Fortify: open source software is a security risk for businesses

What exactly _is_ your case?

FindBugs is an excellent tool for java programs. It is easy to use, and totally free. It isn't
hugely sophisticated, but easy to run and very useful. I'm grateful to anyone or any company
who contributes to the existence of FindBugs.

And in at least one OSS project I'm involved in, releases have gone out for years with
hundreds of FindBugs warnings or errors. Not good, but no-one seems to have the time or
interest to fix them. For example, I've got the interest, but not the time.

This seems to reinforce the point that for security-sensitive applications, you *do* need to
look carefully at the track record of the provider, whether OSS or proprietary.