More than 75% of all vulnerabilities reside in indirect dependencies:
The vast majority of security vulnerabilities in open-source projects reside in indirect dependencies rather than directly and first-hand loaded components.
"Aggregating the numbers from all ecosystems, we found more than three times as many vulnerabilities in indirect dependencies than we did direct dependencies," Alyssa Miller, Application Security Advocate at Snyk, told ZDNet in an interview discussing Snyk's State of Open Source Security for 2020 study.
The report looked at how vulnerabilities impacted the JavaScript (npm), Ruby (RubyGems), Java (MavenCentral), PHP (Packagist), and Python (PyPI) ecosystems.
Snyk said that 86% of the JavaScript security bugs, 81% of the Ruby bugs, and 74% of the Java ones impacted libraries that were dependencies of the primary components loaded inside a project.
[...] Snyk argues that companies scanning their primary dependencies for security issues without exploring their full dependency tree multiple levels down would release or end up running products that were vulnerable to unforeseen bugs.
So dear Soylentils, how do you track vulnerabilities in libraries that you use in your projects and do you scan beyond direct dependencies?
Previously:
(2020-05-16) Nine in Ten Biz Applications Harbor Out-of-Date, Unsupported, Insecure Open-Source Code, Study Shows
(Score: 2) by RS3 on Friday July 03 2020, @06:40PM (2 children)
All good points. I broke the rules and read TFA, and my comments in this discussion, and maybe bradley13's too, are in context of the problem areas:
ftfa:
I don't think TFA refers to drivers, or really anything else written in c or compiled languages, stdio, etc. They mentioned php and Python as having some of the problem, but very low percentage so far.
Oddly, they made no mention of perl... :)
(Score: 3, Insightful) by The Mighty Buzzard on Saturday July 04 2020, @04:20AM (1 child)
That's because Perl guys are all old and wise enough to spot someone spouting ideology instead of good sense. There are plenty of libraries that I use on a regular basis simply because I'm not willing to spend twice as long coding a single library as I do coding the core application. There's just no way I'm writing an entire IRC library from scratch every time I decide to rewrite my bot MrPlow in a new language to (re)familiarize myself with it. It's not conscientious, it's bloody stupid.
My rights don't end where your fear begins.
(Score: 0) by Anonymous Coward on Saturday July 04 2020, @07:23AM
One thing Perl has is thousands of insecure libraries that no one really looks at. But they also have thousands of secure packages that are well-vetted and well-used. Instead of a fractured NIH-RTW ecology, there are a good number of modules on CPAN and elsewhere that are a de facto standard library. Everyone uses them for a particular problem, they are simultaneously stable and maintained, and professionals of various beard length watch over them rather than rolling their own.