GitHub, Microsoft's cloud version control service and gripe forum, has joined with a handful of like-minded partners to form GitHub Security Lab (GSL) to better find bugs in open source software.
Consisting of GitHub security researchers, third-party code maintainers and interested parties from partner companies, GSL aspires to provide a bit more organization to the daunting task of securing open source code.
In a phone interview with The Register, Jamie Cool, VP of product security at GitHub, said the overall theme of GitHub's security announcements involves focusing the power of community.
"We recognize this is a problem that no one company can solve, including GitHub," he said. "But it's incredibly important, which is why we're investing so much in it."
The core of the Security Lab is an internal GitHub security team. The partner companies, said Cool, all share a common interest in better software.
"We basically wanted to combine the energy these companies have to secure open source software," he said, explaining that they all have something tangible to contribute, such as expertise, research or tools.
For example, Google, he said, is bringing software fuzzing tools, while Trail of Bits, a security consultancy, has committed to devoting time to open source bug hunting when not otherwise engaged.
Initially, GSL intends to lead by example, having already driven the creation of more than 100 CVEs detailing flaws that need fixing. The hope is other companies signed on as partners will participate by contributing security research findings to the open source community.
These partners include: F5, Google, HackerOne, IOActive, JP Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber, and VMWare.
GSL brings with it two practical tools: CodeQL, a language for querying databases generated from source code to find variations of vulnerable code patterns, and the GitHub Advisories Database, a public data set of security advisories from GitHub and accompanying remediation info.
Back in September, GitHub bought software analysis biz Semmle for its LGTM (Looks Good To Me) vulnerability query platform. CodeQL, used to search data from LGTM, represents the reconsidered branding for that tool.
With CodeQL now open to the public, any developer able to recognize a vulnerable code pattern can search for variations on that theme in source files converted to a CodeQL database. And Mozilla is offering an incentive for doing so: Firefox's maker, a GSL partner and admitted user of Semmle's tech, has just expanded its bug bounty program to accept static analysis queries crafted in CodeQL or as Clang-based checkers.
Cool said the hope is that CodeQL will not only help people find vulnerabilities but also avoid re-implementing those same flawed patterns.
In a blog post on Thursday, Cool explained the need to make security information easier to find and more comprehensive.
"Forty per cent of new vulnerabilities in open source dont have a CVE identifier when theyre announced, meaning theyre not included in any public database," Cool said. "Seventy per cent of critical vulnerabilities remain unpatched 30 days after developers have been notified."
To help address that gap, GitHub has a service called Security Advisories, just promoted from beta to general availability, that lets developers draft advisories, coordinate private discussion in the applicable project, collaborate on a fix in a temporary private project fork, and then publish the advisory, with a CVE number bestowed by GitHub, alongside patched code.
Along similar lines, Github's automated security update scheme, by which auto-detected vulnerabilities elicit a pull request fix, has graduated to general availability.
Also, Token scanning, introduced last fall in public beta, has attracted still more partners: GoCardless, HashiCorp, Postman, and Tencent. The service, which helps developers avoid publishing sensitive tokens in git commits, previously marked the participation of Alibaba Cloud, Atlassian, AWS, Azure, Discord, Dropbox, Google Cloud, Mailgun, npm, Proctorio, Pulumi, Slack, Stripe, and Twilio.
Sponsored: Technical Overview: Exasol Peek Under the Hood
See more here:
GitHub gathers friends for a security code cleanse to scrub that software up to spec - The Register
- Wyplay’s Digital TV Middleware Source Code is Now Available to Members of the Frog by Wyplay Community [Last Updated On: January 5th, 2014] [Originally Added On: January 5th, 2014]
- Find Open Source Alternatives to commercial software | Open ... [Last Updated On: January 5th, 2014] [Originally Added On: January 5th, 2014]
- Open Source Initiative - Official Site [Last Updated On: January 5th, 2014] [Originally Added On: January 5th, 2014]
- SCALE 11x: Evolution of an Open Source Software Foundation - Stephen Walli - Video [Last Updated On: January 5th, 2014] [Originally Added On: January 5th, 2014]
