Comments on: 11 open-source projects certified as secure

Under contract with the Department of Homeland Security, Coverity seeks to establish a new security baseline for open-source applications.

[Astinsan]

Potentially secure

Most of these items have the potential of being secure. A improper setting Postfix, php and perl can be disastrous.

I know you were really talking about the source code though. Mature projects are usually pretty good.

[kingttx]

Good point!

That is a good point. Although I was going to use this for a good-hearted jab at some anti-PHP folks on our LUG list, I just can't bring myself to twist up the logic like that. Like you say, bad settings can screw up secure source.

[the osd guy]

Sec Code != Sec App

What about design flaws?
What about info disclosures?
What about denial of service issues?
What about unxepected parse failures?
What about ...

There is more to secure applications than making sure ur buffers are correctly sized. Static analysis cant fully guarentee that and fuzz testing can only verify the product is as reliable as the fuzzer's randomizor logic.