search

chainguard-dev / bincapz

detect malicious program behaviors
Apache License 2.0
386 stars 24 forks source link

Add support for rule licenses that require project URL's in attribution #62

Closed tstromberg closed 2 months ago

tstromberg commented 4 months ago

Blocks #61

While I believe we comply with the original DRL (v1.0 and v1.1), this v1.2 license doesn't separate how attribution can be different between source code and match presentation:

https://github.com/mthcht/ThreatHunting-Keywords-yara-rules/blob/main/LICENSE

While I imagine they had in mind source code attribution, we should aim for the strictest license interpretation, and ensure that we meet these requirements when presenting any matches:

Attribution — You must give appropriate credit to the original author(s) of the Rules, provide a link to the project, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.

While we attribute authors, we don't yet provide links to the project. My thought is: add a RuleURL field. When we present results, we can then attribute it as:

by @mthcht (https://github.com/mthcht/ThreatHunting-Keywords-yara-rules)

tstromberg commented 2 months ago

Done!