Hacker News Reader

Comment by rosnd | Hacker News Reader

Which projects do you think would be most interesting to HN users?

I would say this one: https://opensource.nc3.lu/projects/saems/ https://github.com/scandale-project

It's the most recent, really in development. It's about scanning IP ranges, looking for vulnerabilities (in MS Exchange Servers and various things) and sending notifications. Some parts are already used for operational stuff (NMAP Script Engines for example).

An other really interesting project, under AGPL as well: https://opensource.nc3.lu/projects/monarc/

"MONARC is an iterative and qualitative method of risk analysis in four stages, broadly inspired by ISO/IEC 27005." ;-)

And maybe this project: https://github.com/NC3-LU/MOSP As you can see it's a collaborative platform to share security related JSON objects. The nice thing is the object editing user interface automatically generated thanks to the JSON schemas. The project provides an API and is connected to every MONARC instances.

scandale-project is also meant to monitor constituencies' actions after being notified about security issues. The idea is to timestamp scan results with a Time Stamp Authority to have a clear and indisputable incident timeline following a notification. The aim is to nudge constituencies to take action and also give them leverage on non-cooperating suppliers. No infrastructure change or patch after repeated notifications is not a good trajectory to be on--hence the name, scandale :)

Reply on news.ycombinator.com