Sonar Blog
blog.sonarsource.com · Company blog · on HN since 2017
Sonar's security research blog, which discloses vulnerabilities in open source software and analyzes developer tooling and package manager flaws.
What HN saysHN links it as the source for vulnerability disclosures such as Zabbix session storage, RainLoop XSS, and Git integration risks.
20HN people shared it
3linked it in comments
27stories submitted
91story points
4 years agolast shared
2017people per year2026
Most-shared posts
- 1Zabbix – A Case Study of Unsafe Session Storage3 people · 45 points · first shared 2022 · 13 comments on HN
- 2Securing Developer Tools: Git Integrations3 people · 4 points · first shared 2022 · discussion on HN
- 3Unknown Security Pitfalls for Python (2021)2 people · 7 points · first shared 2022 · discussion on HN
- 4Horde Webmail 5.2.22 – Account Takeover via Email2 people · 4 points · first shared 2022 · discussion on HN
- 5Yarn, Pip, Composer and co: Vulnerabilities in popular package managers2 people · 3 points · first shared 2022 · discussion on HN
- 6Code Security Advent Calendar 20202 people · 3 points · first shared 2020 · discussion on HN
- 7Supply Chain Attack on Composer1 people · 4 points · first shared 2021 · 2 comments on HN
- 8Disclosing information with a side-channel in Django1 people · 3 points · first shared 2022 · discussion on HN
- 9For secure code, maintainability matters1 people · 2 points · first shared 2020 · discussion on HN
- 10Code security: now there's a tool for developers1 people · 2 points · first shared 2020 · discussion on HN
- 11False positives are our enemies, but may still be your friends1 people · 2 points · first shared 2020 · discussion on HN
- 12Securing Developer Tools: Argument Injection in Visual Studio Code1 people · 2 points · first shared 2022 · discussion on HN
- 13Getting timely, accurate feedback on your C++ from the SonarQube ecosystem1 people · 2 points · first shared 2020 · discussion on HN
- 14Cognitive Complexity, Because Testability = Understandability1 people · 1 points · first shared 2017 · discussion on HN
- 15Sonarsource, detect C++ buffer overflows in Posix functions1 people · 1 points · first shared 2020 · discussion on HN
What HN people wrote when they linked it
m4lvin · 2022-05-04
Related: RainLoop (of which SnappyMail is a fork) seems to be no longer developed and has a known stored XSS problem: https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw/
SnappyMail is not affected by this and seems to be the successor.
jwilk · 2022-04-13
Related: https://blog.sonarsource.com/securing-developer-tools-git-integrations… ("Securing Developer Tools: Git Integrations")
gnabgib · 2022-02-18
Source/Origin article (linked in the "Patch now" section): "Zabbix - A Case Study of Unsafe Session Storage"[0]
[0]: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-stora…