document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2025-01-25 23:11:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6439 from geekpi/master

Browse Source 
translated
This commit is contained in:
geekpi 2017-12-04 10:39:50 +08:00 committed by GitHub
commit 37942afd73
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 48 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
sources/tech/20171116 Introducing security alerts on GitHub.md
View File

@ -1,50 +0,0 @@
translating---geekpi
Introducing security alerts on GitHub
====================================
Last month, we made it easier for you to keep track of the projects your code depends on with the dependency graph, currently supported in Javascript and Ruby. Today, for the over 75 percent of GitHub projects that have dependencies, we’re helping you do more than see those important projects. With your dependency graph enabled, we’ll now notify you when we detect a vulnerability in one of your dependencies and suggest known fixes from the GitHub community.
[![Security Alerts & Suggested Fix](https://user-images.githubusercontent.com/594029/32851987-76c36e4a-c9eb-11e7-98fc-feb39fddaadb.gif)][1]
### How to start using security alerts
Whether your projects are private or public, security alerts get vital vulnerability information to the right people on your team.
Enable your dependency graph
Public repositories will automatically have your dependency graph and security alerts enabled. For private repositories, you’ll need to opt in to security alerts in your repository settings or by allowing access in the Dependency graph section of your repository’s Insights tab.
Set notification preferences
When your dependency graph is enabled, admins will receive security alerts by default. Admins can also add teams or individuals as recipients for security alerts in the dependency graph settings.
Respond to alerts
When we notify you about a potential vulnerability, we’ll highlight any dependencies that we recommend updating. If a known safe version exists, we’ll select one using machine learning and publicly available data, and include it in our suggestion.
### Vulnerability coverage
Vulnerabilities that have [CVE IDs][2] (publicly disclosed vulnerabilities from the [National Vulnerability Database][3]) will be included in security alerts. However, not all vulnerabilities have CVE IDs—even many publicly disclosed vulnerabilities don't have them. We'll continue to get better at identifying vulnerabilities as our security data grows. For more help managing security issues, check out our [security partners in the GitHub Marketplace][4].
This is the next step in using the world’s largest collection of open source data to help you keep code safer and do your best work. The dependency graph and security alerts currently support Javascript and Ruby—with Python support coming in 2018.
[Learn more about security alerts][5]
--------------------------------------------------------------------------------
via: https://github.com/blog/2470-introducing-security-alerts-on-github
作者：[mijuhan ][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:https://github.com/mijuhan
[1]:https://user-images.githubusercontent.com/594029/32851987-76c36e4a-c9eb-11e7-98fc-feb39fddaadb.gif
[2]:https://cve.mitre.org/
[3]:https://nvd.nist.gov/
[4]:https://github.com/marketplace/category/security
[5]:https://help.github.com/articles/about-security-alerts-for-vulnerable-dependencies/

48
translated/tech/20171116 Introducing security alerts on GitHub.md Normal file
View File

@ -0,0 +1,48 @@
介绍 GitHub 上的安全警报
====================================
上个月，我们用依赖关系图让你更容易跟踪你代码依赖的的项目，目前支持 Javascript 和 Ruby。如今，超过 75％ 的 GitHub 项目有依赖，我们正在帮助你做更多的事情，而不只是关注那些重要的项目。在启用依赖关系图后，当我们检测到你的依赖中有漏洞或者来自 Github 社区中建议的已知修复时通知你。
[![Security Alerts & Suggested Fix](https://user-images.githubusercontent.com/594029/32851987-76c36e4a-c9eb-11e7-98fc-feb39fddaadb.gif)][1]
### 如何开始使用安全警报
无论你的项目时私有还是公有的，安全警报都会为团队中的正确人员提供重要的漏洞信息。
启用你的依赖图
公开仓库将自动启用依赖关系图和安全警报。对于私人仓库，你需要在仓库设置中添加安全警报，或者在 “Insights” 选项卡中允许访问仓库的 “依赖关系图” 部分。
设置通知选项
启用依赖关系图后，管理员将默认收到安全警报。管理员还可以在依赖关系图设置中将团队或个人添加为安全警报的收件人。
警报响应
当我们通知你潜在的漏洞时，我们将突出显示我们建议更新的任何依赖关系。如果存在已知的安全版本，我们将使用机器学习和公开数据中选择一个，并将其包含在我们的建议中。
### 漏洞覆盖率
有 [CVE ID][2]（公开披露的[国家漏洞数据库][3]中的漏洞）的漏洞将包含在安全警报中。但是，并非所有漏洞都有 CVE ID，甚至许多公开披露的漏洞也没有。随着安全数据的增长，我们将继续更好地识别漏洞。如需更多帮助来管理安全问题，请查看我们的[ GitHub Marketplace 中的安全合作伙伴][4]。
这是使用世界上最大的开源数据集的下一步，可以帮助你保持代码安全并做到最好。依赖关系图和安全警报目前支持 JavaScript 和 Ruby，并将在 2018 年提供 Python 支持。
[了解更多关于安全警报][5]
--------------------------------------------------------------------------------
via: https://github.com/blog/2470-introducing-security-alerts-on-github
作者：[mijuhan ][a]
译者：[geekpi](https://github.com/geekpi)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:https://github.com/mijuhan
[1]:https://user-images.githubusercontent.com/594029/32851987-76c36e4a-c9eb-11e7-98fc-feb39fddaadb.gif
[2]:https://cve.mitre.org/
[3]:https://nvd.nist.gov/
[4]:https://github.com/marketplace/category/security
[5]:https://help.github.com/articles/about-security-alerts-for-vulnerable-dependencies/