Snyk Blog

Snyk | https://snyk.io/ | Software Engineer, Senior Software Engineer, Engineering Manager | Full Time | Boston, MA or London, UK | Onsite / Hybrid

About Snyk: Every day, the world gets more digital thanks to tens of millions of developers building the future faster than ever. But with exponential growth comes exponential risk, as outnumbered security teams struggle to secure mountains of code. This is where Snyk (pronounced “sneak”) comes in. Snyk is a developer security platform that makes it easy for development teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and cloud infrastructure — and do it all right from the start. Snyk is on a mission to make the world a more secure place by empowering developers to develop fast and stay secure.

As an Engineer at Snyk, you'll be at the forefront of building the future of application security. You’ll be challenged to create high-performance, reliable, and scalable services while collaborating closely with cross-functional teams. We’re looking for individuals who are passionate about crafting exceptional software, solving complex problems, and driving innovation.

As a part of our Developer Experience team you’ll have the opportunity to work on a wide range of projects, from mastering existing services to building new, cutting-edge features. Your contributions will directly impact the success of our product and the security of millions of developers worldwide.

You can find this and…

There's literally a web site of Kubernetes failure stories: https://k8s.af/ where people experienced in Kubernetes have shot themselves in the foot.

To be fair, it's over a year old, and probably the state of the art and best practices have advanced to the point where many of these are unlikely to happen. But in general, Kubernetes is widely considered a very big complex thing full of footguns for the unwary for a reason.

So while I agree with you that sure, you can get up and running by watching some videos and copy-pasting a few YAML files, the problem is when you are deep into critical production and you run into issues (the classic "I get woken up at 3am by an alert or my boss and we need to fix this in 10 minutes") and you lack the deeper understanding of the framework to even know where to start.

Or even worse, you insert an insidious security issue through a misconfiguration and you are not even aware you have been owned. Security is notoriously difficult to get right, even for people with experience in frameworks and systems, let alone a newbie. Kubernetes is not "secure by default" and again, there are footguns for the unwary:

https://snyk.io/learn/kubernetes-security/

None of these things make Kubernetes bad, per se, and I'm sure the benefits outweigh the costs. But personally I would be cautious about adopting it for serious production without having some solid real-world experience first.

This made me curious what type of vulnerabilities were in something like Lodash and the answer was mostly prototype overwriting:

https://snyk.io/vuln/npm:lodash

It’s nice to see the Snyk project contributing patches back into major open source projects, not just highlighting them. Even if the threat model is relatively mild for an average dev like myself working in a controlled environment, despite the fact the vuln gets marked as severe (don’t get me wrong, it is still important for the larger OSS projects that are widely deployed to a variety of environments like lodash).

I’ve become far more careful updating JS libraries as most frontend projects have thousands in their package.json and I’ve had countless deployment issues getting ground down once the dependencies try to update in production, even though they worked fine locally. We have protocols to catch stuff like that but it’s still a headache that often takes far more effort than it’s worth to have a few patches (same with keeping a Docker clone of production locally which is another nest of problems). So I try to keep updates to dependencies like that contained in their own commits which can be rolled back, and not part of other feature branches or fixes.

I don’t have this problem in other languages nearly as much as JS using NPM/yarn. So I tend to be far less eager to run ‘npm audit’ than I used to.

All great answers thus far. First, it is not for faint of heart. Second, if you get in door, learn how to say no as not every corporate customer is a good one - some can suck you dry and have you customize feature after feature so you need to be strong.

As a previous commenter mentioned, understanding what your product is and your go-to-market motion is super important. Are you a bottom up developer or user-led adoption with ideas to expand or are you going pure top-down enterprise? Either will take time but I've worked with many a company that successfully went from bottom up and generated significant enterprise sales like https://Snyk.io.

If you choose to go top down, find advisors or investors who have relationships at some of your corporate prospects. Going top down super early requires relationships to get in the door. Second, you have to figure out exactly who in the organization you need to get to and understand what is their pain and how you can uniquely solve it. I've seen way too many early stage founders get in the door to explore and they end up hunting for dodo birds - they're extinct and don't exist.

There is so much more on this topic and one method I advocate is focusing on enterprise design partnerships vs. selling which has more of a partnering model than a transatcional one. More on that here in a SaaStr podcast I was on -…

Snyk | https://www.snyk.io/ | Cluj, London, Tel Aviv (all remote) | Full Time
Selected job postings here:

https://snyk.io/careers/all-jobs/?department=4051349002

===

Every day, the world gets more digital thanks to tens of millions of developers building the future faster than ever. But with exponential growth comes exponential risk, as outnumbered security teams struggle to secure mountains of code.

This is where Snyk (pronounced “sneak”) comes in. Snyk is a developer security platform that makes it easy for development teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and cloud infrastructure

— and do it all right from the start. Snyk is on a mission to make the world a more secure place by empowering developers to develop fast and stay secure.

If you are interested, please send your resume to topaz.turkenitz@snyk.io and include "HN: Who is Hiring" in the email subject line.

Yes, shrinkwrapp is a good solution to lock down your dependency versions.
Regarding the security breaches, this is a big problem because, as you mention, there are huge chains of dependencies, and also some of the vulnerabilities are not even in your direct dependency - which makes it hard to fix vulnerabilities.
Snyk recently released stats that found that 14% of npm packages carry known vulnerabilities. Also 64% of our users have found a vulnerability in a private repo, so the chance that your package also contains a vulnerable dependency is quite high.(I work there btw)
We released an open source cli tool that helps you find and fix vulnerabilities in your dependencies tree. You are welcome to try it - https://snyk.io.
You can also take a look at our open source vulnerabilities database with advisories and patches at https://github.com/Snyk/vulndb.