Open-source security moves to next step

RE: Open-source security moves to next step: We applaud the government's efforts at creating code with more integrity. Using Coverity to scan for flaws in the process is a great step, but taking a look at our most recently published Top 5 Most Overlooked Open Source Vulnerabilities it's clear that even with improved coding practices, vulnerabilities remain in the code, largely because the developers had unknowingly used an older, unpatched version of an open source project for which a more secure solution already existed.

Due to overwhelming demands, overtaxed resources and often geographically dispersed development teams, running a code scan for open source vulnerability as part of the build process would quickly identify vulnerable (not improperly coded but insecure) open source, point you to the exact location in the code base where it existed, and further, point you to the fix.

Our belief is that it's better to find out your code is insecure before it hits the market, and your customer base, or before you implement it internally.

We look to the government to take their efforts to the next level by ensuring their newly cleaned up coding process includes secure open source.

--Melisa LaBancz-Bleasdale, Palamida; Posted by: Melisa@... Posted on: 01/14/08 You are currently: a Guest | Members login | Terms of Use