►
Description
Open software platforms are helping the security industry achieve important goals by enabling better communication, information sharing, and code quality. But open source security differs from other open source communities in a number of ways, as we learned with osquery. During this talk, engineers from the Facebook security team will discuss what they've learned building and supporting the most popular security project on GitHub and how that lead to the development of a new open source project for the GitHub community that will be debuted during this talk.
Marjori Pomarole is a Software Engineer on the Security Infrastructure team at Facebook London. She currently leads development for Invariant Dectector, a security tool for finding and blocking anomalies in write requests on Facebook.
Javier Marcos is a security engineer at Facebook with experience working on both offensive and defensive teams. He is currently a member of Facebook's Detection Infrastructure team and manages the Facebook CTF platform.
About Satellite:
GitHub Satellite 2016 was a celebration of the latest and greatest in development. Watch the recordings to learn how engineers, founders, activists, and beyond tackle the latest and most difficult challenges in software.
For more, join us in San Francisco on September 13th-15th for GitHub Universe, three days filled with the creativity and curiosity of the largest software community in the world.
For more information, go to githubuniverse.com.
A
Alright,
thank
you.
Everyone
for
coming
before
we
introduce
ourselves
Javier
is
actually
going
to
start
setting
up
some
stuff
that
you
guys
don't
have
to
care
about
it
now,
but
we're
going
to
go
back
to
later
at
the
end
of
the
presentation,
and
while
he
does,
I
can
say
that
my
name
is
Marjorie
I
work
in
the
Facebook
London
office
in
our
security
team
and
let's
see,
let's
see
what
he's
doing
there
yeah.
B
A
hello
everyone,
my
name
is
Javier
Marcos
I,
am
security,
engineer
on
facebook
and
I
work
in
the
in
the
headquarters
in
California
and
that
the
talk
today
is
it's
a
little
bit
of
a
compilation
of
how
an
open-source
security
project
that
it's
a
security
project
is
different
from
a
standard,
open
source
project
and
the
main
goals
that
we
want
to
try
to
address
today.
It's
it
they're,
based
on
0
square,
into
experiences
that
the
lessons
we
learned
with
those
query.
B
If
you
haven't
heard
about
those
queries,
a
host
instrumentation
to
is
written
in
C++
and
it's
a
it.
It
runs
in
OS,
X,
Linux
and
very
stunning
windows
and
the
it
has
like
over
six
thousand
stars
and
github.
So
it's
one
of
the
most
popular
security
projects
it
github
and
is
fully
open
source.
It
was
I,
was
developed
within
Facebook,
open
source
in
facebook
and
it
did
open
source
like
a
year
and
a
half
ago.
B
So
the
main
idea
of
this
presentation
is
to
share
some
of
the
lessons
that
we
learned
by
open
source
in
this
tool,
which
was
a
security
tool
and
trying
to
build
us
a
security
community
around
it
and
then
also
we're
going
to
be
open
sourcing
in
order
another
project,
a
new
project
for
the
security,
open
source
project
of
Facebook
and
the
main
motivation
about
like.
Why
would
why
did
you
guys
open
source,
OS
query?
It
could
happen
just
another
tool
that
could
it
was.
B
It
was
developed
inside
and
it
was
just
used
inside
of
facebook,
but
for
us
it
was
kind
of
like
a
game
changer
to
be
the
fact
that
we
did
open
source
OS
query
and
we
did
open
source
it
since
the
very
beginning
of
the
development.
So
everything
was
running
in
the
in
the
open
like
we
have,
the
source
of
truth
is
did
have
we
have
the
problems
box
new
features.
They
are
all
in
github
issues
who
requests
fully
development
there.
B
It
runs
in
github
we
built
based
on
all
who
requests
on
all
comets
with
the
G
top
source
of
truth.
So
everything
is
just
open.
It
is
in
the
it's
as
an
open
source
and
we
managed
to
build
a
very
good
security
community
around
it
and
we
are
going
to
be
as
pointing
out
some
of
the
other
things
that
we
learned
on
how
that
happened
and,
like
I,
said,
host
instrumentation
tool.
