| |||||||||||
Rate of bugs and rate of security holes are mostly uncorrelatedRate of bugs and rate of security holes are mostly uncorrelatedPosted Mar 6, 2006 16:11 UTC (Mon) by shahms (subscriber, #8877)In reply to: Rate of bugs and rate of security holes are mostly uncorrelated by nix Parent article: Coverity releases first defect survey results
From reading the articles about Coverity's static checker (at least, the articles on the early versions of the Stanford checker), there is no reason to suspect they haven't written domain-specific extensions for at least some of the idioms and API rules of the projects they checked. One of the main points of their tool is making "system-specifc programmer written compiler extensions" relatively easy. The architecture described by those papers is powerful and extensible, able to detect and act on almost-arbitrary pattern rules. It's really a pretty nice architecture as described and I imagine the Coverity tool addresses the most urgent shortcomings of the early implementation.
(Log in to post comments)
|
|||||||||||