Show HN: Web startup security is failing and we're fixing it

Just as educated programmers can introduce bugs and it’s impossible to find a programmer that will write bug-free code, it’s also impossible to find one that will write vulnerability free code. Therefore educating programmers is not the solution; it’s part of the solution. And automated scanning is also not the solution, but it’s a big part of that solution.

> Automated scans are useless for finding all but the most trivial of vulnerabilities

I’m really curious about how you can make that claim. Automated scanning can find many very important vulnerabilities in a very accurate manner. We regularly receive user comments like this one:

“We have external scan performed by third party that found some vulnerabilities of our sites. Using Netsparker we were able to validate them and work on fixing them. More than this we found few others not reported by them that we had to patch.”

This proves that even a highly-paid security consultant can miss vulnerabilities that can be found by automated scanners. Not to mention that lots of security consultants also use automated scanners to speed up their task.

Finally, there are so many other issues to learn about that you can’t expect your developers to keep up-to-date with all of them: new attack techniques, new vulnerabilities that affect a framework, etc. So, even when your developers are educated about writing secure code, you can still create vulnerabilities in your application. Or when your code is secure in your staging environment, it can be not-so-secure on the production environment because certain settings are different etc.

> merely pokes around for a few well known vulnerabilities.

Modern web app scanners don't really work around the concept of testing well known vulnerabilities, there are classes of vulnerabilities such as LFI, SQLI, XSS etc. and scanners are intelligently (similar to an actual attacker / penetration tester) test these out.

You might be thinking about old school tools such as Nikto (also referred as CGI Scanners). Today, even those tools are doing a little bit more than just looking for well known vulnerabilities.

This is absolutely true.

BUT, there are charlatans armed with little more than nmap and a cursory understanding of the output that sell themselves as penetration testers, for a whole lot more than I assume this service will cost.

This, at least, is normalized, repeated, reported consistently, and history is kept. That's worth something.

It's incomplete, but I assume at the price point, it will be more cost efficient and trustworthy than the other options -- the most popular of which is doing nothing.

Usual rant about false senses of security elided for brevity.

Thanks! Please do not forget to register for beta so we can inform you. Possibly we'll give lots of free scans during the beta as well :)

> (Also the link to your other product http://www.mavitunasecurity.com/netsparker/ doesn't seem to work?)

Is it still not working for you? I just checked and it was up, also pingdom didn't report any downtimes, maybe a temporary issue in your side?

Why not do a port scan yourself then?

Or are there things you don't know about and don't know how to test for? Should you maybe pay a professional who knows about this?

How much is your data worth?

Sites like those generally in the business of seal-selling or doing very light security checks.

Many of them will only report out of date vulnerabilities (quick & easy to check) or very simple issues limited issues. Still a legit business obviously. Though the benefits are limited. Best way to check this, get a scan request and watch your logs. Most of them won't even do a POST request. How can you really check for vulnerabilities unless you test all the functionality in a web application?

I guess we should explain this in our website to distinguish ourselves from that pack.

Thanks :) It seems we have some fine tuning to do.

Thanks for your feedback. The screenshot arrows seemed to work in all the browsers we tested with. Can you tell us what browser you're using?

I recommend that you join our beta programme. As Ferruh (@fmavituna) said, we'll no doubt be making some attractive offers to beta users.

Thanks. What you have said is exactly the rationale behind what we're building - a move away from expensive and restrictive enterprise solutions toward something that works (both operationally and economically) for smaller businesses.