web-security 2021-11-17

Have you looked into it yet? I saw this in passing, but haven’t had time to look properly at it.

Seems to me that it would need some more rules to be super useful

Also, I guess a security product that encourages you to

sudo curl -L  -o /usr/local/bin/clj-holmes

makes me a bit uneasy.

đź‘€ 1

i hadn't looked in any detail yet, no!

I looked at the rules, nothing revolutionary, but it does catch using clojure/read-string and some other stuff. I guess the meat of the work would be in defining the rules, much as with kibitz in that respect.

Also, the prebuilt binary was only for linux, so I didn’t get to run the thingy.

as hinted in the #announcements thread, a couple of the rules seemed a good fit for Eastwood :) might give it a shot at some point