It
runs
in
every
single
machine
in
facebook,
corporate
and
production.
B
That's
the
way
that
we
try
to
take
her
like
a
bit
the
bigger
picture
of.
What's
the
ecosystem
of
offices
of
machines
that
we
have
it's
a
it's
parked,
it's
not
just
it's,
not
the
only
security
tool
that
we
have
open
source
in
facebook
is
part
of
more
or
some
like
some
other
tools
like,
for
example,
threats,
change
like
a
threat,
Intel
community
or
infer
it's
a
static
analyzer
for
java
and
objective-c.
So
the
main
idea
is
to
just
you
know:
go
through
that
and
most
part
it
will
be
the
example
yeah.
A
So
here
are
some
stats
on
OS
curry
on
github,
so
these
are
comparing
to
all
of
the
other
open
source
projects
that
Facebook
has
so
out
of
300
300
thousand
followers.
Six
thousands
are
an
OS
curry,
almost
3,000
per
100,000
permits,
600
out
of
50,000
Forks
and
one
out
of
the
411
repos
that
we
have
a
facebook.
So
Facebook
is
very
committed
to
open
sourcing
as
many
projects
that
we
have.
Oh
sorry,.
A
Yeah,
so
those
curry
community,
right
now,
it's
big,
so
we
have
6,000
followers
with
88
contributors
and
a
team
I
sound
like
a
small
number
but
I
think
anyone
that
has
run
a
open
search
project
knows
that
having
88
people
constantly
doing,
pull
requests,
and
you
know
giving
us
features
to
implement
or
feedback
on
the
stuff.
That's
already
implemented.
It's
it's
really
great,
and
the
thing
that
we
want
to
point
out
here
as
well
is
not
just
these
88
contributors
that
are
actually
making
impact
in
the
project.
A
So
the
past
projects
that
facebook
open
sourced-
we
had
this
mentality
that
you
know
everything
needs
to
be
in
the
open
and
people
love
to
talk
about
the
issues
and
do
the
program
press
on
github,
but
because
of
the
nature
of
this
project
and
being
related
to
security.
Not
all
companies
or
individuals
actually
want
to
release,
are
disclosed
stuff
that
they
find
or
might
not
find
with
us
grace.
So
that
was
a
need.
I
need
of
adjustments
to
start
those
private
conversation
channels
for
people
to
that
want
to
contribute.
A
They
want
to
be
involved,
but
they
don't
necessarily
want
to
have
it
on
github,
which
was
was
a
bit
of
a
surprise
right,
but
they
still
are
part
of
the
community
that
actually,
you
know,
try
to
submit
fakes.
They
try
to
help
with
giving
us
feedback,
and
everything
like
that
and
having
all
these
people
helping
us
on
as
create
makes
the
it.
A
So
the
project
actually
has
facebook
as
a
client,
but
all
of
these
other
people
that
are
changing
the
tool
for
day
use
case,
which
is
which
is
great
having
this
project
also
gives
us
the
ability
to
mentor
new
contributors
right
to
that
might
not
necessarily
know
the
technologies
that
iOS
Curie
uses,
but
through
the
pull
request,
that's
a
face
on
github.
We
can,
you
know,
come
up
with
a
strategy
on
how
to
mentor
them
well
how
to
get
them
sped
up
with
C++
and
everything
go
as
curry
uses
it.
So
that's
great
as
well.
B
So
so,
to
talk
a
little
bit
about
the
community
that
has
been
built
around
or
square
in
here,
you
have
three
three
main
examples
of
tools
or
project
that
they're
they're
dipping
their
phone
like
the
foundation
of
this
project,
is
in
sauce.
Query
like
the
first
one
here
is
a
project
from
Naraku
which
it
likes
being
also
contributed
by
github,
and
you
just
have
actually
used
it.
It's
a
it's,
not
an
actual
TLS
endpoint.
