5

We teach an online course and would like to issue takedown notices if source code for our projects are made publicly available.

Is there a way to automate a periodic online search for any code that matches files that we have saved on disk? Currently we use Google Alerts and manually feed in keywords, but this is too noisy, and we need to manually feed in results to be ignored once a match is found (using -site:url-of-found-results). Eventually, we end up with long unwieldy search strings.

Ideally, when we add code to our "protected source list", the solution would find "unique identifiers" which currently don't exist on the Internet, and only search for those identifiers, triggering when found.

If found, an alert should be triggered. We would like to mark results as seen, or false positive so that we don't get repeated alerts.

  • 4
    Not to recommend a product, but take a look at Netflix's Scumblr. – multithr3at3d Aug 4 '16 at 15:02
  • Thanks @korockinout13. Not looking for a product; trying to find a list of steps that can help me monitor my code, without leaking it. Scumblr is interesting though, and might fit the bill. Someone (I believe it was George Bailey) had posted a useful answer, which is now missing... – Jedi Aug 4 '16 at 23:22
  • 1
    You can search code on Github. Give a property or a function a really unique name with no relation to your company or project and it is really easy to search up. – Bacon Brad Aug 5 '16 at 17:23
  • Netflix Scumblr is not that bad of an option actually. It is open source and on github: github.com/Netflix/Scumblr – Chad Baxter Oct 6 '16 at 13:09
1

That's one of the InfoSec / IT Sec issues currently a bit overlooked just like machine code / source code analysis for vulnerabilities and it's quite similar problem.

Basically you can approach problem with two ways: - Index and search for the same binary code - Index and search for the same source code

Now the problem is that there isn't really search for the source code which could compile and look for same binary code with the same execution sequence.

This is because it's a bit advanced subject, actually, it's the final subject which will allow for automated audits, debugging and so on. As Elon Musk said himself, that it would eventually lead to the rise of Skynet.

There are some search engines for the code but simply by changing labels in source code you can defeat them.

  • Elon Musk? Skynet? No. – alzee Aug 5 '16 at 13:49
  • 1
    :-) :-) That was a joke. Elon Musk says this and that. – Aria Aug 5 '16 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.