Show HN: Receive Alerts when your Server's software has Security Vulnerabilities

https://beta.secureit.io/tryit

by joantune • 9 years ago

16 11 9 years ago

beta.secureit.io

joantune6• 9 years ago

This is till a WIP, but still pretty useful, all comments are welcome

evadne2• 9 years ago

My company uses http://appcanary.com and recently GitHub has introduced a similar feature https://github.com/blog/2470-introducing-security-alerts-on-...

joantune6• 9 years ago

I searched and I did not know about them. Thanks for letting me know. These are actually the first paying service I have seen on this (at least the server side, I had seen it for webapps).

I'll probably start out with Java/Scala on the webapp side and on the server side I'm thinking of an easy to use support for Kubernetes and Rancher OS. If that's more around your ally subscribe there on the website or here.

I'm curious on what is your company, regardless, any pain points that you might have noticed while using AppCanary, or suggestions on SecureIT?

evadne2• 9 years ago

Usually they would like to install a daemon which checks local packages and all Gemfiles for example. The problem would be in ensuring that the daemon does not misbehave. A solution which gets integrated into a CI/CD pipeline would not have this problem but it would not be able to provide assurance on the integrity of the base system, only the artefact (deliverable).

Shoothe• 9 years ago

It would be nice if the home page had some kind of an example page or report. I don't want to sign up for something if I don't know how it works first.

joantune6• 9 years ago

Hi!

You don't need to sign up to use the app. The 'try it' mode allows you to generate and see the reports without signing up. To setup the alert though, you will need to input an email. But you're right, it should show the process upfront. That explanation is on the works and will be on the next version of the frontpage and/or the TryIt part.

Meanwhile you can set a phony email although you won't get the email with the alert of course to see how the process works. But I would love to know what you thought of it through the chat or here.

The link to the try it mode is: https://beta.secureit.io/tryit (or click above)

Cheers

legard44• 9 years ago

This is actually an idea I had started working on, but specifically for PCI requirement 6.2 in conjunction with some kind of automated threat analysis.

If I can list every software used in the card processing environment and get automated alerts fired straight into my ticketing system to create an event, this would be good.

joantune6• 9 years ago

Hmm, interesting. Automated threat analysis, how exactly would that work? Like the configuration OVALs? If I'm not mistaken Red Hat has quite the support via OVALs to some of the PCI requirements.

Regarding the card processing environment, what does that usually consist of? Linux servers?

You can reply to info@ SecureIT or here. I'm interested in knowing more.

Cheers

aennyta• 9 years ago

It might be useful, but I am finding it pretty hard to understand what it is from the landing page. I would suggest putting the message there clearer.

joantune6• 9 years ago

yup, yes, definitely going to. Even the secureit.io is not very clear on it. If you have any more insights let me know. Cheers

Show HN: Receive Alerts when your Server's software has Security Vulnerabilities

Related Stories