Hacker News Reader

Comment by mbrock | Hacker News Reader

Lazyweb question. Is there a way for me to easily keep track of important upstream security announcements for some given set of software—say, ElasticSearch, Rails, nginx, and Linux? Like I could check those check boxes and get an RSS feed, or something?

View on HN

It's not pretty (you need to do filtering yourself), but https://nvd.nist.gov/download.cfm will give you 99% of the data you want.

Otherwise, look at specific distro feeds. For example Ubuntu has http://www.ubuntu.com/usn/ (RSSable) and Debian has https://www.debian.org/security/ (also RSSable)

(apparently you can also generate your own feed from http://tif.mcafee.com/ but I never used it)

We're working something similar at Patchwork (https://patchworksecurity.com/) . You tell us what packages are installed and we notify you when a new security update is released. Right now we're focusing on distro package managers, but plan to add support for monitoring upstreams like nginx.

The big issue we see with RSS / mailing lists is a problem of discoverability and noise. Not all software has an easy to digest format for security changes. We want to do the scraping / parsing once and make it consumable by others. General lists such as OSS and distro specific security announce lists tend to have more noise. Most people only care about packages installed on their machines, which is why we filter our results based on your set of packages.

Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you should have someone looking at that list.

I think it is a good complement to the security advisories of your Linux distributor (Debian, CentOS, whatever), but is isn't free as you'll need time to keep an eye on it.

1: http://oss-security.openwall.org/

Thanks. Regarding cost... someone should sell curated security feeds to startups.

There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings.

Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.

There was something made to ease exactly that pain... sadly it's no longer updated: http://www.websecuritywatch.com/

That isn't really possible, Linux for example doesn't even have a security issues page, you are expected to read git patches yourself and understand the implications of each patch.

In general, looking at the security information for a Linux/BSD distro containing the software you care about is probably the best way, along with tracking any RSS feeds you can find that do exist.

Reply on news.ycombinator.com