best-practices-badge

rc/web/gui/v...). This license explicitly prevents any kind of reverse engineering or separation: > The Software is provided in a binary form for use by end-users. You may not reverse engineer, decompile, disassemble, or modify the Software. The Software is licensed as a single product and its component parts may not be separated. Netdata owns Open Source Security Foundation (OpenSSF) Best Practices Badge (which is awarded only to free/libre open source software) but is now under discussion for removal because of the blobs - https://github.com/coreinfrastructure/best-practices-badge/i.... Major Linux distros are also aware of this issue. Debian - still ships the pre-blobs version, has an open bug report - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1045145. Nix - Split by themselves, packaged Netdata Cloud separately - https://github.com/NixOS/nixpkgs/blob/c3aa7b8938b17aebd2deec... Alpine, OpenSUSE, Red Hat, Fedora etc. have been made aware of the issue and are working on a patch. On the other hand, the open source dashboards v0 and v1 will be removed soon - https://github.com/netdata/netdata/pull/18125. Leaving users no choice by default but to use the closed-source dashboard. So if you have been using Netdata because you loved it for being open source, then you might have to reconsider your option :). (I used a title that explains the problem better, please let me know if it can be worded better.) Thanks!

ach described in "Responsible Social Share Links" by Jonathan Suh (March 26, 2015), specifically using share URLs. In this approach, if a user does not press the link, the social media site never receives any information. Instead, a social media site only receives information when the user takes a direct action to request it (e.g., a click), and that site only receives information from the specific user who requested it." Source: https://github.com/coreinfrastructure/best-practices-badge/b... Suh's page: https://jonsuh.com/blog/social-share-links/#use-share-urls I don't mind people sharing information on Facebook, as long as they choose to do so. If they chose to do it, that's fantastic. What bothers me is Facebook being able to track people without their consent.

entation (as noted in the article), but that's less important if it's implemented by people who know what they're doing. The CII badge does specifically address the problem of people who roll their own crypto. Specifically, its "crypto_call" criterion says: "If the software produced by the project is an application or library, and its primary purpose is not to implement cryptography, then it SHOULD only call on software specifically designed to implement cryptographic functions; it SHOULD NOT re-implement its own." https://github.com/coreinfrastructure/best-practices-badge/b... Full disclosure: I lead the CII Best Practices badge project.

following is NOT a substitute for reading the criteria. I wrote this to give a good idea of why you'd want to take the time to click the above links. >> The following is the criteria to get a _minimally_ passing score. << Website(s) - <Must> succinctly describe the project with a minimum of domain-specific language or siloed knowledge - <Must> explain how to obtain, provide feedback and contribute - <Must> use HTTPS+TLS Project - <Must> use an OSS license (OSI, FSF, or liked by Debian or Fedora); <may> be dual-commercially-licensed - <Must> provide basic documentation in 99% of circumstances - <Must> use a URL-addressable, searchable discussion system for unilateral participation (IRC or mailinglists with URL-accessible logging is acceptable) - <Should> use English Source version control - URL-addressable version control <must> be used - System <must> track who changed what, and when - <Must> list all interim releases, for accountability - Unique version numbers <must> be used for all user-facing releases; commit IDs are listed as acceptable version "numbers", as is use of SemVer, and use of other version representations - Release notes <must> accompany all releases Bug reporting - Project <must> provide bug reporting process; use of an issue tracker is recommended - Project <must> at least respond to (if not fix) issues after 2-12 months, and <should> acknowledge more than half of submitted enhancement requests in the same timeframe Vulnerability reporting - Project <must> provide a vulnerability reporting mechanism; HTTPS or email (possibly with PGP) are suggested - All reports submitted within the last 6 months <must> be responded to within 14 days Building - IF project must be built in order to function, automatic rebuild mechanism must be provided - Automated OSS test suite <must> be used - Tests for new functionality <must> be added to automated test suite Code warnings - Project <must> use compiler warnings, language strict/safe modes, or linting tools Security - Project <must> be built by at least one developer who knows how to design secure software (the 8 principles from Saltzer and Schroeder are noted) - At least one developer <must> have domain knowledge of common vulnerability-introducing errors relevant to the software, and how to mitigate against them - Project <must> use established and reviewed security algorithms/protocols - Project <must> use keylengths that meet minimum NIST requirements through 2030 (certain keylengths are noted) - Project <must not> use known-broken crypto - Security mechanisms <should> use perfect forward secrecy - Stored passwords <must> be iterated/key-stretched hashes with per-$user salt - Keys and nonces must come from a cryptographically secure RNG - Project delivery mechanism <must> be MITM-resilient (HTTPS and SSH+SCP are listed as acceptable) - Checksums <must not> be delivered over HTTP - Medium- to high-severity vulnerabilities <must> be fixed if they are public knowledge for more than 60 days - Project <must not> leak security credentials (sample credentials are exempted) Code analysis - Project <must> use a static code analyser, if one exists for the given project language(s) and is OSS; it is <suggested> that the tool be configured/used to look for vulnerabilities, if possible; it is also <suggested> that code analysis be rerun every commit or at least daily - Project <must> fix medium/high severity (CVSS 2.0 or higher) exploitable issues found by static analysis in a timely manner - The use of a dynamic code analyzer to major production releases is <suggested>, if an OSS tool exists for the project language(s) - If the software is written in C/C++ or another memory-unsafe language, it is <suggested> that a dynamic analyser (fuzzer, web application scanner) be used to look for things like buffer overflows/overwrites - It is <suggested> that the project make heavy use of run-time assertions that are checked by dynamic analysis tools

possible size? CircleCI supports building <https://circleci.com/docs/2.0/building-docker-images/> further Docker images, but then there's a chance of losing dev/prod parity if, for example, a software dependency gets updated in the meantime.

ur application secure [1]. The application doesn't have many LOC, but we do work to keep it that way. We try to reuse code where it makes sense, and always try to keep it simple. Still, it doesn't take many lines to create a useful app, and that's a good thing. [0] https://github.com/kossnocorp/jquery.turbolinks/issues/56 [1] https://github.com/linuxfoundation/cii-best-practices-badge/...

-------+---------+---------+-----+-------+ | Name | Lines | LOC | Classes | Methods | M/C | LOC/M | +----------------------+--------+--------+---------+---------+-----+-------+ | Controllers | 687 | 476 | 8 | 59 | 7 | 6 | | Helpers | 184 | 134 | 0 | 21 | 0 | 4 | | Models | 711 | 470 | 5 | 55 | 11 | 6 | | Mailers | 160 | 115 | 3 | 12 | 4 | 7 | | Javascripts | 405 | 308 | 0 | 35 | 0 | 6 | | Libraries | 369 | 281 | 0 | 0 | 0 | 0 | | Tasks | 369 | 281 | 0 | 0 | 0 | 0 | | Controller tests | 605 | 513 | 6 | 53 | 8 | 7 | | Helper tests | 56 | 45 | 2 | 7 | 3 | 4 | | Model tests | 398 | 309 | 9 | 37 | 4 | 6 | | Mailer tests | 71 | 54 | 4 | 5 | 1 | 8 | | Integration tests | 614 | 446 | 10 | 25 | 2 | 15 | +----------------------+--------+--------+---------+---------+-----+-------+ | Total | 4629 | 3432 | 47 | 309 | 6 | 9 | +----------------------+--------+--------+---------+---------+-----+-------+