Meterian “Life and Hacks of Open Source” Prize Draw

Following yesterday’s event at IDEALondon over in Shoreditch, London, we’re pleased to announce the launch of our new website scanner and prize draw.

Draw Period: July 10 – July 17, 2019

Prize: A bundle consisting of £100 Amazon.co.uk eGift Voucher, a 1-hour in-person consultation with Meterian, 10% lifetime discount to Meterian cloud-based annual subscription product from Startup, Bootstrap, and Enterprise plans.

Eligibility Criteria: Prize Draw entrants must register their email and contact information on Meterian’s website at https://www.meterian.io/webscanner.html during the Draw Period. Only 1 winner will be selected.

Read on for detailed terms.  Happy scanning!

Meterian “Life and Hacks of Open Source” Prize Draw Terms

  1. We shall specify the opening and closing dates of each prize draw (“Draw Period”).  
  2. There will be one winner per Draw Period who will win a prize for registering on Meterian’s website at https://www.meterian.io/webscanner.html during the Draw Period. We reserve the right to reclaim any prize where a participant makes false claims to identity and affiliation with the company they register on the website.
  3. The prize is a bundle consisting of £100 Amazon.co.uk eGift Voucher, a 1-hour in-person consultation with Meterian, 10% lifetime discount to Meterian’s cloud-based annual subscription product from Startup, Bootstrap, and Enterprise plans.
  4. Prizes will be awarded to entries picked at random by computer or an independent person within 7 working days after the closing date. Each winner will be contacted by telephone, post or email within 21 days of the Prize Draw closing, and be sent their prize by post no later than 90 days after the Prize Draw Date. If a winner for a Prize Draw cannot be contacted using reasonable efforts within 10 days from the Prize Draw date for that Draw Period, then an alternative winner will be drawn from the entries for that Draw Period.
  5. There is no cash alternative to the prize. We reserve the right to award an alternative prize of equal or greater value, should the advertised prize or any part of it become unavailable. The result of the Prize Draw is final. No correspondence will be entered into. The name and county of each winner will be available on request by sending a stamp addressed envelope to Customer Service, Meterian Ltd., 196 Freston Road, London W10 6TT, United Kingdom and may be posted online.
  6. Each winner may be required to participate in reasonable press or PR activity related to the prize draw as notified by Meterian Ltd.  
  7. We reserve the right to cancel or amend the prize draw or these rules at any time without prior notice, with no liability to any entrants.
  8. We can accept no responsibility for entries which fail to be properly submitted for any technical reason whatsoever, and we will reject entries submitted by any other means.
  9. Additional terms:
    1. Each winner must be a UK resident.
    2. The prizes are as stated, not redeemable for cash or other products and are not transferable. Each prize can only be claimed by the winner.
    3. If the prize package is not claimed by 90 days after the prize draw, the prize will be forfeited.
    4. We endeavour to run the competition as stipulated, including the closing date of 11:59pm on last date of Draw Period.
    5. The winners will be communicated via the email used to submit their entry shortly after the completion closing date.
    6. Acceptance of these terms and conditions is a condition of entry and the entry instructions form part of these terms and conditions. By entering into the competition, you agree to be bound by these terms and conditions.
    7. The Promoter (Meterian) reserves the right, at its sole discretion, to exclude you from the competition if you do not comply with these terms and conditions.
    8. Internet or Wi-Fi access is required.
    9. If unable to physically attend the consultation, then the consultation will be conducted via Skype and will only be 1 hour long.
    10. No purchase necessary.
    11. The Promoter’s decision will be final and binding and no correspondence will be entered into.
    12. The Promoter reserves the right to change, alter or withdraw the competition at any time.
    13. This Competition is in no way sponsored, endorsed or administered by, or associated with, Twitter, Facebook, Instagram, LinkedIn or any UK registered charity.
  10. If any of these terms and conditions are found to be void or unenforceable, that term shall be deemed to be deleted and the remaining terms and conditions shall continue in full force and effect.
  11. These terms and conditions shall be governed and construed in accordance with the laws of England and Wales. Any dispute arising is subject to the non-exclusive jurisdiction of the courts of England and Wales.
Meterian “Life and Hacks of Open Source” Prize Draw

What do we mean by “stability”?

When you open one of our reports you will see three different sections. At the top you will find our security section, that will tell you whether any of your components is potentially exposing your system to hacking due to known vulnerabilities. At the bottom, you will find our licensing section, that will tell you if any of your components are using a non-business friendly license. But what about the middle section, stability?

This is a concept which we’ve been working on for a while, and now it’s in its early stages. At the moment, in regards to a component, it’s basically an indication of how up to date it is. The stability report will provide you also with an upgrade path to any component your software is directly using, giving you the knowledge to move forward to the next version if you choose to. But is this advisable? Well, in general, yes, mainly because a new version usually includes bug fixes for issues you are not even aware of, performance enhancements and, of course, vulnerability fixes.

But should you always upgrade? And to the latest version? Well, the decision to upgrade has to be evaluated by the development team. For platforms using semantic versioning (the mast majority on the planet these days), it’s usually considered safe to upgrade in certain conditions, but let’s pause for a moment to understand how this works.

