Dyaz17
Joined 11 years ago
Karma
32
Submissions
29
Member since
Dec 2
Recent submissions
Comment · 5 years ago
This is just awesome... Congrats on the launch. This product seems to protect really well websites that include many third party JavaScript. On the other hand ,if you are one of the third party offering the JS, I would advise you to implement Subressource integrity. Or, if not possible to monitor constantly any modifications made to your JS file. I developped a service that does that and there is a free plan : https://www.guardscript.com/
Comment · 6 years ago
Regarding the security aspect, I created GuardScript to help catch malicious 3rd party (or 1st party) javascript changes: https://www.guardscript.com/ .
You should use if you own a SaaS service that require your clients to include your Javascript library in their page, and when you can't use Subresource Integrity.
Comment · 6 years ago
You can login to your instances from the admin console according to this : https://cloud.google.com/compute/docs/instances/connecting-t...
So Google has a way to login to your instances...
Comment · 6 years ago
What is the attack Vector that this solution prevent ?
Am I missing something obvious ?
Will it prevent Google from being able to have a Root access to the VM?
From my understanding it does not seem to protect from Google. If they are still able to have a Root Access to the VM it does not matter if the memory is encrypted or not.
The only thing that I see, is in case of a spectre/meltdown vulnerabilty where the isolation of the RAM fails...
Comment · 6 years ago
Great job.
Here is what I propose to make it more secure and prevent you from being able to read anyone diary...
I propose that each day a link/token is sent to your email. The link then ask for a password that is handled only with client side javascript and does the encryption of the data before sending it do the server. Look at what Blockhain.info or myetherwallet is doing for client side encryption. Maybe also propose provide all the front end as opensource and provide a way for people to host their own front (a few HTML, JS files where you input the link or token sent to you by email...)
Comment · 7 years ago
You can also use https://www.guardscript.com that does this for free and send you a diff in your email.
Comment · 7 years ago
Nice product! And thank you for making it opensource.
Any particular reason why you chose Ruby?
A little plug : I have developed https://www.guardscript.com. It is a service that detect any modification made to static files hosted on your website. The goal is to detect any unwanted modification and revert them as soon as possible.
Comment · 7 years ago
You are right, for now all the analysis should be done by the owner of the script. I'll think about adding a runbook...
Comment · 7 years ago
Thank you, I have corrected it
Comment · 7 years ago
Thanks for the suggestion.