Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Solarwinds Security - Github Concerns

Hello,

Wondering how everyone feels about the impact on security of the Orion SDK and SWQL Studio etc not being available directly from Solarwinds and instead through Github.

Last year was a tough time with the compromise of the official software updates and downloading and running software from Github has me more nervous anyone else?

Are you still using Orion SDK after last year?

I would like to use this feature/service/product but dont feel comfortable in a production environment. Wondering for those using it how you mitigated or accepts risks related to it etc?

Thank you in advance!

Find more posts tagged with

Security

swql_studio

sdk

Comments

m_roberts

What are your concerns on this application being maintained on Github? The idea behind it is for collaboration, with SolarWinds as the owner, as the use of the SDK opens up a wide range of function for the extending of interactivity with the Orion platform.

It is managed and maintained by SolarWinds still, so is it just that it is hosted on Github?

KMSigma.SWI

I may be a SolarWinds employee, but I'm speaking as a consumer as the products in this:

The SDK being moved to GitHub was for a couple of reasons (outlined here), but I prefer that it is isn't an internal "product." The API (which ships as part of the SolarWinds Information Service on the Orion Platform products is handled through traditional releases. However, the SDK (and associated examples) should be able to have contributions from the community.

As of today, only SolarWinds employees (almost exclusively developers and architects) are the only ones who can approve pull requests to have code added to the repository. We aren't the only other organization doing something like this. Microsoft has put its PowerShell development almost exclusively into GitHub. It's where I download my updated bits, where I submit issues, and where I can propose changes if I so desire.

Long story short: I think moving more things to GitHub for community contributions on the Orion SDK was a great move.

shyde

Could be a great move and what you say makes sense to me with my limited knowledge. I was just looking for a discussion if any others had concerns and if they did how they may mitigate the risk. There may be no risk and this isn't meant to be an attack on any product or service.

Its great to have insight from both of you. @KMSigma.SWI I had already read the linked post on SDK move but it was along time ago and prior to last years incident.

Could you tell us if since the last software hack if the process for the SDK security has been modified to be more secure similar to the other software hosted by Solarwinds?

Also could you let us know how we may validate the authenticity?

Any recommendations you would share for mitigating security risks involved with the product or you feel there is none?

Same questions to the community, really appreciate any discussion. Again just to be clear not trying to attack the product, I hope to use it and thought others may have the same question/concerns maybe not and if so that's great.

wluther

@shyde No worries, your questions are most definitely valid, and this community is most definitely here for such questions. I also agree with you, and think other folks may have similar questions too.

Personally, knowing that the official SolarWinds folks are the only folks able to actually make the updates, I see it as a more efficient method to incorporate the ideas of the community while also limiting the number of "chefs in the kitchen", so to speak.

KMSigma.SWI

These are 100% the questions we are all here for. One of the reasons that SolarWinds chose to put the SDK in the public space is to encourage multiple eyes on it. It encourages everyone to find problems, report issues, and contribute. Even though code changes to the SDK would be approved by only a handful of internal developers, that doesn't mean that there aren't hundreds of other people contributing to the process.

That's one of the powers of having this as an Open Source solution for connecting with the SolarWinds Orion API. I, for one, would like to see more and more go into GitHub for community contributions.

As far as "authenticity" goes - nothing is committed to the master tree until a human at SolarWinds reviews it and approves the request. Beyond that, the MSI files that are part of the Orion SDK downloads are built must also be approved by a human - and you can see who approved it and authorized the publishing of the new bits.

Much like the Content Exchanges here on THWACK, the best way (at least for me) to understand new technologies is to work with them.

Quick Links

Custom HTML problem
I have multiple groups, and each group represents a different location. I’m trying to display a location image (hosted on my server) for each group to show its detailed layout. However, I’ve noticed that whenever I modify the HTML/code for one group, the changes are applied to all other groups as well across every group…
Cisco ASR Devices
Cisco ASR Devices.pollerCisco ASR Devices
Basic SWQL Syntax
SWQL is built on the framework of SQL and as such supports most of the standard clauses as part of a query. A very simple example query is: SELECT Caption, IPAddress, Vendor, ResponseTime FROM Orion.Nodes Dissecting this query is relatively straightforward: show some fields (Caption, IP address, Vendor, and Response Time)…
Cisco ASA SSL Tunnels
Active SSL Tunnels-ASA.UnDPThis poller *should* display the number of Active SSL VPN (Anyconnect) Tunnels currently connected to your box. However, I tried it with my 5520 running 8.0.4 and for some reason I get a OID Not Supported. Here's my post in the forum: *EDIT* This is confirmed working with at least Interm release…