- Bitcoin Baron Keeps a Secretive Open Source OS Alive [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- osalt.com - Find Open Source Alternatives to commercial ... [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- Sustainability of Open Source software communities beyond a fork - Video [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- Bringing MoreWomen to Free and Open Source Software - Video [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- Acquia podcast with Sensio Labs UK - Video [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- xTuple ERP + OrangeHRM Open source software leaders integration - Video [Last Updated On: January 22nd, 2014] [Originally Added On: January 22nd, 2014]
- Guest articles setting out the author's position on the current status and future directions of KDE and its software [Last Updated On: January 23rd, 2014] [Originally Added On: January 23rd, 2014]
- Open Source Power for Small Business in 2014 [Last Updated On: January 23rd, 2014] [Originally Added On: January 23rd, 2014]
- EnterpriseDB Expands in Korea to Meet Rising Demand for Postgres [Last Updated On: January 24th, 2014] [Originally Added On: January 24th, 2014]
- Introduction to FOSS - Free and Open Source Software - Video [Last Updated On: January 24th, 2014] [Originally Added On: January 24th, 2014]
- Out in the Open: Teenage Hacker Transforms Web Into One Giant Bitcoin Network [Last Updated On: January 27th, 2014] [Originally Added On: January 27th, 2014]
- Who says that Open Source Software does not have support? By Rosaria Silipo - Video [Last Updated On: January 27th, 2014] [Originally Added On: January 27th, 2014]
- Microsoft Open Sources Its Internet Servers, Steps Into the Future [Last Updated On: January 28th, 2014] [Originally Added On: January 28th, 2014]
- Microsoft cloud server designs for Facebook's Open Compute Project [Last Updated On: January 28th, 2014] [Originally Added On: January 28th, 2014]
- Richard Stallman Free v Open Source Software - Video [Last Updated On: January 28th, 2014] [Originally Added On: January 28th, 2014]
- UK government looks to open source to cut costs [Last Updated On: January 30th, 2014] [Originally Added On: January 30th, 2014]
- Free Software + $20 USB Dongle = Software Defined Radio, Hak5 1524 - Video [Last Updated On: January 30th, 2014] [Originally Added On: January 30th, 2014]
- Libreoffice 4.2 challenges Microsoft Office with improved Windows integration [Last Updated On: January 31st, 2014] [Originally Added On: January 31st, 2014]
- Fallout 3 Let's Play Pt 6 - Video [Last Updated On: February 1st, 2014] [Originally Added On: February 1st, 2014]
- 14 1 29 Tom G Open Source Software 1 - Video [Last Updated On: February 1st, 2014] [Originally Added On: February 1st, 2014]
- 14 1 29 Tom G Open Source Software - Video [Last Updated On: February 1st, 2014] [Originally Added On: February 1st, 2014]
- How is open source software like great wine? - Video [Last Updated On: February 3rd, 2014] [Originally Added On: February 3rd, 2014]
- Free and open source software key for multicore hardware [Last Updated On: February 4th, 2014] [Originally Added On: February 4th, 2014]
- Blender Tutorial - 2D Animation (1) Bone Rigging, Shape Character Planes by VscorpianC - Video [Last Updated On: February 4th, 2014] [Originally Added On: February 4th, 2014]
- Obama Bit Coin Conspiracy? - Video [Last Updated On: February 4th, 2014] [Originally Added On: February 4th, 2014]
- The Pentagon's Mad Science Is Going Open Source [Last Updated On: February 5th, 2014] [Originally Added On: February 5th, 2014]
- The open source countdown has begun [Last Updated On: February 6th, 2014] [Originally Added On: February 6th, 2014]
- BLOG: Why open source will rule the data centre [Last Updated On: February 6th, 2014] [Originally Added On: February 6th, 2014]
- OpenDaylight Summit: SDN Needs Open Source and Open Standards [Last Updated On: February 10th, 2014] [Originally Added On: February 10th, 2014]
- 7 reasons not to use open source software [Last Updated On: February 12th, 2014] [Originally Added On: February 12th, 2014]
- The Open Source Initiative | Open Source Initiative [Last Updated On: February 12th, 2014] [Originally Added On: February 12th, 2014]
- Find Open Source Alternatives to commercial software ... [Last Updated On: February 12th, 2014] [Originally Added On: February 12th, 2014]
- Has Linux Conquered the Cloud? [Last Updated On: February 13th, 2014] [Originally Added On: February 13th, 2014]
- The New eRacks/NAS36 Rackmount Storage Server Achieves Price/Density Breakthrough: 100TB Storage in Only 4U for Under ... [Last Updated On: February 14th, 2014] [Originally Added On: February 14th, 2014]
- 2012 Red Hat Summit Build a PaaS using Open Source Software ~ Redhat Linux Video YouTube - Video [Last Updated On: February 14th, 2014] [Originally Added On: February 14th, 2014]
- Intel launches big data software suite - free to a good home [Last Updated On: February 15th, 2014] [Originally Added On: February 15th, 2014]
- Three college students build a health provider search site in six weeks [Last Updated On: February 16th, 2014] [Originally Added On: February 16th, 2014]
- The Asgard Show Episode 6 - Video [Last Updated On: February 16th, 2014] [Originally Added On: February 16th, 2014]
- Open source startups: Don't try to be Red Hat [Last Updated On: February 18th, 2014] [Originally Added On: February 18th, 2014]
