Comments (6)
The GSD supports namespaces, so if you want to chuck everything into the "inthewild.io": {} namespace that is easiest, our data is licensed CC0 1.0 Universal so I'm not sure how that intersects with the Apache 2 that you use, effectively by submitting you'd have to allow the license to be CC0 1.0 Universal for us to republish it (I don't want to start "sublicensing" or whatever the term would be for the different namespaces/data).
As far as starting out do you want to do some test PR's so we can see what the data looks like, and figure out how to best automated this?
from gsd-tools.
Hey @kurtseifried what should I do the PR against, where to add this?
Probably this format would be the easiest. https://inthewild.io/api/exploited
On the other hand I'm not sure what information you think should belong here: just a yes/no with a reference?
from gsd-tools.
I would say the more data the better, e.g. having the times, and then the link to your site (e.g. https://inthewild.io/vuln/CVE-2020-28949) would be good, basically the more structured data you can send us the better, we are also in the process of having a schema validator that will ensure namespaces that support a schema (e.g. nvd.nist.gov uses the NVD schema for their data) so if you have a schema for your data we can also ensure it is correct on submission.
As far as how to get the data in we're doing PR's for now but longer term we will be doing an API for both read and write.
from gsd-tools.
where should we add data specifically?
from gsd-tools.
So we map GSD to CVE #'s 1:1, e.g. CVE-2020-28949 is GSD-2020-28949, this makes it really easy to find/update/etc. so https://github.com/cloudsecurityalliance/gsd-database/blob/main/2020/28xxx/GSD-2020-28949.json
As for where in the file we support namespacing, so your data would look like adding the following keys:
{
"namespaces": {
"inthewild.io": {
"id": "CVE-2020-28949",
"earliestReport": "2022-08-25T00:00:00.000Z",
"references": [
"https://inthewild.io/vuln/CVE-2020-28949"
]
}
}
}
so your data, a link to the reference for more info/source/etc.
from gsd-tools.
I've added this to the landscape document in #203.
@gmatuz, if you'd still like help with this, let me know. As mentioned by @kurtseifried, it would be fairly simple to add your data under a namespace using whatever scripting language of your choosing. We're also working on an API as well.
Closing out for now.
from gsd-tools.
Related Issues (20)
- Reach out to Ruby Advisory Database community about participation with GSD
- API Endpoint to request/reserve a GSD ID HOT 1
- Update gsd-web to use jsonschema validator HOT 2
- Update gsd-schema with kurtseifried/gsd-schema changes
- Link in https://github.com/cloudsecurityalliance/gsd-tools/blob/main/securitylist/README.md goes to 404 HOT 1
- schema.gsd.id Cloudflare Worker for schema $refs HOT 7
- Fix GSD Bot creating multiple affected packages instead of using multiple ranges
- Update GSD Bot to use INTRODUCED/FIX for reference types HOT 2
- Add tooltips for data.gsd.id add reference type
- Add text box for commit message when editing on data.gsd.id
- Update GSD Web to update modified at when changing a GSD
- Update Edit Button to support all OSV fields HOT 3
- GSD data normalization and format cross-compatibility/conversion
- Vulnerability Data Source Landscape HOT 1
- Update data.gsd.id show page to include all OSV values
- Create an OpenAPI v3.1 Spec for GSD API
- Create Python Interface for GSD HOT 1
- @dawiddczarnecki - counting CVE HOT 1
- Update NVD automation to use the V2 api HOT 1
- Where do kernel vulnerabilities come from ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gsd-tools.