A semantic version number is usually in the format MAJOR.MINOR.PATCH and each part can be independently incremented against the previous when:

  • MAJOR: an incompatible API change has been implemented
  • MINOR: a new functionality has been implemented but it’s backwards compatible
  • PATCH: backward compatible bug fixes have been implemented

So for example version 2.5.3 means major 2, minor 5, patch 3. Following on the previous explanation. 2.5.4 is a patch release, 2.6.1 is a minor release and 3.0.0 is a major release.

We need to appreciate that these are all conventions, and may be overlooked sometimes! Some platforms have a more “creative” ways to think about minor releases, and that’s the reason we usually suggest that only a patch upgrade is safe. Even in that situation, you should always have your test automation, CI, and QA team to validate your release.

Is that all for stability? Well, for the time being, yes, but please stay tuned as we do have something else cooking in the area!

 

What do we mean by “stability”?

How the wrong license can harm your business

legaldoc

 

Friendly disclaimer.

First and foremost, let me immediately start saying that this article is not legal advice, but it’s my attempt to explain in a simple way the problems connected to software licensing: in case of emergency, call a lawyer 🙂

The problem.

Many people think that because you can download a piece of software without paying a fee it means that such software is free. But if something is freely available, it does not mean that the same thing is free to use. Some development teams have the expectation that, when including a software component in their own customised system, it simply becomes “part of it” inheriting their licensing model: this is simply not true.

Imagine, for example, that you are building a new revolutionary car, all electric, and self-driving! You will need a lot of software to make that happen, and certainly, you do not want to code everything from scratch. So you start first assembling some basic components, an operating system (Linux), some basic tools (BusyBox), some software from other vendors and then you finally write your magic code. Sounds familiar? Anybody said “Tesla” in the audience? And what happens when a competitor discovers that you are using open source software with a certain license (GPL) and asks you to provide them with your code, the valuable code you wrote… well, they can lawfully do so and you will have to comply! And so that’s what happened, and forced Tesla to start releasing its software on public repositories. But please, without leaving the car making business, see also BMW who handed over its i3 car code to a random guy, who immediately published it on GitHub.

The restrictions.

It’s important to understand the restrictions you face when you decide to use an opensource component. Even one single component with the wrong license can impose a restriction on all your source code.

  1. you may be forced to release your code under the same license. If you use a component licensed for example under GPL or AGPL (or even LGPL in case of derivative work), all your software will have to be released with the same license.
  2. you may be forced to release to the public your source code. If you use a component licensed for example under MPL or GPL, you will have to provide all your code in a human-readable format upon request (distribution of obfuscated code is not compliant).
  3. you may not be allowed to distribute your software commercially. Licenses like the Oracle BCLA will prevent that, and you can easily be sued (and you will most certainly lose).

But wait, what about the code that does not have any license? For sure I can use it without problems, right? And the answer is again a resounding no! Under current law, copyright extends for the life of the author plus 70 years (and sometimes 120 years after its creation), and the creator (or his/her dynasty) can simply sue you for using it. Unless a piece of code includes a license, do not use it.

The risks.

If you decide to not comply with a license, or you are simply unaware of the problem (this would be the most common case) you face two main risks.

First, you are in actual violation of contractual obligations. This can lead to a long case in court that, if you are lucky, you settle outside court, with money transferred. There are a lot of examples of that, with payments that go up to $100K (please see an incomplete list here), so I really think you should not discount this risk, also because in some cases, firms preferred to file for bankruptcy in order to avoid bigger losses.

Second, you may be in violation of statutory law, a corporate liability that may become also a personal liability. Corporate Criminal Responsibility derived from copyright crimes can also be extended to labour law, in case it can be demonstrated that the responsible was not carrying out his duties properly.

Solutions.

First and foremost you need to be aware of the problem. If you read this article until this point, you now probably are, so we can safely assume you are onboard with this point.

Now, assuming your company is building software, you need to make sure that all components your development team is using, and end up being part of the final product, are accounted for in terms of licensing. Remember: one single component in your chain can influence the whole system.

You will need then to create policies to allow/disallow certain licenses to be used and enforce them across your development teams. The best solution would be an automated one, which automatically detects violations and blocks unwanted releases.

Meterian to the rescue!

Meterian, among others, provides an elegant mitigation for this problem, which is also affordable and efficient. By placing Meterian in your development pipeline you can have continuous reporting about the licenses used by your software so that you can make sure you are not exposed to the risks explained before. Please have a look at one of our reports.

When Meterian is included in your development pipeline, policies can also be enforced so that the presence of certain licenses will stop the build to progress further, preventing the product to be shipped to the final customers.

Make sure to get in touch if you want to learn more!

How the wrong license can harm your business

Time to update your boots!

Bootstrap v4.3.1 and v3.4.1 are out and available to patch an XSS vulnerability, CVE-2019-8331. For any users of the legacy 3.3.7, this will fix also other three XSS issues, namely CVE-2018-14040CVE-2018-14041 and CVE-2018-14042. Bootstrap now include a JavaScript sanitizer that will only allow whitelisted HTML elements in the data attribute of an element.

