+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: Github Announces 4 Million Vulnerabilities (/Thread-Github-Announces-4-Million-Vulnerabilities)
Github Announces 4 Million Vulnerabilities - mothered - 03-24-2018
Greetings to all,
For all GitHub users, I'm sure you'll find this of Interest.
Quote:Github announced the discovery of more than 4 million vulnerabilities located in 500,000 plus repositories.
In 2017, the code sharing site started vulnerability scanning for known Common Vulnerabilities and Exposures in its Ruby and JavaScript libraries, according to a March 21 blog post. The libraries are operated through the company's Dependency Graph which matches the code against the vulnerabilities.
Shortly after the program was launched, Github said 450,000 of the identified flaws had been resolved by Dec. 1, 2017 and its rate of vulnerabilities resolved in the first seven days of detection has been about 30 percent.
Source.
RE: Github Announces 4 Million Vulnerabilities - Bish0pQ - 03-24-2018
That's insane, but it makes a lot of sense to me. While most companies use Git or alternatives, there are also lots of individuals that use Git, what makes some of the code badly written.
The amount doesn't really surprise me, what does surprise me is that possible some open-source software (hosted through Git) is being used as plugins etc for websites, which makes them (possibly) vulnerable as well.
RE: Github Announces 4 Million Vulnerabilities - mothered - 03-24-2018
(03-24-2018, 10:20 AM)Bish0pQ Wrote: some open-source software (hosted through Git) is being used as plugins etc for websites, which makes them (possibly) vulnerable as well.
This.
What makes matters worse, Is the majority of users will be unaware of the vulnerabilities and possibly susceptible to attack.
RE: Github Announces 4 Million Vulnerabilities - Nil - 03-24-2018
(03-24-2018, 10:39 AM)mothered Wrote:(03-24-2018, 10:20 AM)Bish0pQ Wrote: some open-source software (hosted through Git) is being used as plugins etc for websites, which makes them (possibly) vulnerable as well.
This.
What makes matters worse, Is the majority of users will be unaware of the vulnerabilities and possibly susceptible to attack.
That's the thing, I believe they are making users aware of them. I've gotten several emails from Github the last couple of weeks on vulnerabilities but it's on old, useless projects so I don't really care.
RE: Github Announces 4 Million Vulnerabilities - phyrrus9 - 03-24-2018
If I read this correctly, these aren't vulnerabilities with github itself, but they're reading the actual source code of their users and looking for vulnerable sections.
RE: Github Announces 4 Million Vulnerabilities - mothered - 03-25-2018
(03-24-2018, 05:49 PM)God Wrote:(03-24-2018, 10:39 AM)mothered Wrote:(03-24-2018, 10:20 AM)Bish0pQ Wrote: some open-source software (hosted through Git) is being used as plugins etc for websites, which makes them (possibly) vulnerable as well.
This.
What makes matters worse, Is the majority of users will be unaware of the vulnerabilities and possibly susceptible to attack.
That's the thing, I believe they are making users aware of them. I've gotten several emails from Github the last couple of weeks on vulnerabilities but it's on old, useless projects so I don't really care.
Well that's good they're Informing users.
Given the magnitude of vulnerabilities, I'd say It's safe to assume they'll be quite a few users who'd have no knowledge whatsoever.
RE: Github Announces 4 Million Vulnerabilities - Synthx - 03-27-2018
I find this very nice of them. It's a cool idea to do this. I'm glad they're looking out for these programmers/developers.
RE: Github Announces 4 Million Vulnerabilities - mothered - 03-28-2018
(03-27-2018, 06:30 PM)Synthx Wrote: I find this very nice of them. It's a cool idea to do this. I'm glad they're looking out for these programmers/developers.
Absolutely.
The vulnerabilities could've easily been used for malicious Intent, but Instead (as an awareness factor), GitHub elected to disclose them.