Oracle to 'Fortify' its source code

TalkBack 1 of 2:

Next »

• Thread View
• Flat View

Only problem with Fortify is...

... that it gives you sensless hints and does not have stop. It finds things like name of variable password and does not understand that it is a reference to some mapping (securrity indirection). It does not reciognize that credentials are for JUnit testing only and they are valid only in development environment for automated testing which means they are either configured locally in a file or even hardcoded for convenience. Of coyurse nobody sane deploys tests withy productio.... but some enviornments and some engineers (you would be surprised what positions they hold in corporations) are not quite sane.

Basically, you have to spend quite some time to teach it what is secure what is not in a particular environment. Other than that you could learn coding principles as well as design principles with a book and stop making common mistakes, but that would require "extermination" of dinosaurs who keep doing dumb things on purposee or from laziness or "beacuse we need fast change for operations and that would slow us down".

Posted by: FirstNLastN   Posted on: 12/20/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• INNOV8 2.0: A Business Process Management Simulator IBM Innovate your business' process model, play against the market, compete ... Download Now
• Evaluating Price/Performance of VMware ESX Server on Dell PowerEdge Servers Dell This paper examines the price/performance advantage that enterprises can ... Download Now
• Wireless Lab Delivers Technology and a Better Education Dell Steve Spangler, assistant principal of Middlesboro Middle School in ... Download Now