So
the
way
the
way
that
house
query
works
is
is
Oscar.
B
Like,
for
example,
spunk
for
water
or
log
stash
for
water,
which
was
like
making
it
run
in
two
agents
in
the
same
machine,
it
wasn't,
it
was
an
ideal.
So
we
we
have
like
with
their
or
0
square
e,
was,
was
able
to
use
to
do
like
lock,
like
configuration,
fetching
and
also
sending
the
logs
out
there
using
the
TLS
plugging,
but
there
was
not
like
a
proper
way
to
do
it.
So
what
Heroku
did
it?
B
Was
they
open
source
their
code
to
do
a
TL
at
some
point
to
distribute
configuration
and
to
receive
the
logs?
So
that's
a
really
really
great
example
of
how
you
can
be
using
or
square
with
as
a
single
agent.
That
does
all
the
work
for
you
and
then
the
other
two
projects.
The
first
central
Central
is
like
a
full
solution
for
IT
management
or
corporate
assets,
management
which
uses
host
query
as
an
agent,
and
they
built
their
own
solution
for
distributing
logs
and
configuration
using
TLS.
It's
a
great
project.
B
The
way
that
we
were
doing
in
facebook
internally
was
like
too
tight
or
infra
to
be
open
sourced,
but
like
there
was
like
yeah.
This
is
something
that
some
other
people
might
want
to
do
it
the
same,
but
we
cannot
really
open
source
or
solution
yet
so
these
guys
just
did
it,
which
witch
is
which
is
great.
A
Well,
so,
after
all
the
great
results
that
we
got
from
open
sourcing,
Oscar
II,
we
need
to
think
about
how
we
can
grow
the
security
community
in
open
source
by
educating
the
next
generation
right.
So,
according
to
times,
apparently
by
2020,
the
security
industry
is
going
to
reach
170
billion,
I'm
guessing
yet
dollars
and
we're
going
to
face
us
staff
shortage
of
1.5
million
professionals.
So
Facebook
started
thinking.
How
can
we
bridge
that
gap
right
and
apparently
sixty
percent
of
my
lime
years?
Don't
actually
know
that
security
is
a
career
path
for
them.
A
So
that's
why
today
we're
actually
very
proud
to
announce
that
we're
going
to
be
expanding
the
facebook,
open
source
security
family
not
just
have
tread,
exchange,
infer
an
aura
scurry.
We
are
open
sourcing,
our
CTF
platform
that
we've
been
using
for
the
past
for
the
past
year
or
so
and
been
developing
for
the
past
one
at
two
and
a
half
years
so
for
taking
stat
bag,
a
CTF.
What
is
a
CTF?
A
It's
a
capture,
the
flag,
competition
and
it's
very
common
in
the
security
community,
where
people
can
capture
countries
to
win
points
and
the
way
you
can
capture
those
countries
is
by
solving
a
few
challenges.
These
challenges
can
be
crypto
challenge,
so
cryptographic
challenge
forensics,
binary,
remote
code
execution,
web
security-
you
can
have
so
you
can
mean
those
challenges,
yeah
points
and
when
the
competition,
so
we've
been
running
this.
For
the
past
two
and
a
half
years
in
a
few
universities,
high
schools
and
a
few
conferences
as
well.
A
Facebook
has
been
running
it
with
this
platform
that
we've
developed
and
it's
been
a
great
success,
not
just
for
the
people
that
have
been
participating
in
this
competitions
and
for
us
because
it's
a
lot
of
fun
people
learn
about
security.
We
get
to
see
what
is
the
next
generation
of
people
in
colleges
and
conferences
that
actually
want
to
be
involved
in
the
community.
A
So,
there's
a
lot
of
there's
a
lot
of
advantage
to
actually
open
sourcing
this
and
allowing
not
just
us
to
go
into
these
and
universities
and
actually
running
this
competitions,
but
give
the
power
to
colleges
how
school
companies
to
go,
use
our
platform
tweak
it
to
the
way
that
they
wanted
and
run
it
themselves.
