The security scanner that cried wolf
Note: sorry if I sound harsh, but these companies are raising millions to basically add a burden to the backs of hard-working OSS authors instead of helping the ecosystem, it&#x27;s really shameless IMHO. Positive note on the end!<p>I&#x27;ve seen multiple known OSS authors speaking publicly unfavorably about these security scanners. It seems everyone is offering a &quot;solution&quot; to the vulnerability issue with Open Source, but they do it in a way that at best it&#x27;s a reminder to update your dependencies (as noted in the article) and at worst it&#x27;s a burden to OSS authors.<p>Their interests are also very misaligned with everyone else in the field; best security practices are to communicate security issues with the author privately, have you or them make a fix with a reasonable timeline and then publish a fix for everyone (or reveal the issues publicly after X days). That&#x27;d help both authors and users, but unfortunately it doesn&#x27;t help selling the security tools.<p>Instead, due to this misalignment of incentives, the current player&#x27;s workflow include bad practices like:<p>- First time someone notices a potential vulnerability they will register it in their system, and then if you are lucky you&#x27;ll get a public issue. Responsive disclosure sounds like &quot;no publicity for us so nah&quot;.<p>- Paint features as security vulnerabilities. Example: your &quot;arbitrary command execution tool&quot; can &quot;execute arbitrary commands&quot; or &quot;your JSON reading tool can read JSON&quot;. Well, thanks, that&#x27;s totally useless.<p>- Tell users that your dev libraries, that never end up in production, have critical vulnerabilities. Sure if my CSS compilation tool has one it won&#x27;t matter since it doesn&#x27;t end up in the production server (unless it&#x27;s a vuln. in the output).<p>Edit: for a positive note, these are the current champions IMHO that <i>are</i> helping the ecosystem in this field (besides authors themselves ofc):<p>- Github&#x27;s free Actions for OSS. This has been amazingly helpful for testing for free and easily, and basically my turning point on believing that Microsoft has evolved for the better.<p>- Hundreds or thousands of volunteer fellow OSS authors disclosing vulnerabilities privately. They are mostly anonymous, but def a huge force.<p>- Companies releasing open source, since they are in a better position to offer big well-rounded libraries that reduce your dependency graph.