Slashdot Mirror
Java Open Review Project
bvc writes "We Launched the Java Open Review Project today. We're reviewing open source Java code all the way from Tomcat down to PetStore looking for bugs and security vulnerabilities. We're using two static analysis tools to do the heavy lifting: the open source tool FindBugs, and the commercial tool Fortify SCA. We can use plenty of human eyes to help sort through the results. We're also soliciting ideas for which projects we should be reviewing next. Please help!"
http://opensource.fortifysoftware.com/welcome.html
You'd think someone asking for community participation would go to the effort of including a link to the community in question. Somehow, I think you'll get out of this request what you put into it.
I Browse at +4 Flamebait
Open Source Sysadmin
Link to the project's homepage
I pity the foo that isn't metasyntactic
Why so many projects?
Why not pick one or two and really run them through the wringer? Most of the heavily used projects like Tomcat have already been viewed by thousands of eyes so a cursory overview probably won't be worth the time
Anyways, good luck
Static analysis becomes virtually unnecessary when you use a proper, statically-typed language like Haskell, Standard ML or OCaml. Furthermore, the use of garbage collection eliminates many of the buffer overruns that plague C and C++ software. Add in proper unit testing, and you're almost guaranteed to have a rock-solid system, developed very economically and often with extremely clean code.
While Java is more difficult to exploit, it is still possible to crash an app (say, a servlet container running a major web site) by sending data in such a way that an array's capacity is exceeded. Of course, that can easily be avoided by using an ArrayList, but there are programmers out there who are unaware of such basic helper classes.
Agreed. May as well just do it in one big hit instead of piece by piece. That way you will have one big mob that will target everything instead of a few dedicated people watching the programs that concern them?
I ate your fish.
And the obvious superiority you've conveyed with your tone is reflected quite nicely in the fact that so few people actually know of (never mind know) any of those languages.
I guess it's tough being extra-right all the time and still being ignored. Sorry.
Slashdot - where whining about luck is the new way to make the world you want.
If a langauge will not let you commit security vilolations through design, then I can say with surity that language is not usable.
Note I am NOT saying Haskell is unusable. What I am saying is that in all the languages you list, it is still possible to create code that by design will be insecure. Any time you take input from a user, and place that input into a database for example, you have an avenue for attack.
As for the suggestion to use an ArrayList instead of basic arrays in Java, it makes me sudder to think of you designing any web systems that may be touched by a high volume of traffic. No wonder you posted AC with such "helpful" advice!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Like +C+?
Thanks for demonstrating that even open-minded coders like yourself still need a good QA team, even if it's just to fix the little language typos...
I thought your "real language" is a rip-off of Java. Sounds like you should learn the *original* real language....
Real language like what C/C++ Grow up man, try to write an ENTERPRISE SYSTEM without a thick client server model using C/C++. Let me know once done.
I'm not a big fan of Java, but to be fair:
Unless you prefer an language in which you can be more productive
Most of the slow development and painful complexity of Java has more to do with complex configuration of the popular application frameworks than the language itself. Our in-house Tomcat/Struts/Hibernate/XDoclet application has nearly 40 different XML configuration files. Java doesn't need any of those XML files beyond the single build file for the Ant build tool.
DOne. Several times over. I wouldn't write anything more complex than Hello World in Java, it just doesn't have the performance.
I still have more fans than freaks. WTF is wrong with you people?
When I go to that page the sidebar overlaps the text of the article. It kinda puts me off that a rant about "good code" is hosted on a page with terrible web design.
I really hate responding to shadows, but here goes:
There's a list of warnings that FindBugs outputs. If you want to claim that static analysis is unnecessary for Haskell or OCaml, then go over the list and say why. It's not enough to just claim by fiat that your favorite language doesn't have that problem and then tell "Blub" to go master it.
An enterprise software with a thin client in c/c++!!!!!!!!!!!! Hats off to you. I love programming and started as c guy but I have no more patience for the reinvention of wheel several times. I like to solve business problems using code
Whoever the heck is kdawson, he certainly does not sound like he is from the many-eyeballs dept.
I've looked into Haskell before. Just scratched the surface, really, but definitely more than "know nothing".
Bold statements like this are bullshit. Any language can benefit from static analysis. How can you seriously claim otherwise? Obviously a language like C would benefit more than Java, and Java would benefit more than Haskell, but no language checks for every possible problem at compile time.
Here's a counter-example to your claims: Catch - Case Totality Checker for Haskell: "A Haskell program may fail at runtime with a pattern-match error if the program has any incomplete (non-exhaustive) patterns in definitions or case alternatives. This paper describes a static checker that allows non-exhaustive patterns to exist, yet ensures that a pattern-match error does not occur."