July 2023 Summaries

In July, GitHub issued a security advisory for vm2, a popular JavaScript sandbox, revealing two critical vulnerabilities that led to its discontinuation due to its inability to be fixed. This situation highlights the broader issue of open-source software reliance, where many technology companies depend on projects like vm2 without contributing resources to their maintenance, leading to potential risks when such projects become unsustainable. The vm2 project faced an unusually high number of security advisories within a short period, overwhelming its limited maintainers and prompting its closure. The recommended alternative, isolated-vm, offers a more secure approach by using v8's Isolate interface instead of Node's vm module, but it requires community support to ensure its sustainability. This scenario underscores the importance of active community involvement and support in maintaining open-source projects to prevent similar situations in the future.

Semgrep Assistant, initially launched in a private beta three months ago, is now available to all Semgrep users on GitHub, aiming to enhance cybersecurity efficiency by leveraging AI to assist in static code analysis. The tool reviews security alerts and assesses whether findings are false positives or require code updates, integrating its recommendations into GitHub pull request comments and Slack notifications. During the beta phase, Semgrep Assistant marked 230 findings as likely false positives, with users agreeing with 95% of these assessments, although response rates were low. Data from the largest beta customer showed users were 1.5 times more likely to fix true positives and 2.2 times more likely to ignore false positives, indicating improvement over time, partly due to enhanced prompt engineering and GPT-4's updates. The initiative faces challenges such as extracting confidence levels from GPT-4's autofix suggestions and incorporating AI-driven rule writing, given the model's training data limitations. Future directions include refining auto-triage capabilities, better rule classification, and feedback loops for improved data quality, with community input sought for further development.

In an effort to streamline efficiency and reduce maintenance burdens, the migration of Semgrep's codebase from Python to OCaml was initiated by Robur in April 2023, leveraging their expertise with systems code and OCaml. This transition encountered a significant challenge with an "HTTP request failed" error in the CI environment, attributed to a timeout during DNS resolution due to the complexities of modern internet protocols and multi-homed servers. The root cause was traced to the "happy-eyeballs" algorithm's handling of DNS-over-TLS connections, which did not adequately address scenarios where connection attempts received no response. The solution involved revising the algorithm to enable concurrent connection attempts and improve timeout handling, which was achieved without altering the interfaces of related libraries, thereby maintaining compatibility for users. This endeavor underscores the benefits of using OCaml for developing systems libraries, particularly in the context of MirageOS unikernels, which offer enhanced security, reduced complexity, and environmental benefits.