So
let's
actually
show
you
guys
the
platform.
It's.
A
B
If
the
configuration
works
as
expected
takes
six
to
seven
minutes
now,
it
took
11
minutes,
which
is
the
time
that
it
takes
from
not
having
anything
to
having
a
full
provision
CTF
platform.
So
we
take
care
of
all
that
in
the
provision
in
script
we
do
use
HH
vm
for
the
for
the
back
end,
so
the
code,
the
whole
platform,
is
written
in
hack.
It's
like
the
extension
of
PHP,
the
gps,
p
plus
plus
I'm.
B
Well
like,
for
example,
here
you
can
see
this
is
like
the
deploy
is
based
on
like
this
is
developed
development
mode
which
create
self-signed
keys,
and
then
you
have
like
a
fully
working
city,
a
platform
and
like
that
means
created
by
default
for
the
for
the
for
the
development,
but
for
the
directory.
If
you
can
deploy
it
in
a
production
system
and
then
the
the
password
is
going
to
be
able
to
generate
it
anyway.
B
B
B
When
we
were
developing
this
platform
and
the
other
thing
was
one
would
we
tried
we
work
out?
We
were
having
something
that
he
was
doing
the
trick
for
for
a
while,
and
then
we
decided
to
redesign
re-engineer
the
whole
platform
to
make
sure
that
we
were
actually
using
it
as
a
educational
tool
for
four
to
use
the
code.
That's
an
educational
tool,
so
the
code
is
going
to
be.
B
You
can
you
just
actually
look
at
the
code
base
for
for
for
the
city
of
platform
and
say:
oh
I,
wonder
how
can
you
actually
configure
ssl
the
right
way?
Well,
we
are
trying
to
just
address
every
single
issue
and
every
single
proper
configuration
you
should
do
for
SSL,
for
example,
and
or
how
can
you
just
you
know,
make
sure
that
your
database
is
not
compromised
by
having
a
massive
SQL
injections
in
your
in
your
code
base?
B
We're
we
were
having
this
game
running
like
oh
now,
like
no,
no
on
a
room
which
has
like
people
playing
with
it,
and
then
we
have
another
one
which
was
sitting
on
the
internet.
We
which
was
open
but
like
the
registration
was
talking
eyes.
So
we
kind
of
like
being
able
to
to
give
access
to
that
and
we
have
the
website
that
we
have
is
is,
if
you
want
to
just
play
around
with
it,
you
can
just
spin
it
up
in
your
computer
as
virtual
machine.
B
If
you
want
to
play
with
demo
site
that
we
have,
we
can
you
can
ask
us,
for
a
token,
will
give
you
a
talking
for
the
registration
and
then
you
can
guess
the
grave
access
to
it
so
find
us
afterwards
and
we'll
give
you
access.
The
address
is
demo
dot,
FB,
CTF,
calm
and
well.
That's
a
that's!
That's
pretty
much!
What
we
are
we're
open
sourcing
today
and,
like
I
said,
the
back
end
or
the
platform
takes
care
of
everything
it
does
team
registration.
B
It
provides
you
an
admin
page
that
you
can
actually
manage
the
game
that
is
running
it.
The
game
board
or
game
app
is
the
risk
type
of
thing
and
also
the
scoring
system
it
does
for
people
that
are
familiar
with
CTF
games.
It
does
provide
geo
per
diem,
king
of
the
hill
type
of
games,
and
it's
it's
developed.
The
way
that,
if
you,
for
example,
don't
like
the
world
map
you
I,
you
could
use
the
platform
as
back-end
and
customize
it.
B
The
way
you
want
so
you
just
make
it
sit
on
there
like
the
different
endpoints.
We
have
to
just
send
the
rights
request
and
then
it
will.
It
will
just
use
your
UI
as
the
way
to
display
the
game,
and
also
we
have
a
library
like
a
library
of
challenges
that
you
can
start
using.
