Source code analysis expert Coverity has found and helped fix more than 7,500 security flaws in open-source software, and published a list of the 11 open-source projects working fastest to sort them out.
"We applaud the developers responsible for the 11 open-source projects that have advanced to the second rung of code security and quality," said David Maxwell, open-source strategist for Coverity.
Eleven projects have been awarded the newly announced status of Rung 2, including those known as Amanda, NTP, OpenPAM, OpenVPN, Overdose, Perl, PHP, Postfix, Python, Samba, and TCL. According to Coverity, this new development means users will be able to "select these open-source applications with even greater confidence."
Several other projects are expected to advance to Rung 2 over the next few months. The Open Source Hardening Project began in January 2006 and was expanded early in 2007 to cover a list of 150 projects.
Coverity uses static source-code analysis to spot errors in code, such as open brackets. Projects on Rung 2 will move on to use the company's "satisfiability" techniques, which use a bit-accurate representation of a software system, translating every relevant software operation into Boolean values (true and false) and Boolean operators (such as and, not, or).
Coverity claims this type of analysis is a first in commercial programming and is able to spot hundreds more bugs than the tools available on Rung 1.
Although the project is clearly improving the security of open-source software, some have expressed concern that coverage of its results may produce bad publicity in the form of headlines about security flaws in open-source software.
In terms of security, PHP is horrible. As a programming language it is not much better.
I don't think this is bad publicity for OSS. If anything it is good news. OSS generally takes security seriously and doesn't deny and hide issues and then post fixes only when they have to like many proprietary software companies.
Many things still need to be done... but Microsoft still needs to do many things before they can even think about achieving the status of Rung 1... much less Rung 2.
Web giant is spending $120 million to beef up its Mountain View, Calif., headquarters, according to filings with the city reviewed by the San Jose Mercury News.
The Samsung Galaxy Mini 2 S6500 could make its debut at the Mobile World Congress in Barcelona later this month, according to a leaked promotional image.
MIT creates a simulation to celebrate the 50th anniversary of Spacewar. A relic of the early days of minicomputers, it was one of the first computer video games and set the stage for many others, including Asteroids.
In terms of security, PHP is horrible. As a programming language it is not much better.
I don't think this is bad publicity for OSS. If anything it is good news. OSS generally takes security seriously and doesn't deny and hide issues and then post fixes only when they have to like many proprietary software companies.
Walt
7500 bugs in just the first pass.
What will it be next week? 75,000???