some extra logic
| for support timelines). PHP Version Audit:
| https://www.github.developerdan.com/php-version-audit/
|
| One thing I've noticed with PHP at least, is that their release
| docs will regularly have the CVE listed with the details for many
| days before it shows up in the CVE feed- even as long as a week.
| Sourcing only from the feeds is a bit slow, but perhaps that is
| limited to the process that PHP uses?
| pabs3 wrote:
| Debian has another solution for this, also written in Python:
|
| https://security-tracker.debian.org/tracker/
| turminal wrote:
| The usage of 'open' in the name is misguided.
| timdaub wrote:
| Nice,
|
| I once had the idea to create a CVE/Bounty platform running on
| Ethereum:
|
| - wp:https://github.com/0xdefaceme/whitepaper
| watrami wrote:
| My startup is providing a somewhat similar service to our
| customers. However, we also provide intel on suspicious activity
| regarding the customer's software on social media and on forums.
| This way our beta testers were able to prevent the OWA hacks that
| happened a few weeks ago. It's primarily targeted towards small
| and medium business that usually lack some deeper knowledge in
| cyber security and can't monitor this stuff themselves.
| obayesshelton wrote:
| Not a huge fan of managing something as critical like this.
| GitHub has a dependancy management tool and also Snyk is a great
| addition to our pipeline for code packages and Docker Images.
|
| Using both in production.
| aaronharnly wrote:
| What do you like about Snyk above what GitHub provides?
| eptcyka wrote:
| > During the import of initial data OpenCVE will download and
| parse huge files, like the CPE dictionnary. For that we recommend
| you 3.5G RAM at least.
|
| Why oh why are streaming parsers not used?
| JohnCClarke wrote:
| This is a great self-hosted solution!
|
| We built CyberSentinel (https://www.insurtechnix.com/) to solve
| two problems with this approach. Firstly the raw CVE feed is
| quite "noisy" so you need almost full NLP to get the best out.
| Secondly most organisations find it challenging to get an
| inventory of all their SW.
|
| We also prioritize CVEs according to whether they have exploit
| code, and also whether they are targeted by exploit kits. There
| are only about 2 dozen CVEs at any time that are exploit kit
| targets, so patching just those gives a huge security ROI.
| waihtis wrote:
| Greetings fellow LORCA alumni, you're solving a real problem
| but the website doesn't really tell that story as well as your
| comment.
|
| I also think SME's care very little of CVE prioritization
| whereas enterprise fights this problem day in, day out!
| JohnCClarke wrote:
| Agree! It is hard to sell security to SMEs! Vitamins vs.
| pain-killers...
|
| We do have success with enterprise and our goal (hence the
| name) is to integrate with cyber-insurance.
___________________________________________________________________
(page generated 2021-04-13 23:02 UTC)