Comments (8)
- User wants to look up/add/correlate multiple identifiers for the same object (Snyk ID, v. CVE, v. other vendor ID)
- User wants to subscribe/unsubscribe from GSD notices on a particular keyword or component
- User wants to link articles/posts around breaches/exploits of a known vuln (potential auto updated from RSS filtering?) (mark links as useful not useful or dead)
from gsd-tools.
I think starting with a highly constrained scope is a good idea
from gsd-tools.
Hey everybody, I'm new to open source and dev, I've been looking for a project to support since October but nothing really jumped out at me until this one. Sorry if this isn't the place for an intro but I wanted to share my experience level and manage expectations. I'm excited about this project for two reasons, one it is still young enough I feel confident jumping in without being overwhelmed and secondly who doesn't love staying up-to-date with the most current CVEs!
I'm not sure what expertise I can lend to the project but I'm happy to help with documentation and yak shaving. If there is something specific to focus on I'm happy to dig in.
from gsd-tools.
Hi @ThatOhGi
Welcome aboard!
This isn't the best place to have a discussion. Can you subscribe to the mailing list and basically copy and paste your message there?
https://groups.google.com/a/groups.cloudsecurityalliance.org/g/gsd
I know it's scary to start a new post sometimes but I promise your mail will be most welcome!
from gsd-tools.
Since the success of the Global Security Database (GSD) is heavily based on getting user buy-in and contribution, users need to see how it can solve problems for which they donβt currently have solutions.
I think it should be clearer what current problems are initially in-scope to be solved by GSD, which from what I understand fall under the following two main categories:
- Creating new identifiers for use-cases outside the current CVE/NVD scope
- OSV Linux Kernel vulnerabilities
- Assigning identifiers to Cloud Service Providers issues (https://blog.wiz.io/security-industry-call-to-action-we-need-a-cloud-vulnerability-database/)
- Others
- Crowdsourcing enrichment or corrections to existing vulnerability data
- Correcting typos (Zabbix vs Zabbiz)
- Correcting scoring/severity issues
- Mapping vulnerability identifiers
- GSD -> CVE -> Vendor identifiers like RHSA, USN, etc
- GSD -> CVE -> Third-party vulnerability identifiers like GHSA, Snyk, VulnDB, etc
- Additional crowdsourced vulnerability data enrichment:
- Links to exploits, research, etc
This is not to suggest that I'm recommending limiting the scope, just focusing on some core use cases so that hopefully others will be encouraged to contribute and grow the community.
from gsd-tools.
Putting this link in the first place I looked: https://github.com/cloudsecurityalliance/gsd-database/blob/draft-docs/CONTRIBUTOR.md
Still working on fleshing this out in such a way that it's easy to follow and concise.
from gsd-tools.
It appears this can be done at the organization level: https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file#supported-file-types
from gsd-tools.
Ruby on Rails CONTRIBUTING.md example: https://github.com/rails/rails/blob/main/CONTRIBUTING.md
from gsd-tools.
Related Issues (20)
- Reach out to Ruby Advisory Database community about participation with GSD
- API Endpoint to request/reserve a GSD ID HOT 1
- Update gsd-web to use jsonschema validator HOT 2
- Update gsd-schema with kurtseifried/gsd-schema changes
- Link in https://github.com/cloudsecurityalliance/gsd-tools/blob/main/securitylist/README.md goes to 404 HOT 1
- schema.gsd.id Cloudflare Worker for schema $refs HOT 7
- Fix GSD Bot creating multiple affected packages instead of using multiple ranges
- Update GSD Bot to use INTRODUCED/FIX for reference types HOT 2
- Add tooltips for data.gsd.id add reference type
- Add text box for commit message when editing on data.gsd.id
- Update GSD Web to update modified at when changing a GSD
- Update Edit Button to support all OSV fields HOT 3
- GSD data normalization and format cross-compatibility/conversion
- Vulnerability Data Source Landscape HOT 1
- Update data.gsd.id show page to include all OSV values
- Create an OpenAPI v3.1 Spec for GSD API
- Create Python Interface for GSD HOT 1
- @dawiddczarnecki - counting CVE HOT 1
- Update NVD automation to use the V2 api HOT 1
- Where do kernel vulnerabilities come from ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gsd-tools.