January 2017 Summaries

Here's a 1-paragraph summary of the text: The process of disclosing security vulnerabilities is a complex and debated topic in the security industry. The goal is to minimize the window of exposure, which refers to the time period during which a vulnerability can be exploited by attackers. There are different approaches to disclosure, including reporting vulnerabilities to organizations privately and waiting for them to fix the issue before making it public, full public disclosure where vulnerabilities are disclosed immediately without warning, and responsible disclosure, which involves private disclosure followed by public disclosure within a reasonable time limit. A responsible disclosure process provides a balance between giving organizations a head start to address vulnerabilities and protecting users from potential harm, and is considered an ethical approach in the security industry.

Pkgbot is a command-line tool that was initially developed by Karen Yavine and Alon Niv for the Snyk Security Team to help research vulnerabilities in package repositories. Pkgbot uses APIs such as npm and RubyGems to collect information about packages, including their downloads and vulnerabilities. The tool has since been open-sourced and is now available for anyone to use and contribute to. With its ability to provide detailed information about packages, Pkgbot aims to make vulnerability research more efficient and accessible.

Snyk has updated its CLI to require authentication for testing applications, a change aimed at preventing abuse and improving user experience. The new requirement is necessary due to the growing use of Snyk's service, which has led to occasional massive bursts of tests that can overload the system. By authenticating users, Snyk aims to block or throttle abusive users and provide better support for its growing user base. The change also allows Snyk to communicate new features and capabilities more effectively with its users. However, applying patches using `snyk protect` will remain anonymous, as it is a separate process that doesn't require authentication.