- Open Source in the Enterprise: To Pay or Not to Pay? [Last Updated On: February 18th, 2014] [Originally Added On: February 18th, 2014]
- DEF CON 12 - Wendy Seltzer and Seth Schoen, Hacking the Spectrum - Video [Last Updated On: February 18th, 2014] [Originally Added On: February 18th, 2014]
- dev@Pulse Speaker Predictions - Jonathan Bryce - Video [Last Updated On: February 19th, 2014] [Originally Added On: February 19th, 2014]
- Facebook Boosts Its Open Source Mojo With New Project [Last Updated On: February 20th, 2014] [Originally Added On: February 20th, 2014]
- Raising Linux to Grow Open Source [Last Updated On: February 20th, 2014] [Originally Added On: February 20th, 2014]
- Apple Veteran Named PayPal's First Head of Open Source Software [Last Updated On: February 20th, 2014] [Originally Added On: February 20th, 2014]
- Open Source Software | 46 of 62 | MconneX - Video [Last Updated On: February 20th, 2014] [Originally Added On: February 20th, 2014]
- News Flash from Redmond: FOSS Causes Dissatisfaction! [Last Updated On: February 25th, 2014] [Originally Added On: February 25th, 2014]
- FOSS4G with Eric Brelsford - Video [Last Updated On: February 25th, 2014] [Originally Added On: February 25th, 2014]
- NYLUG Presents: Mark Tolliver on Palamida. Application Security for Open Source Software (6/25/08) - Video [Last Updated On: February 25th, 2014] [Originally Added On: February 25th, 2014]
- DARPA Open Catalog Makes Agency-Sponsored Software and Publications Available to All [Last Updated On: February 25th, 2014] [Originally Added On: February 25th, 2014]
- Munich opts for open source groupware from Kolab [Last Updated On: February 26th, 2014] [Originally Added On: February 26th, 2014]
- Modelling Hands Step by Step Using Free Open Source Software Seamless3d 3 - Video [Last Updated On: February 27th, 2014] [Originally Added On: February 27th, 2014]
- Accelerating the Network with Open Source Software, Erik Ekudden | OpenDaylight Summit 2014 - Video [Last Updated On: February 27th, 2014] [Originally Added On: February 27th, 2014]
- The Commercial Case for Open Source Software [Last Updated On: March 1st, 2014] [Originally Added On: March 1st, 2014]
- Beginners guide to contributing to open source software - Video [Last Updated On: March 3rd, 2014] [Originally Added On: March 3rd, 2014]
- Free Open Source Software [Last Updated On: March 4th, 2014] [Originally Added On: March 4th, 2014]
- Open Source Software - Video [Last Updated On: March 4th, 2014] [Originally Added On: March 4th, 2014]
- Open Source Software EDTC5325 - Video [Last Updated On: March 6th, 2014] [Originally Added On: March 6th, 2014]
- Broadcom Announces Open Switch Pipeline Specification Targeting Growing SDN Application Ecosystem [Last Updated On: March 7th, 2014] [Originally Added On: March 7th, 2014]
- RIT launches nation’s first minor in free and open source software and free culture [Last Updated On: March 7th, 2014] [Originally Added On: March 7th, 2014]
- Forum created to push optical SDNs [Last Updated On: March 10th, 2014] [Originally Added On: March 10th, 2014]
- Google embraces open source for 10th year of Summer of Code [Last Updated On: March 10th, 2014] [Originally Added On: March 10th, 2014]
- Is Open Source Software The Answer to Oregon's IT Problems? [Last Updated On: March 11th, 2014] [Originally Added On: March 11th, 2014]
- Spenden Ticketautomat mit Open Source Software auf der CeBIT 2014, CMS Garden - Video [Last Updated On: March 14th, 2014] [Originally Added On: March 14th, 2014]
- 2012 Red Hat Summit Build a PaaS using Open Source Software - Video [Last Updated On: March 14th, 2014] [Originally Added On: March 14th, 2014]
- CyanogenMod receiving Linux New Media Award 2014 (Best Open Source Software App for Android) - Video [Last Updated On: March 15th, 2014] [Originally Added On: March 15th, 2014]
- Real tech 25 Finding open source software you can trust - Video [Last Updated On: March 15th, 2014] [Originally Added On: March 15th, 2014]
- Tor is building an anonymous instant messenger [Last Updated On: April 10th, 2017] [Originally Added On: March 15th, 2014]
- MailPile is now in Alpha [Last Updated On: April 10th, 2017] [Originally Added On: March 15th, 2014]
- $2,400 “Introduction to Linux” course will be free and online this summer [Last Updated On: April 10th, 2017] [Originally Added On: March 16th, 2014]
- Linaro announces MediaTek as member [Last Updated On: March 18th, 2014] [Originally Added On: March 18th, 2014]
- TN state departments asked to switch over to open source software [Last Updated On: March 18th, 2014] [Originally Added On: March 18th, 2014]
- Open source project builds mobile networks without big carriers [Last Updated On: March 18th, 2014] [Originally Added On: March 18th, 2014]
- Your U.S. government uses open source software, and loves it [Last Updated On: March 18th, 2014] [Originally Added On: March 18th, 2014]
- Linux Goes to the Head of the Class [Last Updated On: March 22nd, 2014] [Originally Added On: March 22nd, 2014]
- What is open source? - Definition from WhatIs.com [Last Updated On: March 23rd, 2014] [Originally Added On: March 23rd, 2014]