So
you
can,
you
can
request
access.
Is
that
some
a
public
yet
because,
basically,
to
prevent
cheating?
If
someone
wants
to
run
those
challenge,
you
know
in
a
competition
if
it's
opening
the
internet,
obviously
the
solution
is
going
to
be
there.
B
So
that's
not
cool.
So
if
you
asked
us
will
give
you
access
fully
access
to
their
to
their
to
the
library
of
challenges
and
as
we
do
with
our
open
source
project,
we
did
a
third-party
security
audit
on
the
actual
application
and
we
will
publish
the
results
of
the
of
the
of
the
pen
test,
which,
surprisingly,
were
we're
pretty
good.
We
we're
not
having
any
of
the
video
or
once
top
ten
thanks
to
probably
xhp
and
HH
vm
good
stuff,
so
on
also,
we
have
flow,
which
is
another
open
source
project
from
from
facebook.
B
It's
a
type
checking
javascript
library,
and
the
other
thing
that
we
are
applying
to
do
is
fully
full
internal
is
internationalization
of
the
platform,
because,
with
being
a
living
with
being
approached
by
a
lot
of
people
from
a
lot
of
places
that
they
want
to
run
this
as
educational
main
theme
for
their
students
from
all
over
the
world
and
one
of
the
things
about
you
know
security
or
cold,
open
sources.
Mostly
the
code
is
reading
in
English,
but,
like
some
other
people
really
need
to
have
like
multiple
options.
B
A
And
on
the
thing
of
people
all
over
the
world
trying
to
get
access
to
it
like
these
are
sort
of
the
use
cases
that
we've
bought
of
people
wanting
to
use
the
CTF
for
so
competitions
people
that
already
run
them
now
can
start
using
it.
So
their
school's
doing
it.
Security
clubs
in
colleges,
lots
of
conferences
so,
for
example,
we're
going
to
use
this
platform
to
run
routes
in
Def
Con
this
year.
A
So
you
can
start
up
a
game.
Put
some
people
to
to
play
the
game,
mass
and
security
professionals
it
can
be
on
which
a
little
bit
more
challenging
more
than
what
may
be
a
high
score.
A
middle
school
would
would
set
it
up
as
and
he
says,
repair
platform
and
as
the
as
an
example
of
career
advantage.
We
have
our
main
did
one
of
the
main
developers
on
the
platform
bhushan.
He
wrote
the
blog
posts
today
about
it.
A
He
said
that,
basically,
when
he
was
in
college,
he
started
getting
to
the
cts
buff
competitions
got
really
interested
in.
It
learned
a
whole
bunch
of
stuff
from
them
guiding
to
the
security
space
and
because
of
those
competitions,
he
also
got
attention
from
whole
bunch
of
country
from
companies
to
to
see
a
lot.
This
guy
knows
what
he's
doing
so.
You
can
plainly
CTFs
putting
them
together.
A
It
can
be
a
great
way
to
you
know,
get
you
into
the
security
space
and
lastly,
Facebook
has
something
called
the
bug
brownie
program
that
we
use
for
white
hats
to
disclose
vulnerabilities,
that
we
have
on
Facebook
and
all
other
apps
that
we
have
so
the
disclose
it
first
to
us
and
get
money
for
it
if
it's
an
actual
vulnerability,
so
we
can
fix
it
in
private
and
then
we
can
disclose
it
publicly.
So
we
are
adding
the
CTF
platform
on
the
bug
bounty
program
as
well.
A
So
if
you
do
play
around
with
it
today
and
you
go
and
find
a
poner
ability,
we
ask
you
to
please
go
through
our
bug.
Bounty
website
first
disclose
it
to
us.
If
you
want
to
help
us
fix
it,
let's
do
it
like.
Then
we
can
start
the
process
of
doing
a
pull
request
on
github.
We
just
want
that
period
of
mitigating
it
like
if
someone
is
actually
going
to
use
this
exploit
as
a
cheating
on
actual
game.