osv.dev

/languages/Rust GitHub Dependency Graph; "Exploring the dependencies of a repository - GitHub Docs" https://docs.github.com/en/code-security/how-tos/secure-your... : > You can use the [GitHub search] keywords `ecosystem:` to show only packages of a certain type, or `relationship:` to show only direct or transitive dependencies (if the ecosystem supports transitivity). OSS-Fuzz runs CloudFuzz/CloudFuzzLite for many open source repos and feeds OSV OpenSSF Vulnerability Format: https://github.com/google/osv#current-data-sources

ion, GPUs, TPUs/NPUs, Hypervisors, OS schedulers, IPC,] Still though, coverage-based fuzzing; From https://news.ycombinator.com/item?id=30786239 : > OSS-Fuzz runs CloudFuzz[Lite?] for many open source repos and feeds OSV OpenSSF Vulnerability Format: https://github.com/google/osv#current-data-sources From "Automated Unit Test Improvement using Large Language Models at Meta" https://news.ycombinator.com/item?id=39416628 : > "Fuzz target generation using LLMs" (2023), OSSF//fuzz-introspector* > gh topic: https://github.com/topics/coverage-guided-fuzzing The Fuzzing computational task is similar to the Genetic Algorithm computational task, in that both explore combinatorial Hilbert spaces of potentially infinite degree and thus there is need for parallelism and thus there is need for partitioning for distributed computation. (But there is no computational oracle to predict that any particular sequence of combinations of inputs under test will deterministically halt on any of the distributed workers, so second-order methods like gradient descent help to skip over apparently desolate territory when the error hasn't changed in awhile) The Fuzzing computational task: partition the set of all combinations of inputs for distributed execution with execute-once or consensus to resolve redundant results. DbC Design-By-Contract patterns include Preconditions and Postconditions (which include tests of Invariance) We test Preconditions to exclude Inputs that do not meet the specified Ranges, and we verify the Ranges of Outputs in Postconditions. We test Invariance to verify that there haven't been side-effects in other scopes; that variables and their attributes haven't changed after the function - the Command - returns. DbC: https://en.wikipedia.org/wiki/Design_by_contract : > Design by contract has its roots in work on formal verification, formal specification and Hoare logic. TLA+ > Language: https://en.wikipedia.org/wiki/TLA%2B#Language Formal verification: https://en.wikipedia.org/wiki/Formal_verification From https://news.ycombinator.com/item?id=38138319 : > Property testing: https://en.wikipedia.org/wiki/Property_testing > awesome-python-testing#property-based-testing: https://github.com/cleder/awesome-python-testing#property-ba... > Fuzzing: https://en.wikipedia.org/wiki/Fuzzing Software testing > Categorization > [..., Property testing, Metamorphic testing] https://en.wikipedia.org/wiki/Software_testing#Categorizatio... -- From https://news.ycombinator.com/item?id=28494885#28513982 : > https://github.com/dafny-lang/dafny #read-more > Dafny Cheat Sheet: https://docs.google.com/document/d/1kz5_yqzhrEyXII96eCF1YoHZ... > Looks like there's a Haskell-to-Dafny converter. haskell2dafny: https://gitlab.doc.ic.ac.uk/dcw/haskell-subset-to-dafny-tran... -- Controlled randomness: tests of randomness, random uniform not random norm, rngd, tests of randomness: From https://news.ycombinator.com/item?id=40630177 : > google/paranoid_crypto.lib.randomness_tests: https://github.com/google/paranoid_crypto/tree/main/paranoid... docs: https://github.com/google/paranoid_crypto/blob/main/docs/ran...

tool.c: https://github.com/Cisco-Talos/clamav/blob/main/sigtool/sigt... clamav sigtool: https://www.google.com/search?q=clamav+sigtool https://blog.didierstevens.com/2017/07/14/clamav-sigtool-dec... : sigtool –-find-sigs "$name" | sigtool –-decode-sigs List of file signatures: https://en.wikipedia.org/wiki/List_of_file_signatures And then also clusterfuzz/oss-fuzz scans .txt source files with (sandboxed) Static and Dynamic Analysis tools, and `debsums`/`rpm -Va` verify that files on disk have the same (GPG signed) checksums as the package they are supposed to have been installed from, and a file-based HIDS builds a database of file hashes and compares what's on disk in a later scan with what was presumed good, and ~gdesktop LLM tools scan every file, and there are extended filesystem attributes for label-based MAC systems like SELinux, oh and NTFS ADS. A sufficient cryptographic hash function yields random bits with uniform probability. DRBG Deterministic Random Bit Generators need high entropy random bits in order to continuously re-seed the RNG random number generator. Is it safe to assume that hashing (1) every file on disk, or (2) any given file on disk at random, will yield random bits with uniform probability; and (3) why Argon2 instead of e.g. only two rounds of SHA256? https://github.com/google/osv.dev/blob/master/README.md#usin... : > We provide a Go based tool that will scan your dependencies, and check them against the OSV database for known vulnerabilities via the OSV API. ... With package metadata, not (a file hash, package) database that could be generated from OSV and the actual package files instead of their manifest of already-calculated checksums. Might as well be heating a pool on the roof with all of this waste heat from hashing binaries build from code of unknown static and dynamic quality. Add'l useful formats: > Currently it is able to scan various lockfiles, debian docker containers, SPDX and CycloneDB SBOMs, and git repositories Things like bittorrent magnet URIs, Named Data Networking, and IPFS are (file-hash based) "Content addressable storage": https://en.wikipedia.org/wiki/Content-addressable_storage

requirements.txt, Pipfile lock, environment.yml, or a custom Dockerfile, ], debian docker containers, SPDX and CycloneDB SBOMs, and git repositories.

gate and consume vulnerabilities across all ecosystesm. See our blog post for more details. > The following ecosystems have vulnerabilities encoded in this format: > GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), Rust Advisory Database (CC0 1.0), Global Security Database (CC0 1.0) OSS-Fuzz (CC-BY 4.0) > Together, these include vulnerabilities from: > npm, Maven, Go, NuGet, PyPI, RubyGems, crates.io, Packagist, Linux, OSS-Fuzz

y logs.

/news.ycombinator.com/item?id=29355786 Because ld-proofs is RDF, it works in JSON-LD and you could merge the entire SBOM [1] and e.g. CodeMeta [2] Linked Data metadata for all of the standardized-metadata-documented components in a stack. [1] https://github.com/google/osv/issues/55 [2] https://github.com/codemeta/codemeta

le: https://attack.mitre.org/techniques/T1552/005/. [Accessed 8 July 2021]. > [6] CISA, "Analysis Report (AR21-013A): Strengthening Security Configurations to Defend Against Attackers Targeting Cloud Services." Cybersecurity and Infrastructure Security Agency, 14 January 2021. [Online]. Available:https://us- cert.cisa.gov/ncas/analysis-reports/ar21-013a [Accessed 8 July 2021]. How can k8s and zero-trust cooccur? > CISA encourages administrators and organizations review NSA’s guidance on Embracing a Zero Trust Security Model to help secure sensitive data, systems, and services. "Embracing a Zero Trust Security Model" (2021, as well) https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI... In addition to "zero [trust]", I also looked for the term "SBOM". From p.32//39: > As updates are deployed, administrators should also keep up with removing any old components that are no longer needed from the environment. Using a managed Kubernetes service can help to automate upgrades and patches for Kubernetes, operating systems, and networking protocols. *However, administrators must still patch and upgrade their containerized applications.* "Existing artifact vuln scanners, databases, and specs?" https://github.com/google/osv/issues/55