Slashdot Mirror
Java Open Review Project
bvc writes "We Launched the Java Open Review Project today. We're reviewing open source Java code all the way from Tomcat down to PetStore looking for bugs and security vulnerabilities. We're using two static analysis tools to do the heavy lifting: the open source tool FindBugs, and the commercial tool Fortify SCA. We can use plenty of human eyes to help sort through the results. We're also soliciting ideas for which projects we should be reviewing next. Please help!"
Why Java, specifically?
http://opensource.fortifysoftware.com/welcome.html
You'd think someone asking for community participation would go to the effort of including a link to the community in question. Somehow, I think you'll get out of this request what you put into it.
I Browse at +4 Flamebait
Open Source Sysadmin
where is teh clicky??
Link to the project's homepage
I pity the foo that isn't metasyntactic
Why so many projects?
Why not pick one or two and really run them through the wringer? Most of the heavily used projects like Tomcat have already been viewed by thousands of eyes so a cursory overview probably won't be worth the time
Anyways, good luck
Static analysis becomes virtually unnecessary when you use a proper, statically-typed language like Haskell, Standard ML or OCaml. Furthermore, the use of garbage collection eliminates many of the buffer overruns that plague C and C++ software. Add in proper unit testing, and you're almost guaranteed to have a rock-solid system, developed very economically and often with extremely clean code.
While Java is more difficult to exploit, it is still possible to crash an app (say, a servlet container running a major web site) by sending data in such a way that an array's capacity is exceeded. Of course, that can easily be avoided by using an ArrayList, but there are programmers out there who are unaware of such basic helper classes.
You realize that they're using static code analysis software, right? Such automation makes it very quick and easy to statically analyze even a complex program.
It's well worth spending even a few hours to statically analyze a piece of software using such tools. Even for very well-coded and heavily used software, these tools will find issues that should often be dealt with. You'll get a few false positives here and there. But overall, the alerts raised will often point one to code that does need to be fixed in some way, or can otherwise be improved. The code may even appear fine via visual inspection, but in certain circumstances it could lead to a crash, or a security breach.
Add in proper unit testing, and you're almost guaranteed to have a rock-solid system, developed very economically and often with extremely clean code.
A statically typed language + unit testing doesn't even come close to guaranteeing a rock-solid system. I'm not real familiar with the compilers of Haskell, ML and OCaml, but I doubt they would do the same amount of static analysis as something like FindBugs. Some for sure, but not all.
And, BTW, when Java people do not use ArrayList, its because they think that can do it better, or they can really do it better, not because they are unaware of the existance of the class.
A statically typed language + unit testing doesn't even come close to guaranteeing a rock-solid system. I'm not real familiar with the compilers of Haskell, ML and OCaml, but I doubt they would do the same amount of static analysis as something like FindBugs.
It is quite clear you're clueless when it comes to Haskell, Standard ML and OCaml. If you did know anything about them or their implementations, you'd know that the amount of static analysis they do is more than comparable to that of many of the commercial static code analysis tools.
The only reason such tools are deemed necessary for Java, C and C++ apps is because those languages just aren't as suited for static analysis as most functional languages. The very act of compiling a Haskell or Standard ML program involves the static analysis that such tools do. When you're dealing with strong, static typing and automatic type inference, you're already performing the vast majority of what the C, C++ and Java static analysis tools do.
Come back once you've used, let alone mastered, one of Haskell, OCaml or Standard ML. Once you have even a basic understanding of the techniques the compilers for such languages use, then you'll see how blatantly wrong you are in your post.
I'm sorry, I thought you wanted them to learn a real langugae.
I still have more fans than freaks. WTF is wrong with you people?
If a langauge will not let you commit security vilolations through design, then I can say with surity that language is not usable.
Note I am NOT saying Haskell is unusable. What I am saying is that in all the languages you list, it is still possible to create code that by design will be insecure. Any time you take input from a user, and place that input into a database for example, you have an avenue for attack.
As for the suggestion to use an ArrayList instead of basic arrays in Java, it makes me sudder to think of you designing any web systems that may be touched by a high volume of traffic. No wonder you posted AC with such "helpful" advice!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Some of the Tomcat code is used by instructors as "how not to program". Tomcat works (I use it in production), but it isn't pretty, nice or elegant code:
c at
http://jroller.com/page/fate?entry=why_i_hate_tom
Like +C+?
Thanks for demonstrating that even open-minded coders like yourself still need a good QA team, even if it's just to fix the little language typos...
I thought your "real language" is a rip-off of Java. Sounds like you should learn the *original* real language....
When you're dealing with strong, static typing and automatic type inference, you're already performing the vast majority of what the C, C++ and Java static analysis tools do.
Vast majority means most, but not all. Thats exactly what I said.
Still, how does that and unit testing guarantee a rock-solid system?
Real language like what C/C++ Grow up man, try to write an ENTERPRISE SYSTEM without a thick client server model using C/C++. Let me know once done.
DOne. Several times over. I wouldn't write anything more complex than Hello World in Java, it just doesn't have the performance.
I still have more fans than freaks. WTF is wrong with you people?
When I go to that page the sidebar overlaps the text of the article. It kinda puts me off that a rant about "good code" is hosted on a page with terrible web design.
An enterprise software with a thin client in c/c++!!!!!!!!!!!! Hats off to you. I love programming and started as c guy but I have no more patience for the reinvention of wheel several times. I like to solve business problems using code
Whoever the heck is kdawson, he certainly does not sound like he is from the many-eyeballs dept.