Some notes from the Coverity survey [LWN.net]

Some notes from the Coverity survey

Posted Mar 9, 2006 10:33 UTC (Thu) by nelljerram (guest, #12005)
In reply to: Some notes from the Coverity survey by k8to
Parent article: Some notes from the Coverity survey

The method my employer attemped to use was to simply provide the tools for use by various organizations like Red Hat, SuSE, etc. They weren't open source, but we wanted to at least put the tools in their hands to run on whatever projects they felt needed attention, as well as provide a public scanning facility for open source projects to use.
Strangely, we were unable to get anyone to reply with interest.

The only thing strange here is that some people simply refuse to get the point despite an abundance of material everywhere explaining it. The point is freedom.

(Ever heard of a project called BitKeeper?)

to post comments

Some notes from the Coverity survey

Posted Mar 10, 2006 1:32 UTC (Fri) by k8to (guest, #15413) [Link] (1 responses)

This is a reasonable guess as to what happened, but not accurate.

No objections were raised over the closed source nature of the tools. No objections were raised over lack of control. Through my years of working in different parts of the software industry I had direct contacts to many of the right people to consider allocating time to improving security in open tools.

What I got was not objections but utter silence. No counteroffers, no comments, nothing.

The bulk of the staff who work at Linux organizations simply do not
or did not understand the important benefits of static security analysis on tools they are very much interested in selling as secure and reliable.

This is why I say that a summary report comparing hard numbers is much more likely to get attention on this important field.

Some notes from the Coverity survey

Posted Mar 11, 2006 8:40 UTC (Sat) by LetterRip (guest, #6816) [Link]

Well Coverity it appears analysed first, then reported the results. Also I believe for the kernel when the did the first version (a couple of years ago) they provided some fixes to. So that is why they have gotten the attention they have - they proved their value first.

LetterRip