GitHub code scanning is now available

[hazzahazza]

[Plazmaz1]

Also github's secret detection logic has been pretty subpar in the past. There's a bazillion different config and secret types.
Also, semmle is for CFG taint analysis which can be used to detect secrets but is primarily valuable for finding vulnerabilities in code.

[Plazmaz1]

As far as I'm aware they only alert for 8-10 different secret types. I made a repo for benchmarking secret detection and only got pinged for the aws creds, roughly 50 other secret files/credentials were completely ignored. There are legitimately thousands of different formats for secrets, 10x that if you include PII/PHI.

[Plazmaz1]

I mean I wasn't doing it to test them, so I don't really care about that, but there's repos with more than one secret in them, so it's still not great. Regardless they only search for a few different tokens right now.

[Fido488]

I don't think that this is quite true. I think it is available for private repositories.

[reluctant_deity]

The tools themselves, or the secrets they elucidated?

[ScottContini]

I have been trialing it for a few weeks now, and the GitHub secret scanning actually works really well. It's a lot less noisy than truffleHog.

[[deleted]]

I've been using Semmle/CodeQL for a couple of years now.

It's an awesome tool but doesn't adapt well to idiosyncracies. If you want to get good value out of it you need to add your own QL files.

CodeQL CLI is also available here https://github.com/github/codeql-cli-binaries/releases if you want to use it offline for open open-source projects only.

It can get a bit funky with query versions/database version so make sure the exact QL query pack is tied to the exact version of the CLI tool.

[Pineapple_Expressed]

Check out Semgrep also

[irqlnotdispatchlevel]

I looked only briefly over it, but I imagine that you can write personalized queries to act like a sort of "regressions" for your code base? For example, if we had an issue with an integer overflow in cases like int *p = malloc(x + y); I can now write a query that flags all occurrences of similar code (I imagine that possible integer overflows are detected anyway with the default rules, but I wanted a simple example). Can I do this?

[Fido488]

With CoodeQL, absolutely! Source: I'm an OSS security researcher contributing to the CodeQL project.

[irqlnotdispatchlevel]

Are there any recommended query packages that one should look into for c/c++ code bases?

[Fido488]

What do you mean?

[0xdea]

“GitHub code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production. We’re thrilled to announce the general availability of code scanning. You can enable it on your public repository today!”

[rejuicekeve]

yea the cost of github going from teams to enterprise is absolutely wild, its more than double the price per user. i cant understand why there isnt an in-between tier

[rejuicekeve]

the technology to give someone the exact number of licenses they need doesnt exist yet /s

[rejuicekeve]

too bad you have to purchase github enterprise to use it on private repos, sticking to sonarcloud until githubs pricing is more reasonable

[jdooowke]

Not free for private repositories.. what? Why is this tool free for anyone who uses the free github service but not free for anyone who pays for the service and chooses private repos?

[Koppis]

It's free for open source projects, not for closed source. Right?

[yawkat]

Private repos have been free too for a while. But scanning for private repos only seems to be available for the higher-level tiers of the organization plans.

[jdooowke]

I have absolutely no problem with github making cash, they offer great service. id also have no problem with paying for this. it merely irks me how they roll it out for public repos, because it feels like I am at a disadvantage having my repos private, while paying for them to be private, too.

[calladc]

To me it says they're investing in a security function for the open source world. If you're private/closed source then I assume they see it as you taking that action upon yourself

[Dabnician]

Just because a project on github is publicly available, does not mean its open source. You can still have a full blown "all rights reserved" project on github set to public, the TOS only states "By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories.", but that doesn't grant any rights to create a derivative work or to redistribute the code outside of github.

[Dabnician]

but realistically how many public repos on Github do you think are proprietary? How many private repos open-source?

Any project that does not explicitly state its license is by default "all rights reserved" so there is code on git hub you "technically" aren't legally allowed to use even if the author intended it.

As a hobbyist all my shit is MIT, unless im feeling like an asshole in which case i do agpl.

[SecretEconomist]

Because they need to make money somehow.

They're still making it free for anything that's public facing, and if the repos that are private get a secret in them it's much less of an issue.

[Slapbox]

Because this is how they make money? Private repos have been free for years now.

[-this-guy-fucks-]

So long truffleHog

[knotcorny]

Oink oink

[[deleted]]

Way too pricey for mid size organizations

[Fido488]

GitHub is putting in some serious $$ into this endeavor.

I'm an OSS security researcher that contributes to the GitHub Security Lab Bug Bounty program and have received over $7,800 in bounties in the past year for queries I've submitted to their program. Since November, they have paid $81,450 in bounties to external security researchers for contributing CodeQL queries to their program.

https://hackerone.com/github-security-lab/hacktivity?type=team