Hacker News Reader

Comment by grey-area | Hacker News Reader

I find it incredible that there are 86,453 results for this, and 58,123 results for execution of a parameter as a command!

Github should set up a little warning for people when they log in to their account if their repos match any of a set of obvious security anti-patterns, because this would be fertile ground for exploits. They could expand it later to some kind of code-review bot which does automatic code reviews looking for common antipatterns, off-by-one errors, and anything else that is easy to detect automatically. There are quite a few tools like this for analysis of desktop apps, but code for web apps are not checked as much in a systematic way.

Are there any external services which do this already for public github repos?

View on HN

I think this is a great idea, and an area where someone as big as Github could make a MASSIVE difference. A CodeSmell metric! Allow contributions to add extra smells to langauges, and then it looks after itself.

A modern, open, polyglot lint would be of great benefit to the world. Unfortunately, it's something that gets way too little attention. Open-source static analysis projects always seem to flounder.

That would be great, but I would hope it could be turned off. I have plenty of code on GitHub that's clearly marked as just something I put up in a few hours for personal use only, where I don't care if there's vulnerabilities or exploits. The code was written in the true spirit of hacking, fast and dirty in order to solve an immediate need.

Maybe dirty, hackish code for personal use only shouldn't make it out into the public ;-)

What if op doesn't want to pay for private repositories to store his hackywhackys or wants to share them with others?

Bitbucket lets you have free private repositories.

That's where i'm storing my dirty laundry at least...

Lots of generic hosting providers can be used for it too, if you have a hosting account somewhere. As long as the server has git and you have SSH access, you can do this on the server side:

$ mkdir project_name.git; cd project_name.git; git init --bare

Then locally, from the repo directory:

$ git remote add origin username@server.com:~/path/to/project_name.git

That's what I do (on Webfaction). Of course, then you don't get all the fancy issue tracking and all that from github, but it works if all you need is a few kb of storage for a remote. That also makes it easy to deploy PHP projects with a single post-receive hook, since it's all in the same box.

Or type slightly less:

  $ git init --bare project_name.git

It will make the directory for you.

I would expect any code marked "quick hack to solve [obscure problem], not for production!" to be pretty clear.

If someone is encountering the same problem, the code is there for them to use. If they happen to use it in production, that's hardly my fault.

Technically if the code doesn't have an open source license attached then it is still their copyright and isn't up for you to use even if on Github.

Just because it's dirty doesn't mean someone else can't use it and make it clean.

Sure, it could be on by default but easy to turn off if you wanted to.

Thinking about it again probably it'd be best as a per-repro flag that made a little button appear somewhere saying 'security', 'code police' or something similar, leading to more info. Obviously it'd take a bit of work and generate some false-positives, but I could see a system like this being really handy if they accepted open contributions for filters, even if it was opt-in it would probably still help a lot of people.

Re dirty hacks, I guess I wouldn't publish things like that to github, I'd keep them in a local or private repo, as they're not for sharing. If they are for sharing in spite of vulnerabilities, turning off a warning shouldn't be too much hardship for you, and it could actually help others looking at the code quickly tell it wasn't to be used in production as it would mark it as unsafe.

It shouldn't really matter if it's only for personal use, it's not a whole lot of extra effort to follow basic security guidelines.

Matt Wright, is that you?

Reply on news.ycombinator.com