WIRED
Open source software has the potential to be very secure. Unlike proprietary code that can only be accessed directly by its own developers, anyone can vet open source projects to spot flaws and bugs. In practice, though, being open source is no panacea. Now, code repository GitHub is rolling out new tools for its GitHub Advanced Security suite that will make it easier to root out vulnerabilities in the open source projects managed on its platform.
Open source code present a few security challenges. In practice there aren’t always enough people with the right expertise looking at it. And open source projects are generally ad hoc; they don’t necessarily have a clear process in place for people to submit vulnerabilities, or the resources available for someone to patch them. Even if you surmount those hurdles, you may not know who’s actually using your open source code and needs a patch.
A lot of what we talk about is there’s a vulnerability, what’s the workflow for that vulnerability, now it gets addressed, says Jamie Cool, vice president of product for security for Microsoft-owned GitHub. But the nirvana is you don’t introduce the vulnerability to begin with. You stop it from ever showing up. It really seems like this is a problem we should be able to help developers not introduce again and again, but by and large we haven’t succeeded at that as a software industry yet.
In September, GitHub acquired the code scanning tool Semmle as part of a plan to help the GitHub community catch common security flaws automatically. Advanced Security includes this service, calling out which line of code contains a potential vulnerability, why it might be exploitable, and how to fix it. In addition to this automatic scanning, Semmle’s technology can also be used manually by security researchers. GitHub’s goal is to use Advanced Security as both a warning system for developers and a built-in framework for bug hunters to find and report additional issues.
GitHub Advanced Security also includes tools that scan user repositories, essentially the folder where they store their development projects, for secret data like passwords and private keys that shouldn’t be exposed and accessible. GitHub works with a number of partners, including Amazon Web Services and Alibaba, to understand the characteristics of their authentication tokens and spot them automatically. The feature has already been available to public repositories for a couple of years, but today GitHub is also adding support to scan private repositories as well. GitHub says that eight percent of active public repositories had a secret exposed in them during the last month alone.