It’s available through all the channels: as NPM package, via CDNs and for old fashioned guys also as a direct download from Github. You do not have any excuses now, please upgrade!

 

Time to update your boots!

The problem with opensource components

construction

While opensource components are basically indispensable in modern software development, they also must be handled with care. In this post, I will explain in the simplest possible way the problem with opensource components: I am going to use a metaphor that seems to resonate well with our customers, which however may not be necessarily accurate from an engineering point of view.

Building a house.

When you build a house a lot of work has to be done, starting from the planning all down to the actual building of the foundation, infrastructure, walls, ceilings, and roof. This work is different for every house and very specific so that it’s necessary to have a very solid process to make sure the standards of quality are high enough from a variety of point of views. There’s an enormous amount of attention on every aspect and it’s always supported by a strict set of practices and processes.

Now, when you build a house, there are a lot of things you do not necessarily want to create from scratch: items like windows and doors, for example, are components readily available on the market in a variety of shapes and sizes. You do not need to build them from scratch: that would require specific craftsmen and a sizeable amount of time. You simply shop for those components, find the right ones and integrate them into your house.

As we are a security company, let’s focus on security for a moment. Your team built the walls and the infrastructure, right? With a very strict process that guarantees you that everything is solid, unbreakable and durable. But what about windows and doors? You bought those components off the shelf: what do you know about their quality? Are the locks durable? Are the glasses really break proof or are they affected by some design flaw? How much of your house did you have to buy from other manufacturers? And how long ago was it? What’s the warranty, and did you stay warm this winter or were the windows drafty?

This is the problem with opensource components.

Building a software application.

In a modern development process, your development team is “building the house”: writing the code that contains the business logic of your application. They also need a lot of other code to do various ordinary tasks, like talking to a database, exposing an API, talking to other services, exchanging data using a machine-readable format like JSON or XML. The opensource community has already available off the shelf components you simply incorporate in the project, saving huge amounts of money and dramatically shortening the time to market: those are the “windows” and “doors”. Worse than in a building, however, off the shelf software components can be up to the 80% of the code shipped to production, making them a very critical asset to keep under control.

What we are finding when we meet potential customers is that they have a very strict process with regards to their code, often supported by a variety of tools in order to make sure that the business logic code is solid and secure. The same attention, however, is not extended to the opensource components used, which are simply bundled with the code shipped to production.

The opensource components are like the “doors” and the “windows” of your “house”: are they secure? Every day an average of 40 new vulnerabilities are discovered in external components, and new versions of those are often released monthly. It’s critical to keep the components used in your applications up to date and replace them immediately, to avoid something like what happened to Equifax, that simply did not update a vulnerable software component, Apache Struts.

graph-2(source: vulndb)

Do you know how much of your base is opensource? Do you know when you updated it last? And do you know every noteworthy detail of the updates from those external components?

What can you do?

Our software, Meterian, does exactly that job. It will continuously check the opensource components used by your business logic so that you will not have any nasty surprises because of them. It takes 5 minutes to set it up in your process, and you can also simply run it on your codebase with no installation at all. You do not need to be a developer to run it and it produces also a clear report that is understandable and actionable right away.

We strongly encourage you to give it a try, or maybe just have a look at our reports for some common libraries like Alibaba/FastJson or Netflix/Zuul, both scoring a resounding 0 in security at the time of writing.

Keep your house safe, keep all external components under control.

The problem with opensource components

Meet Meterian at the next Gerrit summit

gerritsummit

Meterian is happy to announce that it will be presenting at the next Gerrit summit in Paolo Alto, California, an innovative Jenkins based solution to ship software without vulnerabilities using Gerrit Code Review and Robot Comments.

What if fixing vulnerable components was something that can be completely automated? And what if it could fit nicely in the amazing review process used by Gerrit, leaving to the humans just the burden of the last click?

Well, we think that with Robot Comments now this is possible! Join us on Friday in the Cloudera Galactic HQ and see how!

Meet Meterian at the next Gerrit summit

New vulnerabilities in jackson-databind

The jackson-databind saga continues and today 4 new vulnerabilities have made their way into the NVD database. Still not “officially” confirmed, they are there to stay, as you can probably guess looking at the project bug report:

  • CVE-2018-14718: remote code execution via slf4j-ext
  • CVE-2018-14719: remote code execution via blaze-ds-opt
  • CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions)
  • CVE-2018-14721: exfiltration/SSRF with axis2-jaxws

Things are becoming quite tricky as the project is trying to keep up with four different main codebases (2.6.x, 2.7.x, 2.8.x, 2.9.x) plus the new development in progress. This is all about the ability to use the deserialisation mechanism of Jackson in order to perform mischiefs using, in a very creative way, some standard classes (see an example exploit documented a while ago on my personal blog) and all due to a blacklisting mechanism that continues to require updates.

You can also read a full account of the problem here, but for the time being, I would suggest using Gson instead, at least until a 3.x version of Jackson is out.

New vulnerabilities in jackson-databind